[112270] in cryptography@c2.net mail archive
Re: Death of antivirus software imminent
daemon@ATHENA.MIT.EDU (=?UTF-8?Q?Ivan_Krsti=C4=87?=)
Thu Jan 3 16:26:23 2008
From: =?UTF-8?Q?Ivan_Krsti=C4=87?= <krstic@solarsail.hcs.harvard.edu>
To: Bill Frantz <frantz@pwpconsult.com>
In-Reply-To: <r02010500-1049-E801C0CFB7E911DC83E60030658F0F64@[192.168.1.5]>
Date: Thu, 3 Jan 2008 07:20:01 -0500
Cc: Cryptography <cryptography@metzdowd.com>
On Dec 31, 2007, at 4:46 PM, Bill Frantz wrote:
> My favorite virtual machine use is for the virus to install itself
> as a virtual machine, and run the OS in the virtual machine. This
> technique should be really good for hiding from virus scanners.
It's not, and despite the press handwaving about hypervisor rootkits =20
being the death of all security as we know it, this attack is largely =20=
uninteresting in practice. Repeat after me: it's not a real problem, =20
and it's unlikely to become a real problem.
A walkthrough with pretty pictures, courtesy of the Matasano folk:
=
<http://www.matasano.com/log/930/side-channel-detection-attacks-against-un=
authorized-hypervisors/=20
>
Cheers,
--
Ivan Krsti=C4=87 <krstic@solarsail.hcs.harvard.edu> | http://radian.org
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
