Attention: 'Blue Pill' Prototype Creates 100% Undetectable Malware

By Ryan Naraine
June 28, 2006

A security researcher with expertise in rootkits has built a working prototype of new technology that is capable of creating malware that remains "100 percent undetectable," even on Windows Vista x64 systems.

Joanna Rutkowska, a stealth malware researcher at Singapore-based IT security firm COSEINC, says the new Blue Pill concept uses AMD's SVM/Pacifica virtualization technology to create an ultra-thin hypervisor that takes complete control of the underlying operating system.

Rutkowska plans to discuss the idea and demonstrate a working prototype for Windows Vista x64 at the SyScan Conference in Singapore on July 21 and at the Black Hat Briefings in Las Vegas on Aug. 3.

The Black Hat presentation will occur on the same day Microsoft is scheduled to show off some of the key security features and functionality being fitted into Vista.

Rutkowska said the presentation will deal with a "generic method" of inserting arbitrary code into the Vista Beta 2 kernel (x64 edition) without relying on any implementation bug.

The technique effectively bypasses a crucial anti-rootkit policy change coming in Windows Vista that requires kernel-mode software to have a digital signature to load on x64-based systems.

The idea of a virtual machine rootkit isn't entirely new. Researchers at Microsoft Research and the University of Michigan have created a VM-based rootkit called "SubVirt" that is nearly impossible to detect because its state cannot be accessed by security software running in the target system.

Now, Rutkowska is pushing the envelope even more, arguing that the only way Blue Pill can be detected is if AMD's Pacifica technology is flawed.

"The strength of the Blue Pill is based on the SVM technology," Rutkowska explained on her Invisible Things blog. She contends that if generic detection could be written for the virtual machine technology, then Blue Pill can be detected, but it also means that Pacifica is "buggy."

"On the other hand—if you would not be able to come up with a general detection technique for SVM based virtual machine, then you should assume, that you would also not be able to detect Blue Pill," she added.

"The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices," she explained.

Rutkowska stressed that the Blue Pill technology does not rely on any bug of the underlying operating system. "I have implemented a working prototype for Vista x64, but I see no reasons why it should not be possible to port it to other operating systems, like Linux or BSD which can be run on x64 platform," she added.

Blue Pill is being developed exclusively for COSEINC Research and will not be available for download. However, Rutkowska said the company is planning to organize trainings about Blue Pill and other technologies where the source code would be made available.

Rutkowska has previously done work on Red Pill, which can be used to detect whether code is being executed under a VMM (virtual machine monitor) or under a real environment.

[link to www.eweek.com]