Re: Regarding Xen security....

[Anthony Liguori <aliguori@linux.vnet.ibm.com>]

Mark Williamson wrote:
>>> The vast majority of this is, as Keith Adams put its, "quasi-illiterate
>>> gibberish."
>>>
>>> http://x86vmm.blogspot.com/2006/08/blue-pill-is-quasi-illiterate.html
>>>
>>> Having VT/SVM doesn't really change anything wrt rootkits.  Most of what
>>> is floating around is FUD.  There's nothing you can do today that you
>>> couldn't do before VT/SVM.
>> This is true in some manner, it's just that VT/SVM let a rootkit hide
>> itself pretty well from the operating system that it is already
>> attacking. But no doubt it's FUD. At the other end though, Intel
>> invests a lot of efforts in marketing VT as a synonym for security.
> 
> I always thought the principle behind blue pill was quite sensible.  It's not 
> demonstrating a fundamental flaw / bug in the hardware design (I'm not sure 
> it was originally presented that way, although I've certainly seem it treated 
> as if it did).

I'm a bit bias on the subject but the author did announce her work with 
a paper claiming "100% undetectable malware".  That simply isn't true.

Discussing the practicality of hiding malware is certainly an 
interesting and research worthy topic.  However, IMHO, VT/SVM really 
doesn't make it any easier than it was in the past.

You could always hook the IDT.  That is considerably easier than setting 
up a full VT/SVM environment.

Regards,

Anthony Liguori


> I see it as just a (rather neat and clever) proof of concept to show that the 
> VMX/SVM extensions add a new class of attack and a new stealth mechanism for 
> rootkits; no more no less.  A heads-up to the security community.  And worth 
> pointing out, since existing rootkit detection mechanisms may not be able to 
> detect it once the VMX stealthing is enabled...
> 
> I have a feeling that this research has both been reported to be much more, 
> and much less than it really is.  The important thing is that it doesn't open 
> a new loophole, but does provide a new tool for attackers (and for 
> defenders!).
> 
> Cheers,
> Mark
>