[ISN] 'Blue Pill' Prototype Creates 100% Undetectable Malware

[InfoSec News]

http://www.eweek.com/article2/0,1895,1983037,00.asp

By Ryan Naraine
June 28, 2006

A security researcher with expertise in rootkits has built a working
prototype of new technology that is capable of creating malware that
remains "100 percent undetectable," even on Windows Vista x64 systems.

Joanna Rutkowska, a stealth malware researcher at Singapore-based IT
security firm COSEINC, says the new Blue Pill concept uses AMD's
SVM/Pacifica virtualization technology to create an ultra-thin
hypervisor that takes complete control of the underlying operating
system.

Rutkowska plans to discuss the idea and demonstrate a working
prototype for Windows Vista x64 at the SyScan Conference in Singapore
on July 21 and at the Black Hat Briefings in Las Vegas on Aug. 3.

The Black Hat presentation will occur on the same day Microsoft is
scheduled to show off some of the key security features and
functionality being fitted into Vista.

Rutkowska said the presentation will deal with a "generic method" of
inserting arbitrary code into the Vista Beta 2 kernel (x64 edition)  
without relying on any implementation bug.

The technique effectively bypasses a crucial anti-rootkit policy
change coming in Windows Vista that requires kernel-mode software to
have a digital signature to load on x64-based systems.

The idea of a virtual machine rootkit isn't entirely new. Researchers
at Microsoft Research and the University of Michigan have created a
VM-based rootkit called "SubVirt" that is nearly impossible to detect
because its state cannot be accessed by security software running in
the target system.

Now, Rutkowska is pushing the envelope even more, arguing that the
only way Blue Pill can be detected is if AMD's Pacifica technology is
flawed.

"The strength of the Blue Pill is based on the SVM technology,"  
Rutkowska explained on her Invisible Things blog. She contends that if
generic detection could be written for the virtual machine technology,
then Blue Pill can be detected, but it also means that Pacifica is
"buggy."

"On the other hand—if you would not be able to come up with a general
detection technique for SVM based virtual machine, then you should
assume, that you would also not be able to detect Blue Pill," she
added.

"The idea behind Blue Pill is simple: your operating system swallows
the Blue Pill and it awakes inside the Matrix controlled by the ultra
thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without
restarting the system) and there is no performance penalty and all the
devices," she explained.

eWEEK.com Special Report: The Rise of Rootkits

Rutkowska stressed that the Blue Pill technology does not rely on any
bug of the underlying operating system. "I have implemented a working
prototype for Vista x64, but I see no reasons why it should not be
possible to port it to other operating systems, like Linux or BSD
which can be run on x64 platform," she added.

Blue Pill is being developed exclusively for COSEINC Research and will
not be available for download. However, Rutkowska said the company is
planning to organize trainings about Blue Pill and other technologies
where the source code would be made available.

Rutkowska has previously done work on Red Pill, which can be used to
detect whether code is being executed under a VMM (virtual machine
monitor) or under a real environment.