Here a very interesting topic both for virtualization.info and SECURITY ZERO, my blog about infosecurity.
Quoting from eWeek:
Lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and that can maintain control of a target operating system.
The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.
Once the target operating system is hosted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system, according to documentation seen by eWEEK.
The prototype, which will be presented at the IEEE Symposium on Security and Privacy later in 2006
…
The group said the SubVirt project implemented VM-based rootkits on two platforms — Linux/VMware and Windows/VirtualPC — and was able to write malicious services without detection.
…
The group used the prototype rootkits to develop four malicious services—a phishing Web server, a keystroke logger, a service that scans the target file system for sensitive information and a defense countermeasure to defeat existing VM-detection systems.The researchers also used the VM-based rootkits to control the way the target reboots. It could also be used to emulate system shutdowns and system sleep states.
Read the whole article at source.
My comments on this article at SECURITY ZERO.