Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity
    • Development
    • Networking

    Vitriol Rootkit to Demo at MS BlueHat Hacker Summit

    By
    Ryan Naraine
    -
    October 17, 2006
    Share
    Facebook
    Twitter
    Linkedin

      Microsofts twice-yearly BlueHat hacker summit, running Oct. 19-20, will kick off later this week with a demo of a virtual machine rootkit that can potentially be used to defeat the controversial PatchGuard technology.

      Dino Dai Zovi, a principal at penetration-testing outfit Matasano Security, has been invited to Microsofts Redmond, Wash., campus to showcase a hardware VM-based rootkit called Vitriol that piggybacks on Intels VT-x virtualization extension.

      Zovi, an expert on exploitation techniques, 802.11 wireless attacks and operating system kernel security, will demo the rootkit at the conference, to which select members of the hacking community are invited to brainstorm security issues with Microsoft employees and executives.

      The Vitriol presentation is an expansion of a talk given by Zovi (here as a PDF) at the Black Hat Briefings in Las Vegas in August, and will include a technical explanation of how Intels VT-x extensions can allow malicious hackers to install a “rootkit hypervisor” that invisibly runs the original operating system in a virtual machine.

      Zovi plans to demonstrate how the Vitriol rootkit can migrate a running operating system into a hardware virtual machine on the fly and install itself as a rootkit hypervisor. The malicious code becomes inaccessible to the operating system, maintaining stealth and controlling access to the malware.

      /zimages/5/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

      Zovi, in a blog entry, claimed that hypervisors can also be used to bypass PatchGuard on 64-bit systems, but Stephen Toulouse, a security program manager for Microsoft, explained that PatchGuard prevents modification of the data tables and is not meant to detect hypervisors.

      “In this case, there is nothing [from Zovi] to indicate the attack is even trying to modify the kernel itself, and I confirmed with Matasano thats true,” Toulouse said in an e-mail sent to eWEEK. “Vitriol doesnt defeat kernel patch protection,” he added.

      In response, Zovi cited “confusion” around how or whether hypervisors can bypass PatchGuard and stressed that Vitriol is not an attack against [a weakness in] PatchGuard itself. “[It] is more a demonstration of how a hypervisor controls the entire universe in which an operating system runs and can mislead or lie to any operating system running inside it, thus defeating security defenses running on the guest VM,” he explained.

      Microsoft officials declined to comment on the BlueHat schedule. According to sources familiar with the companys plans, BlueHat v4 will feature a roster of well-known white hat researchers specializing in OS kernel hardening, database security and application threat modeling.

      The source said the company is looking for “new faces” to talk at the two-day event. Researchers who made presentations at BlueHat v3 in March 2006 are being invited back as attendees.

      At the Spring 2006 sessions, the roster of presenters included database security experts David Litchfield and Alexander Kornbrust, Web applications security researcher Caleb Sima, Metasploit founder HD Moore and reverse engineering guru Halvar Flake.

      Moore, Flake and Kornbrust said they will not be attending the sessions this week.

      /zimages/5/28571.gifTo read more about Microsofts BlueHat hacker summits, click here.

      Zovis virtual machine rootkit presentation comes on the heels of a Black Hat demo by stealth malware researcher Joanna Rutkowska of Blue Pill, new technology that is capable of creating malware that remains “100 percent undetectable,” even on Windows Vista x64 systems.

      Rutkowskas Blue Pill prototype uses Advanced Micro Devices SVM/Pacifica virtualization technology to create an ultrathin hypervisor that takes complete control of the underlying operating system.

      Rutkowska, who also showed off a way to defeat the device driver signing requirement in Windows Vista, told eWEEK she has never been invited to speak at Microsofts BlueHat.

      Microsofts own Cybersecurity and Systems Management Research Group has also created a proof-of-concept rootkit called SubVirt that exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.

      This story was updated to include comments from Microsofts Stephen Toulouse.

      /zimages/5/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

      Ryan Naraine

      MOST POPULAR ARTICLES

      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×