'Blue Pill' Prototype Creates 100% Undetectable Malware

PC Magazine (excerpt) ^ | June 28, 2006 | Ryan Naraine

[John Valentine]

Joanna Rutkowska, a stealth malware researcher at Singapore-based IT security firm COSEINC, says the new Blue Pill concept uses AMD's SVM/Pacifica virtualization technology...

I think that Rutkowska may be referring to Linux and BSD running on AMD chips. Unless Intel is using this AMD virtualization technology it appears that Macs may escape.

[Swordmaker]

I think that Rutkowska may be referring to Linux and BSD running on AMD chips. Unless Intel is using this AMD virtualization technology it appears that Macs may escape.

That's why the PING! said "...could..." The new Intel Core processors also have a virtualization layer... it may just be time or secrecy that keeps us from knowing about a rootkit that will work on it.

[mhx]

Love my G4 Mac(s) even more now.

[Salamander]

Without a virus, there'd be no need to buy an antivirus.
Sounds like a perfect self-perpetuating business plan to me......:]

[ShadowAce]

[postaldave]

but at least it doesn't take up so much HD space like the old stupid-fat and bloated subhypervisors.

if women would just start having sex with these virus writing geeks all this crap would come to a grinding stop.

[KoRn]

Damn scary stuff. I believe I had a run in with something similar last year.

I won in the end, but it was a tough fight.

[DesScorp]

" FreeBSD (OS X) could be vulnerable"

I don't think so. Apparently, this relies on AMD processors. Even if Intel adds this kind of virtualization technology to their processors, this particular exploit probably wouldn't work.

[beef]

Sounds to me like a hardware based back door. Shame on AMD.

[Turbopilot]

"You got a problem with my ultra-thin hypervisor, punk??"

[beezdotcom]

If this is stored on the hard drive, boot from a CD, and find it sitting unexecuted on the hard drive.

A *really* good one should first try to write extra instructions to the firmware in your PC, to thwart this sort of detection later.

[Swordmaker]

A *really* good bad one should first try to write extra instructions to the firmware in your PC, to thwart this sort of detection later.

There, fixed it for you.

[rzeznikj at stout]

"if women would just start having sex with these virus writing geeks all this crap would come to a grinding stop."

ROTF!!