4 ms·
But you are signed - you're a vanilla distro kernel booting a custom userspace that fires up the victim OS under virtualisation.
by caf 9y ago
But you are signed - you're a vanilla distro kernel booting a custom userspace that fires up the victim OS under virtualisation.
- Jasper_ 9y agoYou're suggesting a construction like Blue Pill[0], right, where you have a "malware hypervisor"? The concept is known, security people are aware, it's considered moderately infeasible, and multiple techniques can prevent it[1]. [0] https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software) [1] http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-...
- caf 9y agoThat mitigation technique relies on the anti-malware executable starting before the malware does.