From: Paolo Bonzini <pbonzini@redhat.com>
To: Yang Luo <hsluoyc@gmail.com>, qemu-devel <qemu-devel@nongnu.org>
Subject: Re: [Qemu-devel] Making Qemu/KVM more undetectable to malwares
Date: Wed, 2 Mar 2016 10:22:18 +0100 [thread overview]
Message-ID: <56D6B0CA.4080703@redhat.com> (raw)
In-Reply-To: <CAFc5gye36ADsM4H7y=7OTT__8qQ4H4DeWhCxRHkRpAuV57Y0og@mail.gmail.com>
On 02/03/2016 04:07, Yang Luo wrote:
> And how about this idea. I found out that lots of malware will detect
> the presence of hypervisors and refuse to refuse to execute their real
> code in a VM. The malwares do this to prevent security engineers from
> analyzing their code under a VM. Lots of detection methods have been
> proposed for many years. But hypervisors seem to not care about this issue.
>
> So what do you think about making Qemu/KVM more undetectable to
> malwares? Is this idea viable?
KVM already allows you to disable CPUID leaves specific to hypervisors.
As you said, other detection methods for hypervisors exist, and patches
are welcome to thwart them. :)
However, while it is definitely a nice project and we would appreciate
it, it doesn't sound like the kind of research that you would publish in
academic venues.
Paolo
prev parent reply other threads:[~2016-03-02 9:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-02 3:07 [Qemu-devel] Making Qemu/KVM more undetectable to malwares Yang Luo
2016-03-02 9:22 ` Paolo Bonzini [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56D6B0CA.4080703@redhat.com \
--to=pbonzini@redhat.com \
--cc=hsluoyc@gmail.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.