‘Blue Pill’ Prototype Creates 100% Undetectable Malware

A security researcher with expertise in rootkits has created a working prototype of new technology that is capable of creating malware that remains “100 percent undetectable,” even on Windows Vista x64 systems.

Joanna Rutkowska, a stealth malware researcher at Singapore-based IT security firm COSEINC, says the new Blue Pill concept uses AMD’s SVM/Pacifica virtualization technology to create an ultra-thin hypervisor that takes complete control of the underlying operating system.

Rutkowska plans to discuss the idea and demonstrate a working prototype for Windows Vista x64 at the end at the SyScan Conference in Singapore on July 21 and at the Black Hat Briefings in Las Vegas on August 3.

The Black Hat presentation will occur on the same day Microsoft is scheduled to show off some of the key security features and functionality being fitted into Vista.

Rutkowska said the presentation will deal with a “generic method” of inserting arbitrary code into the Vista Beta 2 kernel (x64 edition) without relying on any implementation bug.

VM Rootkits: The Next Big Threat? Click here to read more.

The technique effectively bypasses a crucial anti-rootkit policy change coming in Windows Vista that requires kernel-mode software to have a digital signature to load on x64-based systems.

The idea of a virtual machine rootkit isn’t entirely new. Lab rats at Microsoft Research and the University of Michigan have created a VM-based rootkit called “SubVirt” that is near impossible to detect because its state cannot be accessed by security software running in the target system.

Now, Rutkowska is pushing the envelope even more, arguing that the only way Blue Pill can be detected is if AMD’s Pacifica technology is flawed.

“The strength of the Blue Pill is based on the SVM technology,” Rutkowska explained on her Invisible Things blog. She contends that if generic detection could be written for the virtual machine technology, then Blue Pill can be detected, but it also means that Pacifica is “buggy.”

Read the full story on eWEEK.com: ‘Blue Pill’ Prototype Creates 100% Undetectable Malware