SubVirt: implementing malware with virtual machines

By Samuel T. King, Peter M. Chen, Yi-Min Wang, Chad Verbowski, Helen J. Wang, Jacob R. Lorch. 2006

499 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Backdooring Convolutional Neural Networks via Targeted Weight Perturbations (2018, background): “More modern attacks implement strategies such as dumping the original operating system on a virtual machine, making it a guest OS and making the rootkit the host OS [17].”
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity (2010, background): “Furthermore, successful VM escape attacks [14], [57] as well as the emerging hypervisor rootkits [7], [24] greatly exacerbate the current situation.”
Lares: An Architecture for Secure Active Monitoring Using Virtualization (2008, background): “Similarly, the SubVirt attack [17] is not possible because it was not designed to handle nested virtualization.”
SMM rootkits: a new breed of OS independent malware (2008, background): “The VMBR threat was analyzed by [1].”
A survey of intrusion detection techniques in Cloud (2013, unknown): “BLUEPILL (Rutkowska, 2006), SubVir (King et al., 2006) and DKSM (Bahram et al.”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, background): “[27] proposes the VM-based rootkit (VMBR) which can be dynamically inserted under an existing OS.”
Security issues in cloud environments: a survey (2014, background): “Well-known VM escape attacks include SubVirt [140], BLUEPILL [237] and Direct Kernel Structure Manipulation (DKSM) [24].”
Designing and Implementing Malicious Hardware (2008, background): “The recent SubVirt project shows how to use virtual-machine monitors to gain control over the operating sys-tem (OS) [11].”
A survey on security issues and solutions at different layers of Cloud computing (2012, unknown): “By compromising the lower layer hypervisor vulnerabilities, attacker can gain control over installed VMs. E.g. Bluepill, SubVirt and DKSM are some well-known attacks on virtual layer.”
Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction (2007, methodology): “[39] proposes the notion of VM-based rootkit (VMBR) which can be dynamically inserted underneath an existing OS.”
Cloud Hooks: Security and Privacy Issues in Cloud Computing (2011, background): “Memory modification during migration presents other possibilities such as the potential to insert a VM-base rootkit layer below the operating system [ 35 ].”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, background): “Malware that installs a malicious type 1 hypervisor is called a virtual machine-based rootkit ( VMBR ) [30, 31].”
The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures (2017, methodology): “SubVirt was shortly followed by Blue Pill [51].”
CloudVisor: retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization (2011, methodology): “On the negative side, virtualization has also been used as a means to mount attack traditional operating systems and virtualization system [32, 50, 51].”
Dune: Safe User-level Access to Privileged CPU Features (2012, unknown): “For example, VT-x has been suggested as a tool for creating rootkits [29] that are challenging to detect.”