5 ms·
A "vPro" application for McAfee might, for instance, be to embed the AV engine in a slim hypervisor layer, invisible to the OS, and to have it report status to
by moe 16y ago
A "vPro" application for McAfee might, for instance, be to embed the AV engine in a slim hypervisor layer, invisible to the OS, and to have it report status to a mothership using the AMT engine.
Nice. A vendor controller hypervisor with full access to the system and supposedly no way for the user to alter or inspect the code it runs...
What could possibly go wrong.
- wccrawford 16y agoActually, my first thought was "Man, that would be a great spot for a virus." If other code can get in there, why not?
- tptacek 16y agoWhich sums up approximately 5 consecutive years of Black Hat Vegas and DC presentations on rootkits.
- tptacek 16y agoAV hypervisors are no harder or easier to inspect than any other piece of closed-source software. The world runs on closed-source, from Cisco and Juniper routers to NetApp storage appliances to WinAPI OS's. This is no more (or less) sinister than any of that. Intel seems almost fastidious about not imposing this stuff on Linux; from what I can tell, almost all of this stuff is open to Linux kernel developers to take advantage of. So mostly I think you're just FUD'ing for karma.