Microsoft Research Warn About VM-Based Rootkits
According to a story on eWeek, lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and maintaining control of a target OS. The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation. Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system.
It seems that Brad Pitt and Angelina Jolie are spreading the rootkit love with the German DVD release of Mr. & Mrs. Smith. This DVD uses a copy protection mechanism that is being described as using “rootkit-like cloaking technology.” The DVD uses Settec Alpha-DISC copy protection that manages to hide its processes, but it does not hide any files. So it isn’t as bad as Sony’s recent rootkit blunders, at least in practice.