Malware will not be detected

A rootkit security researcher has successfully developed a prototype of a new technology that allows the creation of "100% invisible" malware, even for x64 systems like Windows Vista.

Joanna Rutkowska - an expert in "hidden" malware technology at security firm COSEINC based in Singapore - said the new technology Blue Pill using AMD's virtualization technology can help. create a very small software that is capable of controlling the entire operating system. It cannot be detected.

Rutkowska plans to present his new idea at the SyScan Conference to be held in Singapore at the end of July and at the Black Hat Conference in the US in early August.

The idea is not new

Malware will not be detected Picture 1 Rutkowska has revealed that the new technology relies on a "generic method" dynamic solution to insert some binary code into the Vista kernel Beta 2 (x64 edition) without generating any errors. This technique has helped to overcome the changes in Windows Vista's anti-rootkit policy.

The idea of a virtual machine rootkit is not new. Microsoft and Michigan University researchers created a rootkit based on the virtual machine technology called SubVirt. This is a rootkit that cannot be detected because security software cannot access its status.

Now, Rutkowska continues to develop this technology. However, the expert also confirmed that Blue Pill could be detected if AMD's Pacifica technology failed.

Where does the power come from?

" The strength of Blue Pill is due to SVM technology ," Rutkowska explained. If the "generic" detection capability is added to virtual machine technology, Blue Pill will lose its invisible capabilities. But this only makes sense when AMD's Pacifica technology fails.

" On the other hand, if you cannot add generic detection techniques to SVM on a virtual machine platform, you will never be able to detect Blue Pill ."

"The idea of the Blue Pill is very simple: Your operating system swallowed a Blue Pill and it will work in a Matrix controlled by a tiny Hypervisor Blue Pill. This happens directly when operating system, does not affect other devices . "

Rutkowska also emphasized that Blue Pill is not based on any errors that exist in the operating system. Blue Pill technology will be proprietary to COSEINC Research and will not be publicly available. But Rutkowska said her firm also plans to organize training on the new technology and will reveal the technology source in such training courses.

Hoang Dung

technology blue

David Pac

Update 26 May 2019

You should read it

May be interested

What is Safe Malware? Why is it so dangerous?
remote access trojan (rat) is a type of malware that allows hackers to monitor and control the victim's computer or network.
Can a VPN Fight Malware?
sure, a vpn can help you maintain your privacy and security online. but can it protect you from malicious programs? can a vpn keep you safe from malware and viruses like antivirus vendors do?
How to fix Chrome 'Failed - Virus Detected' error on Windows
are you getting the 'failed - virus detected' error when downloading specific files through chrome? this problem usually occurs when chrome or windows defender detects a virus in a potentially malicious file that you are downloading.
Why is Infostealer malware the biggest new malware concern?
often distributed in a malware-as-a-service model, infostealer malware is often used to steal data, remaining hidden for as long as possible.
How to fix 'Hard Drive Not Detected' error on Windows
if you start your pc as usual, but instead of the usual desktop screen, you encounter the hard drive not detected error message on windows.
Why VPNs Are Getting Detected More Than Ever
have you noticed that your vpn is being detected more often than before? unfortunately for vpn users, websites, companies, and governments have more techniques than ever to detect vpn use, so they are no longer as invisible as they used to be.
What is Malware? What kind of attack is Malware?
guide you how to recognize malware, how to prevent malware and as well as what to do when you encounter a malware infected website.
The 4 most common ways to spread malware today
if there's one thing that poses a threat to all users of technology, it's malware. this malware can be extremely dangerous, harmful, and comes in many different forms.
How to fix 'Screen overlay detected' error on Android device
sometimes you will see a 'screen overlay detected' message when using android, this error does not allow certain applications to launch, which is annoying for users.
How to fix Windows Has Detected An IP Address Conflict error
are you facing the windows has detected an ip address conflict error when connecting your computer or laptop to a wireless network or through an ethernet cable? here are 3 ways to fix windows has detected an ip address conflict error.

Malware will not be detected

You should read it

May be interested

Computer security