Security Threats 3 Levels Beyond Kernel Rootkits 264
Posted
by
kdawson
from the close-to-the-machine dept.
from the close-to-the-machine dept.
GhostX9 writes "Tom's Hardware has a long interview with security expert Joanna Rutkowska (which is unfortunately split over 9 pages). Many think that kernel rootkits are the most dangerous attacks, but Joanna and her team have been studying exploits beyond Ring 0 for some years. Joanna is most well known for the BluePill virtualization attack (Ring -1) and in this interview she chats a little bit about Ring -2 and Ring -3 attacks that go beyond kernel rootkits. What's surprising is how robust the classic BluePill proof-of-concept is: 'Many people tried to prove that BluePill is "detectable" by writing various virtualization detectors (but not BluePill detectors). They simply assumed that if we detect a virtualization being used, this means that we are "under" BluePill. This assumption was made because there were no products using hardware virtualization a few years ago. Needless to say, if we followed this way of reasoning, we might similarly say that if an executable makes network connections, then it must surely be a botnet.'" Rutkowska says that for her own security, "I don't use any A/V product on any of my machines (including all the virtual machines). I don't see how an A/V program could offer any increased security over the quite-reasonable-setup I already deployed with the help of virtualization." She runs three separate virtual machines, designated Red, Yellow, and Green, each running a separate browser and used for increasingly sensitive tasks.
o.k. (Score:1, Funny)
i was gonna write something about [o]ver[k]ill but I'm not in the mood anymore. 3 VMs??? ahahahahahahahhahahahha ROFL ahahahahhahahahah (sorry, I can't help it) .. ahahahahahhahahaha
* burn karma, burn *
Why? (Score:5, Funny)
"...interview with security expert Joanna Rutkowska (which is unfortunately split over 9 pages)"
Why oh why did they split Joanna into 9 pages?! Thats so cruel!
Also, First Post
Three Separate Virtual Machines (Score:4, Funny)
There's careful, there's paranoid, and there's three separate virtual machines.
security is ... (Score:4, Funny)
Re:Why? (Score:5, Funny)
Re:Why? (Score:2, Funny)
Best. Centerfold. Ever?
Re:huh? (Score:3, Funny)
Re:o.k. (Score:5, Funny)
Re:in all do respect (Score:3, Funny)
I'd be careful. She doesn't use AV.
Re:o.k. (Score:5, Funny)
I guess it's true that what you don't know can't hurt you.
Okay, so, you're walking through your house, right? And you think, "I know, I think I'll make some pancakes", so you go to the kitchen. But what you don't know is there's an ANGRY GRIZZLY BEAR in your cupboard next to the flour.
Re:o.k. (Score:3, Funny)
Re:o.k. (Score:5, Funny)
Okay so at my school we have faculty advisers that are assigned to students according to their last names. The faculty advisers help students with scheduling conflicts, general questions, help with internships/employment, etc. My adviser is named Jess Depew and she's pretty hot. I don't have a picture that could do her justice at the moment. She's like 25 and she's only been at the school a few years. Anyway, I have been looking into getting an internship at a TV station or something over the summer, and the school helps coordinate these things with an internship database that's maintained by the advisers. You log on with your school ID and password and you can browse internships and stuff. I was having trouble logging on to mine so I went to go see Ms. Depew. That's where all the trouble started.
Firstly, I walked into office like 15 minutes early like an idiot and she's in the middle of lunch. So I awkwardly make stupid stall talk until she's finished.
"Oh, hey, what are you eating?"
"Salmon. I love it. I eat it practically everyday."
"Just salmon? That's pretty weird." Why the hell did I say this?
"Oh, well, I don't know. I try to eat healthy, natural foods...you know, like wild berries and honey and stuff."
"Yeah, I like food too." *facepalm*
Man, I was so nervous. Anyway, we finally begin squaring my stuff away. She looks up what I registered with in the beginning of the year. This is when the crap really hit the fan. This is how the conversation went:
"Okay, your account name is [my name] and your password is ...'depewissexy'..."
Oh damn. I completely forgot that I put that as my password in the beginning of the year. What the hell was I thinking? It was probably the longest 20 seconds of my life before I finally got my balls together to stand up and leave. Just as I walk out the door she says,
"In the future, you might want to bear in mind what kind of things you want keep to yourself."
I was so freaking embarrassed I wanted to kill myself right then and there. I wanted to run the hell out of there and never, ever see her again. But something about what she just said kept me standing in her doorway. I decided to man up and apologize. I turned to her, looked her straight in the eyes, and swallowed my pride. And then, it hit me like a train full of bricks.
She was eating Salmon.
She tries to eat all healthy, natural foods, like wild berries and honey.
She told me that I might want to bear in mind what kind of things I want to keep to myself.
Ms. Depew was a bear disguised as a human.
Immediately, the bear saw that I had seen through its charade. It roared loudly and took a menacing swipe at me. I deftly avoided its claw and sprinted out of the office. The bear was soon in chase, crashing through the walls of the office as if they were made of paper. I jumped over the receptionist desk and ran out the back entrance. The bear followed, tossing the secretary aside like a rag doll. The bear began to pursue me through the street traffic. While I fought my way through the maze of vehicles, the bear simply careened its massive force through anything standing in its way. Cars veered off the road to escape the onslaught of grizzly force that was barreling down the road. The bear was gaining fast. I had no other option but to make my way into the nearest building: a preschool. I burst through the door, startling the children from their naps. Immediately, the bear slammed through the wall, crushing a child beneath his massive paws and burying several other children in sheet rock and debris. I maneuvered my way through the chaos towards the back exit. The pre-schoolers were little more than a screaming annoyance for the bear. Its massive paws cut swaths through the sea of toddlers with each swipe. I used the precious time these children had afforded for me to make my escape into the playground. I scrambled up a ladder to a fort-like structure. My goal was to walk across the monkey bars then jump to a tree which I could climb
Re:Well... (Score:1, Funny)
Heresy! Microsoft is incapable of doing anything intelligent.
Re:I have to agree it is idiotic (Score:2, Funny)
Welcome to Computer Science, where the guys are guys and the girls are guys.
Re:o.k. (Score:3, Funny)