4 ms·
The dangerous part: once they have the ability to tamper with the kernel, they can chainload another operating system and functional as a poisonous bootloader.
by caf 9y ago
The dangerous part: once they have the ability to tamper with the kernel, they can chainload another operating system and functional as a poisonous bootloader.
Here's the bit I don't get: even if you can't be used as a chainloading malware bootloader, can't you still be used as a slightly more complicated malware bootloader that fires up the victim OS under virtualisation?
- gruez 9y agounder secureboot, you would need to get that boot loader signed
- caf 9y agoBut you are signed - you're a vanilla distro kernel booting a custom userspace that fires up the victim OS under virtualisation.
- Jasper_ 9y agoYou're suggesting a construction like Blue Pill[0], right, where you have a "malware hypervisor"? The concept is known, security people are aware, it's considered moderately infeasible, and multiple techniques can prevent it[1]. [0] https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software) [1] http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-...
- caf 9y agoThat mitigation technique relies on the anti-malware executable starting before the malware does.