Security: Window Vista's Kernel not that secure

Security: Window Vista's Kernel not that secure

I know it seems really strange that I'm writing about Windows Vista, but yesterday I've read some interesting stuff about Windows Vista, specially about it's kernel.

You might not know, but Microsoft has implemented a policy system within the vista's kernel, where kernel-mode software will (errr..should) only be loaded if they have a digital signature.
This is the way Microsoft found to harden their kernel against malware, such as kernel mode rootkits. (If you are interested in rootkits you might want to have a look on the post Rootkits: now a generalised threat)

Although Microsoft claimed that the new feature was pretty secure (so typical of them), last friday, Joanna Rutkowska presented a talk at the black hat conference called, "Subverting Vista Kernel For Fun And Profit", where she showed that she was able to load unsigned modules into the kernel. Now what's even cooler is that she didn't exploit any obscure vista functionality or unknown bug, she just use raw disk access to change some pagefiles!

But Joanna couldn't present only that attack vector, being a well known security researcher with interests in rootkits, she presented an application called "Blue pill", which takes advantage of AMD's hardware virtualization in order to on the fly create a Virtual Machine where the OS runs.
Blue Pill virtualizes the operating system beneath the Hypervisor, which is then used to intercept system calls and execute the code the attacker wants. This means that the virtualization is made at processor level, not at userland or kernel level, which makes the detection really hard.
Joanna also stated that with some work the concept can be brough to the new Intel chips.

Like the other attack vector, this one doesn't exploits directly a problem in vista, still it brings vista to the knees. And with some work, it might work with any operating system. Now this sounds probably one of the most interesting, yet dangerous, attack vectors presented in the last years. A truly undetectable rootkit..

Related:

• Black Hat Conference
• Information about 'blue pill'
• Joanna Rutkowska webpage
• News at internet news