The Network Security. Org

Subversive SubVirt

The IT security world is in something of an uproar - there's a lot of discussion about a supposedly undetectable rootkit which uses virtual machine technology. The real question is, what's all the clamor about, and do we really need to worry?

The development of the rootkit, which works at a level below the operating system, was developed at the University of Michigan in a project sponsored by Microsoft. It became public knowledge after the IEEE Symposium on Security and Privacy conference materials were published - they included the proof of concept.

The basic idea from Michigan is that malicious code can be taken beyond the bounds of the user's operating system. To do this, it creates an additional layer (a virtual machine monitor (VMM)) between the operating system and the hardware. Once the VMM is installed and when the machine is booting, control is passed from BIOS to VMM, bypassing the normal load sequence of the user's actual operating system. Once accomplished, all interaction between the user and the hardware will take place via the VMM. Viruslist.com - Analyst's Diary

More News

• HTTPS Cookie-Hijacking Tool CookieMonster Gobbles Personal Data
  



• Anatomy of a botnet
  



• Microsoft patches 8 critical bugs in Windows, Office
  



• Virtualization users should expect more attacks
  



• Threat From DNS Bug Is not Over, Experts Say
  



• Website infection rate triples
  



• How to Use Honeypots to Improve Your Network Security
  



• Microsoft Patch Tuesday Targets 26 Application Flaws
  



• SSL VPNs might not be as secure as you think
  



• 8 tips to filter spam effectively
  



• Onus on IP address owner to prove innocence
  



• How to install an SSH Server in Windows Server 2008.
  



• Several vulnerabilities closed in the Linux kernel
  



• 8 Best Practices for Encryption Key Management and Data Security
  



• Free Honeypot Client Could Sting Malware
  



• What Firewalls Do & Donot Do
  



• Symantec fingers D Link for bot attacks
  



• WhiteHat: 90% of Sites Still Vulnerable
  



• Red Hat releases free security code
  



• A new type of Bluetooth security