3 ms·
You're suggesting a construction like Blue Pill[0], right, where you have a "malware hypervisor"? The concept is known, security people are aware, it's consider
by Jasper_ 9y ago
You're suggesting a construction like Blue Pill[0], right, where you have a "malware hypervisor"? The concept is known, security people are aware, it's considered moderately infeasible, and multiple techniques can prevent it[1].
[0] https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
[1] http://northsecuritylabs.blogspot.com/2008/06/catching-blue-pill.html http://northsecuritylabs.blogspot.com/2008/06/catching-blue-...
- caf 9y agoThat mitigation technique relies on the anti-malware executable starting before the malware does.