SubVirt - the prototype of the next generation malware
Below is a MRR and PLR article in category Internet Business -> subcategory Security.
SubVirt: The Future of Next-Generation Malware
Overview:
SubVirt is a groundbreaking research initiative by Microsoft, in collaboration with the University of Michigan, aiming to revolutionize computer malware with a prototype that could define future threats.
Introduction to SubVirt:
Recent years have seen a decline in traditional computer viruses like macro and script viruses, but there's been a surge in more sophisticated threats. Trojans, backdoors, rootkits, and spyware have risen sharply, with spyware alone increasing from 54.2% to 66.4%.
The Rise of Rootkits:
Rootkits are now highly regarded in the malware world. They enable hackers to control infected computers from afar, typically for financial theft or Distributed Denial of Service (DDoS) attacks. In Windows, rootkits refer to malware hiding techniques within the system. In Unix systems, they are often rewritten commands that conceal data, such as altering the 'ls' command to omit particular files.
There are two types of rootkits: user-mode and kernel-mode. User-mode rootkits are standard processes that are usually easier to detect and eliminate. Kernel-mode rootkits, however, are embedded in the operating system, making them much harder to find and eradicate.
The SubVirt Research Project:
Conducted by Microsoft and the University of Michigan, SubVirt explores a new frontier with the Virtual Machine Based Rootkit (VMBR). A Virtual Machine (VM) acts as a software layer between the hardware and the operating system, even running the operating system itself in user mode. In this setup, a rootkit could insert itself between the OS and the hardware, gaining full control over the system.
For a VMBR to function, it must activate before the operating system by modifying the Master Boot Record (MBR). Once initiated, the VM would boot up first, running the OS in a virtual environment. This setup could potentially manage two operating systems simultaneously: the user’s Windows OS and an undetectable malware OS.
Challenges and Considerations:
A significant drawback of this malware type is the impact on system performance. Tests by Microsoft revealed that system startup time increased by about 30 seconds, and it consumed approximately 3% of system resources. Additionally, the virtual machines used in these tests were about 100 megabytes in size, far exceeding the capacity of a typical MBR.
For further details, the complete research dossier is available for download [here](http://www.eecs.umich.edu/~pmchen/papers/king06.pdf).
You can find the original non-AI version of this article here: SubVirt - the prototype of the next generation malware.
You can browse and read all the articles for free. If you want to use them and get PLR and MRR rights, you need to buy the pack. Learn more about this pack of over 100 000 MRR and PLR articles.