Can Malware Hide Indefinitely?
Can rootkit malware that hides by mimicking a software-based virtual machine ever be detected? That was the topic of debate as security researchers presented their latest findings to packed audiences at the Black Hat Conference here. Joanna Rutkowska, researcher at the firm Invisible Things, was the one who famously ignited the keen interest in virtualized rootkits after she described and demonstrated her rootkit creation, called Blue Pill, at last year’s Black Hat. Wednesday, Rutkowska returned to Black Hat to acknowledge that researcher Edgar Barbosa has come the closest to devising a method for detecting Blue Pill. “Congratulations to Edgar,” she said, during the highly technical presentation she made with her colleague, researcher Alexander Tereshkin. Rutkowska said she and her colleague hadn’t found a way yet to evade Barbosa’s so-called counterbased detection method as detailed in a paper he made public in July at the SyScan conference. Rutkowska also said she is posting the Blue
