Microsoft refutes hypervisor attack claim

Submit

Senior Microsoft security strategist Steve Riley has used the vendor's Tech.Ed conference in Sydney this week to rebut claims by a Polish researcher that Microsoft's hypervisor software could be maliciously replaced on PCs without administrators knowing.

Microsoft's Steve Riley
(Credit: Microsoft)

The hypervisor is the portion of Microsoft's operating system that controls virtual operating system instances. Researcher, Joanna Rutkowska, has caused a debate over the past several years about developing a hypervisor rootkit that could go undetected on a PC.

"Her insistence is that you can replace the hypervisor without anybody knowing... Our assertion is that this is incorrect," Riley told the audience. "First of all, to do these attacks you need to become administrator at the root. So, that's going to be, on an appropriately configured machine, an exceedingly difficult thing to happen."

Even if an attacker's malware did gain root access, therefore allowing them to replace the hypervisor, the replacement itself would be an imperfect copy, according to Riley.

"Because you (the attacker) didn't subject your own replacement hypervisor through the thorough design review that ours did, I'll bet your hypervisor is probably not going to implement 100 per cent of the functionality as the original one," he said. "There will be a gap or two and we will be able to detect that."

An attacker's malware would also behave differently to the original hypervisor, resulting in changes to network, processing and disk activity, which should cause alarm bells for security professionals.

"I mean, the whole reason for doing this is so you can take over the machine," he explained. "It is entirely possible to detect if the root operating system has been compromised and if the hypervisor has been replaced."

So where does that leave the security professional who manages these systems? According to Riley, exactly where they were before the rise of virtual machines.

"You have to ask: is there malware on my system? You can be 100 per cent certain there is no malware that you can detect, but less than 100 per cent certain that there is no malware at all. Now, ladies and gentlemen, isn't this true of every computer we already have? There is no difference just because it's virtualisation.

"Don't let the hype machines cloud your understanding of what you need to do. Apply your knowledge to the next evolutionary step, but don't expect that everything you have learned is something you have to throw away."

Talkback

Quick Poll

What is the biggest data management challenge in your organisation?

Inconsistent data and overlapping sources
Rising management and maintenance costs
Scaling the database to meet business needs
Handling analysis of streaming data
Complexity in data security auditing and reporting databases
Inability to keep up with growth in requirements

ZDNet Australia Live

by http://t.co/vmlQ0Ecb: Lax data privacy laws hurt Australia: Australia may be setting a bad example and limitin... http://t.co/G0fEMhs7

1 minute ago by InternetTechSec on twitter, retweet

LinkedIn posts strong Q4 earnings, up in after hours trading http://t.co/TJSBmtlT

1 minute ago by EssenteeWeb on twitter, retweet

Twitter now available in emergencies with satellite providers: Twitter is being pumped up to save the day with t... http://t.co/Oz2xsX0K

1 minute ago by twymy on twitter, retweet

Microsoft plans to release a flavour of Windows 8 on ARM chips http://t.co/10rKSoAs

6 minutes ago by zdnetaustralia on twitter, retweet

RT @zdnetaustralia: Why a $25 computer means revolution http://t.co/ufWQdLzT

11 minutes ago by WauloK on twitter, retweet

Senator Conroy imposes limits on amount of spectrum telcos can buy at Digital Dividend auction: http://t.co/PD7DNr4r

11 minutes ago by janeburton80 on twitter, retweet

Reminders: Be aware and beware @facebook's #rules. You could lose valuable rights | http://t.co/chuIKcIq | via @ZDNet | #socialmedia #smm

15 minutes ago by eeWeeProduction on twitter, retweet

Facebook: 60 million users access apps via mobile http://t.co/jLxQXuQM

15 minutes ago by islandmobile on twitter, retweet

Windows 8 Consumer Preview due February 29: why it's not called beta http://t.co/MEAZzVA6

15 minutes ago by Timothy_Hughes on twitter, retweet

RT @ldignan: New post: LinkedIn posts strong Q4 earnings, up in after hours trading http://t.co/Q95IUhzo

15 minutes ago by TDefren on twitter, retweet

RT @Timothy_Hughes: Windows 8 Consumer Preview due February 29: why it's not called beta http://t.co/sbPX5RwT

15 minutes ago by Angry_Saguaro on twitter, retweet

http://t.co/JaYhkJjV

15 minutes ago by ThaRebeliouZ on twitter, retweet

Armageddon of War 1.5 (Mobile): Top Hit Game for everybodyIdea is simple,Collect red items, Avoid green objects,... http://t.co/BqJhQRiO

15 minutes ago by Sheldonisms on twitter, retweet

Court agrees to speed up case over #Google's privacy policies http://t.co/hCf5CbQT | RT @ZDNet | #privacy

15 minutes ago by ChoiceZnewZ on twitter, retweet

RT @ZDNet: Facebook admits it needs to fight scams more efficiently http://t.co/O7DvYt87

15 minutes ago by InformaFinance on twitter, retweet

Twitter now available in emergencies with satellite providers http://t.co/dZUPbpj1

15 minutes ago by Tuiteventos on twitter, retweet

RT @zdnetaustralia: Why a $25 computer means revolution http://t.co/ufWQdLzT

15 minutes ago by techinbusiness on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

15 minutes ago by davidhickman13 on twitter, retweet

Facebook: 60 million users access apps via mobile: By Emil Protalinski | February 9, 2012, 10:01am PST Summary: ... http://t.co/Nq0TvzJY

15 minutes ago by Rothschild999 on twitter, retweet

New website hopes to improve the Federal datacenter consolidation process: New website hopes to bring together I... http://t.co/5yeK9VMO

15 minutes ago by datacenters on twitter, retweet

iPhone commands better resale value than Android or Blackberry: @danjames2012 I find it hard to believe that som... http://t.co/GryjHpQZ

15 minutes ago by RazMattic on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

15 minutes ago by nowdoit2011 on twitter, retweet

Court agrees to speed up case over Google's privacy policies http://t.co/NQxH2Ktq

16 minutes ago by informatica411 on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

16 minutes ago by spm221 on twitter, retweet

Why a $25 computer means revolution http://t.co/ufWQdLzT

16 minutes ago by zdnetaustralia on twitter, retweet

Twitter now available in emergencies with satellite providers: http://t.co/FxfaiPqi

16 minutes ago by rtehrani on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

16 minutes ago by acnMobility on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

16 minutes ago by john_fotiadis on twitter, retweet

Facebook admits it needs to fight scams more efficiently http://t.co/AHU5iPKV

16 minutes ago by JeffsTeamFreedm on twitter, retweet

Lenovo posts strong Q3 results: By Larry Dignan, ZDNet US on February 10th, 2012 (14 mins ago) Lenovo reported s... http://t.co/Ld0J83UF

21 minutes ago by LocalMobile911 on twitter, retweet

There is (or at least will be) a better way to fly ;-) http://t.co/SKyfCiiO

21 minutes ago by waldemarhein on twitter, retweet

Lenovo posts strong Q3 results - Lenovo reported strong fiscal third quarter results as its PC market share crept up... http://t.co/9jDMsMQD

21 minutes ago by pcrepairs_au on twitter, retweet

Google readying cloud storage service - Communications - News - ZDNet Australia http://t.co/1Tqkrzfa

26 minutes ago by SeasonalTrend on twitter, retweet

Lenovo posts strong Q3 results - Business - News - ZDNet Australia http://t.co/wApzMLes

26 minutes ago by SeasonalTrend on twitter, retweet

Google is reportedly getting ready to take on Dropbox with its own cloud-based storage service http://t.co/qEoMRSk4

26 minutes ago by zdnetaustralia on twitter, retweet

invention these appreciate Every using after Numerous Not well ordering customer any custom route do make these current can consider of N...

32 minutes ago by gurbapagnonna on Abetz shifted in reshuffle

I'd say a reasonable amount of it would be. In the Queensland Department of Education's case, it said it was trying to make as much of it...

1 hour ago by suzanne.tindal on The application nation

Great article, Suzanne—couldn’t agree more. It is only logical for organisations – private or public-- to take a long, hard look �...

1 hour ago by kashe on The application nation

Every example of action against child molesters in this story related to internet protocols other than the www. This filter then achieves...

2 hours ago by Bob.H on Interpol defends voluntary filter

Soooo... it's okay for Apple to demand use of technologies and designs falling under competitors patents (considered "standards"), but on...

10 hours ago by MoWeb on Apple wants new rules for mobile patents

But I am having an intelligent conversation young fibes, my point is the lofty goal that all are equal is unfortunately not so. That is w...

12 hours ago by Doubt on NBN Co inks $620m satellite deal

May be so, but we do need to lighten up some of these people who are so serious. poor old fibretech nearly brings tears to the eyes and j...

12 hours ago by Doubt on Turnbull decries 'Rolls-Royce' satellites

The latest MS Windows update for XP tries hard to persuade you to update. For those machines that already have IE8 loaded it tries to re-...

13 hours ago by brak on Windows XP clings on as dominant OS

Will be interesting to see if he drives the qld gov political IT agenda or looks to address the IT challenges being faced by qld gov agen...

13 hours ago by Flly on Queensland's CIO returns to the post

So angry! NOKIA has forgotten the main purpose and the user function, and instead prioritised their industry level concerns. I bought my...

13 hours ago by spaceagesoup on Nokia skips Australia in Symbian Belle roll-out

I get what you mean in your context, meski. If the filter is like speed cameras, then people can alternately take side streets and back r...

15 hours ago by techkid on Interpol defends voluntary filter

Remind me again how people can get to a leadership position with absolutely no practical knowledge? I would ask Alexander how he intends...

15 hours ago by cleversoap on Internet won't always be anonymous: ITU

I was reading about DMARC at http://www.unlocktheinbox.com/resources/dmarc.aspx, perhaps they should try to implement something like this...

17 hours ago by wpfn on Phishing scam causes Telstra email woe

As you can tell, I'm a big follower. For AFL read NRL.

17 hours ago by phildobbie on The TV Now aftermath

Im not sure if David Gallop realises he now works for the AFL.

17 hours ago by katerich on The TV Now aftermath

That assumes that people see the stop sign. If you're using proxies, or whatever *all* the time, then these stop signs will never be obs...

18 hours ago by meski on Interpol defends voluntary filter

The advanced remote controlled machines reduce the human working rate from hazardous environment.

18 hours ago by Manasy on Robotic mining worth its high cost: Rio

Internet connection rate tremendously increasingly a lot.

18 hours ago by Manasy on Optus unveils NBN small business plans

content producers see Quickflix as a cheap and effective way of distributing copy-protected content in the Australian market.

18 hours ago by Manasy on Quickflix looks to avoid Netflix's failures

After this it could be very easy to identify the vulnerability products.

18 hours ago by Manasy on Body scanners coming to airports in July

This story has been voted 20 times in the last 24 hours!

2 days ago, Symantec confirms hacker extortion

This story has been voted 10 times in the last 24 hours!

2 days ago, Symantec confirms hacker extortion

Keep up with ZDNet Australia

Inside ZDNet Australia

ZDNet / Security / Story

Microsoft refutes hypervisor attack claim

Topics

Top related stories

Related gallery

Related stories

Talkback

Resource Centre Useful content from our premier sponsors

Quick Poll

ZDNet Australia Live

Facebook Activity

Keep up with ZDNet Australia

ZDNet Events Calendar

Plan Comparison

Sponsored resources

Inside ZDNet Australia

Services