Bitter News For VM Users, There's a Rootkit Made Just For You

With every innovation comes a setback, sometimes vitriolic in nature. Virtual machine (VM) technology is a good case in point.

VMs are growing in popularity by leaps and bounds. We'll see more and more VM technology to the point that it becomes common place, probably even on everyday users' desktops. The benefits of VMs are manifold and the drawbacks are few, the most significant of which is undoutedly the cost of acquiring hardware to leverage VM power.

Intel introduced its Intel's VT-x technology for x86 processors which basically an extends processor architecture to fascilitate better VM behavior. Of course potential intruders can't stand by idle why VMs take over servers and eventually desktops. They need their inroads, or so they think anyway. Be assured that there is definitely active on-going progress in developing ways to usurp VM technology to insidious purposes. So security professionals need to keep pace, or preferrably outpace the inroads made by "the bad guys."

One set of researchers have managed to develop a rootkit, appropriately named Vitriol, that demonstrates how its possible to coopt Intel's VT-x. In effect, Vitriol takes over as a the host OS and moves the original host OS into the mode of guest OS, transparently without the computer user's knowledge. The team gave a presentation of Vitriol at the recent Black Hat conference in Las Vegas. At least some of the team are slated to attend Microsoft'invitation-only Blue Hat conference, which is taking place this week, to present their work in more detail.

Writing in Monasato's blog, Dino Dai Zovi, gives an introduction to the presentation:

Zovi clarified the previous introduction statements:

Vitriol has got to be unnerving to Intel, and Microsoft too for that matter. I think this is just the beginning of what we'll see relating to hypervisor exploitation. Stay tuned.