Helu. I'm Thomas Ptacek, one of the four challenge team members --- Slashdot left out Dino Dai Zovi, who kicked this off by writing a virtualized rootkit at Matasano last year.
Joanna has responded to our challenge [blogspot.com]. We invited her to stipulate any terms she deemed reasonable. She proferred:
Five (5) laptops instead of two (2), as a defense against lucky guessing.
We can't crash the machines in the process of testing.
We can't spike the CPU on the machine for more than one (1) second.
We have to open source our detector, and she'll open source her rootkit.
We have to arrange to have her paid between $384,000 and $416,000, and wait six months.
You can probably predict our response [matasano.com].
Here's where it stands: all parties agree that by Black Hat '07, Blue Pill will not be in a state where it is hard to detect. Our detection techniques are likely to detect Blue Pill at Black Hat. Blue Pill requires six months of engineering time to get to a state where Joanna is confident that we can't detect it.
Here's why you care: a few weeks ago, Microsoft decided that Vista Home would not allow virtualization, in part because of the threat of virtualized malware. To the best of our knowledge, there have been two (2) real hypervisor rootkits ever produced: Joanna's Blue Pill, and Matasano's Vitriol. Neither has ever been seen in the wild, because neither has been released to the public. Meanwhile, our team is preparing to demonstrate at Black Hat this year that hypervisor malware is actually even easier to detect than the kernel malware operating systems like Vista are already exposed to.
Joanna's Blue Pill work, along with all the rest of her work (check out this project [matasano.com], where she turns AMD security hardware against forensics devices), is top-notch. In a weird, secretive space like security, this is how science gets done. Joanna chooses a side: it's possible to make undetectable malware. We square off on the opposite side. Then we debate it using code, presentations, papers, and I guess Slashdot stories. Hopefully, in the end, we all learn something.
Hope this stays interesting for everyone. Thanks for paying attention!
"We would expect an industry standard fee for this work, which we estimate to be $200 USD per hour per person."
I have never heard of a programmer being paied 200$ an hour... Perhaps I should have stayed in Computer Engineering rather than switch to Electrical?
That's not what she'd be paid, it's what she would bill. Typically the difference between wage and billing rate is a factor of about 3. For example, I'm paid ~$30/hr, but my company bills ~$100/hr for my time. The difference covers administrative costs (like support staff) and other overhead (like rent and equipment). How do you think receptionists get paid?
"We would expect an industry standard fee for this work, which we estimate to be $200 USD per hour per person."
I have never heard of a programmer being paied 200$ an hour... Perhaps I should have stayed in Computer Engineering rather than switch to Electrical?
<shrug> I'm often billed out at more than $200 per hour as a programmer skilled in security. My employer keeps most of that, of course. Were I working freelance I couldn't bill that much, but I could easily get $100, and I'm nowhere near as good as Rutkowska and her colleagues. My company has plenty of people that are in her league, and they bill out at over $400 per hour.
Security engineering and research is a fairly well-compensated field, because it takes a certain kind of person and it requi
I haven't watched too much of this debate so far, but assuming you're being honest with your post (hey, I haven't background checked you!) I want to extend some sincere Kudos to you and her for having this kind of competition in the security industry, diametrically opposed, and NOT resorting to childish name-calling or logical fallacies. I see a ton of research teams contradicting each other on a daily basis online and often they take things very personally. It brings me a rare bit of optimism to see two tea
Five laptops, one with her stuff, and the other four with benign virtualization.:-)
I mean, really, how are you to be sure it isn't just something like VMWare?
Testing for specific products has problems. The list of products is unbounded and unknowable. (VMWare, Virtual PC, Parallels, Qemu+KVM... and even future products) Her malware can pretend to be Qemu+KVM, and how would you know it isn't?
Because an operating system running on Qemu behaves differently, in measurably quirky ways, than one running under (a) VMWare, (b) Virtual PC, (c) Intel VT-X Virtualization and (d) native hardware. Validating that assertion is the point of the challenge.
How I'm sure it's not just something like VMWare is that we wrote a hardware-virtualized rootkit ourselves and saw Joanna's talk last year and have read everything else Joanna has produced and, to the extent that the word of "yet another security researche
Being somebody else in the field, I have to call bullshit on that one. Sorry.
You can detect a VM. Well, you can if you ignore the issue of Crusoe-like processors and you have an external time reference.
You can not detect intent.
Suppose I hacked VMWare to be malicious. I can do this; it is but a bit of reverse engineering. Then what, you'd recognize that I had hacked VMWare to be malicious? Sure, would you like to sell me a bridge too?
I'm not sure we're talking about same "field", if you think what Joanna is doing is infecting something like VMWare. Joanna is using the trap-and-exec virtualization extensions of the AMD hardware to hide code and intercept system activity. She's not installing a dynamic-code-rewriting full-scheduling virtualization package on the machine.
Hardware virtualization works at a layer above software virtualization. Unless VMWare is now using VTX/SVM (ring -1), you can install a VTX/SVM hypervisor over VMWare (ri
Of course VMWare is using VTX/SVM now. Qemu definitely does, at least on a Linux host. Other products do as well. Virtualization goes beyond Joanna-style and VMWare-style uses. Think about DRM. Think about stopping people from cheating in online games. Now you may call this malware, but you won't get everybody to agree with you. These products can be really thin low-overhead VMs. They can let the OS punch right through to native hardware.
VTX/SVM makes things easy. Everybody and their dog will write a VM. You
I have no idea why you are assuming that it is hard to differentiate between Qemu and Blue Pill, Blue Pill and VMware, or for that matter VMWare and Parallels. But the fact that you think Transmeta is an obstacle for us, when Transmeta supports neither the AMD nor Intel hardware virtualization extensions in question, tells me we're simply on a different wavelength. I'll take you at your word that there's some important point you're making. If you'd like to produce a hardware-virtualized rootkit for us to (a
You misread. Of course you can identify these current, existing, unmodified products. It's damn easy. You're not producing a tool that can identify a malware VM in a reliable way. Your tool is completely unsuitable for including in something like a commercial malware detection tool. You'll get false positives on new (future) technology. (new non-malware VMs, and new Crusoe-like CPUs with the CPU itself looking like a VM) You'll get false negatives on "known" VMs that have been hacked.
DefCon is way easier to attend. It's cheap and we need only 1 vacation day to attend. Blackhat costs an arm an a leg and, last I checked, was in the middle of the week.
No problem is so large it can't be fit in somewhere.
The State Of The Challenge So Far (Score:5, Informative)
Helu. I'm Thomas Ptacek, one of the four challenge team members --- Slashdot left out Dino Dai Zovi, who kicked this off by writing a virtualized rootkit at Matasano last year.
Joanna has responded to our challenge [blogspot.com]. We invited her to stipulate any terms she deemed reasonable. She proferred:
You can probably predict our response [matasano.com].
Here's where it stands: all parties agree that by Black Hat '07, Blue Pill will not be in a state where it is hard to detect. Our detection techniques are likely to detect Blue Pill at Black Hat. Blue Pill requires six months of engineering time to get to a state where Joanna is confident that we can't detect it.
Here's why you care: a few weeks ago, Microsoft decided that Vista Home would not allow virtualization, in part because of the threat of virtualized malware. To the best of our knowledge, there have been two (2) real hypervisor rootkits ever produced: Joanna's Blue Pill, and Matasano's Vitriol. Neither has ever been seen in the wild, because neither has been released to the public. Meanwhile, our team is preparing to demonstrate at Black Hat this year that hypervisor malware is actually even easier to detect than the kernel malware operating systems like Vista are already exposed to.
Joanna's Blue Pill work, along with all the rest of her work (check out this project [matasano.com], where she turns AMD security hardware against forensics devices), is top-notch. In a weird, secretive space like security, this is how science gets done. Joanna chooses a side: it's possible to make undetectable malware. We square off on the opposite side. Then we debate it using code, presentations, papers, and I guess Slashdot stories. Hopefully, in the end, we all learn something.
Hope this stays interesting for everyone. Thanks for paying attention!
Re: (Score:1, Funny)
Re: (Score:1)
anyway, let us know when Joanna responds to your response to her response.
Re: (Score:1)
Re: (Score:3, Interesting)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
"We would expect an industry standard fee for this work, which we estimate to be $200 USD per hour per person." I have never heard of a programmer being paied 200$ an hour... Perhaps I should have stayed in Computer Engineering rather than switch to Electrical?
<shrug> I'm often billed out at more than $200 per hour as a programmer skilled in security. My employer keeps most of that, of course. Were I working freelance I couldn't bill that much, but I could easily get $100, and I'm nowhere near as good as Rutkowska and her colleagues. My company has plenty of people that are in her league, and they bill out at over $400 per hour.
Security engineering and research is a fairly well-compensated field, because it takes a certain kind of person and it requi
Re: (Score:1)
Re: (Score:2)
I see a ton of research teams contradicting each other on a daily basis online and often they take things very personally. It brings me a rare bit of optimism to see two tea
better condition (Score:2)
I mean, really, how are you to be sure it isn't just something like VMWare?
Testing for specific products has problems. The list of products is unbounded and unknowable. (VMWare, Virtual PC, Parallels, Qemu+KVM... and even future products) Her malware can pretend to be Qemu+KVM, and how would you know it isn't?
Re: (Score:2)
Because an operating system running on Qemu behaves differently, in measurably quirky ways, than one running under (a) VMWare, (b) Virtual PC, (c) Intel VT-X Virtualization and (d) native hardware. Validating that assertion is the point of the challenge.
How I'm sure it's not just something like VMWare is that we wrote a hardware-virtualized rootkit ourselves and saw Joanna's talk last year and have read everything else Joanna has produced and, to the extent that the word of "yet another security researche
Re: (Score:2)
You can detect a VM. Well, you can if you ignore the issue of Crusoe-like processors and you have an external time reference.
You can not detect intent.
Suppose I hacked VMWare to be malicious. I can do this; it is but a bit of reverse engineering. Then what, you'd recognize that I had hacked VMWare to be malicious? Sure, would you like to sell me a bridge too?
Re: (Score:2)
I'm not sure we're talking about same "field", if you think what Joanna is doing is infecting something like VMWare. Joanna is using the trap-and-exec virtualization extensions of the AMD hardware to hide code and intercept system activity. She's not installing a dynamic-code-rewriting full-scheduling virtualization package on the machine.
Hardware virtualization works at a layer above software virtualization. Unless VMWare is now using VTX/SVM (ring -1), you can install a VTX/SVM hypervisor over VMWare (ri
Re: (Score:2)
Virtualization goes beyond Joanna-style and VMWare-style uses. Think about DRM. Think about stopping people from cheating in online games. Now you may call this malware, but you won't get everybody to agree with you. These products can be really thin low-overhead VMs. They can let the OS punch right through to native hardware.
VTX/SVM makes things easy. Everybody and their dog will write a VM. You
Re: (Score:2)
I have no idea why you are assuming that it is hard to differentiate between Qemu and Blue Pill, Blue Pill and VMware, or for that matter VMWare and Parallels. But the fact that you think Transmeta is an obstacle for us, when Transmeta supports neither the AMD nor Intel hardware virtualization extensions in question, tells me we're simply on a different wavelength. I'll take you at your word that there's some important point you're making. If you'd like to produce a hardware-virtualized rootkit for us to (a
Re: (Score:2)
You're not producing a tool that can identify a malware VM in a reliable way. Your tool is completely unsuitable for including in something like a commercial malware detection tool. You'll get false positives on new (future) technology. (new non-malware VMs, and new Crusoe-like CPUs with the CPU itself looking like a VM) You'll get false negatives on "known" VMs that have been hacked.
As for producing a hardw
BTW, why Blackhat instead of DefCon? (Score:2)