VMTN Blog

We seem to be writing a lot about Blue Pill for something that's pretty hypothetical at this point.

A bit of background if you haven't been following this: Blue Pill is theoretical/proof of concept rootkit that uses virtualization -- a hypervisor architecture -- to insert itself and hide under your operating system.  Previous coverage on the VMTN Blog here, here, and here.

Here are excerpts from a longer background explanation by VMware's Beng-Hong Lim.

First off, it is important to understand that this threat targets the operating system.  It is not about vulnerabilities in virtualization. ... An interesting implication of the study is that operating systems that are already running in virtual machines are actually less vulnerable. ... A bare-metal style virtualization system, such as VMware ESX Server, does not have a general-purpose host OS, and is not vulnerable to the same attack points as on Windows and Linux operating systems.

A lot of claims have been made at this point, with hype as well as scoffing about undetectable rootkits. I know that you can't prove that something will never happen, but the computer scientists I talk to say this is very unlikely. The basic argument, most recently laid out by VMware's own Keith Adams and collaborators, is that it's easy to detect that you're inside a virtual machine, and in fact it's much easier to detect a hypervisor than to hide one. The disparity is so great that this isn't the same cat-and-mouse game that is being played with current malware. Here the good guys always stay ahead.

Recent work on applications ranging from realistic honeypots to stealthier rootkits has speculated about building transparent VMMs -- VMMs that are indistinguishable from native hardware, even to a dedicated adversary. We survey anomalies between real and virtual hardware and consider methods for detecting such anomalies, as well as possible countermeasures. We conclude that building a transparent VMM is fundamentally infeasible, as well as impractical from a performance and engineering standpoint.

Joanna Rutkowska, Blue Pill author, now has released a new version of Blue Pill as well as this blog post, wherein she claims that (and here I am paraphrasing in a slightly snarky way):

• her real point is that a monolithic kernel like Windows Vista is always going to be vulnerable to some sort of attack (OK)
• just detecting you're on a hypervisor is different than detecting that you're on an evil hypervisor (OK, but if you're on a hypervisor, first of all, you're now talking about vulnerabilities in ESX Server vs Windows, and eventually the hypervisor has to talk to the physical hardware and can detect that, as Thomas Ptacek explains here. Thomas seems to have taken the title of chief blue pill debunker along with colleagues Nate Lawson and Peter Ferrie. )
• some theoretical methods of detecting a hypervisor don't work so well in the real world, or at least in her hands (OK, I buy that as well -- theory doesn't always do well meeting reality; however, as Keith explains in here, they are really defending themselves against a straw man, not a real detection method)
• and if we have to resort to building in Symantec anti-rootkit technology into a hypervisor we've failed as well. (And again, with no disrespect to the fine ladies and gentlemen of Symantec, I'll agree with that too.)

OK, I've agreed with all of Joanna's points, but I don't think they've done much to convince me, the technical layman, that a completely undetectable rootkit is possible. 

If you want to dive deep on this topic, don't stop with misleading articles in the tech press. Go straight to the sources like this and this and this.