Creating modern blue pills and red pills

Asaf Algawi; Michael Kiperberg; Roee Leon; Amit Resh; Nezer Zaidenberg

Creating modern blue pills and red pills

Asaf Algawi, Michael Kiperberg, Roee Leon, Amit Resh, Nezer Zaidenberg

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

5 Scopus citations

Abstract

The blue pill is a malicious stealthy hypervisor-based rootkit. The red pill is a software package that is designed to detect such blue pills. Since the blue pill was originally proposed there has been an ongoing arms race between developers that try to develop stealthy hypervisors and developers that try to detect such stealthy hypervisors. Furthermore, hardware advances have made several stealth attempts impossible while other advances enable even more stealthy operation. In this paper we describe the current status of detecting stealth hypervisors and methods to counter them.

Original language	English
Title of host publication	Proceedings of the 18th European Conference on Cyber Warfare and Security, ECCWS 2019
Editors	Tiago Cruz, Paulo Simoes
Publisher	Curran Associates Inc.
Pages	6-14
Number of pages	9
ISBN (Electronic)	9781912764280
State	Published - 2019
Externally published	Yes
Event	18th European Conference on Cyber Warfare and Security, ECCWS 2019 - Coimbra, Portugal Duration: 4 Jul 2019 → 5 Jul 2019

Publication series

Name	European Conference on Information Warfare and Security, ECCWS
Volume	2019-July
ISSN (Print)	2048-8602
ISSN (Electronic)	2048-8610

Conference

Conference	18th European Conference on Cyber Warfare and Security, ECCWS 2019
Country/Territory	Portugal
City	Coimbra
Period	4/07/19 → 5/07/19

Keywords

Forensics
Information security
Virtualization

Cite this

@inproceedings{a53b4492e91e400ba9c9c245bc6a063a,

title = "Creating modern blue pills and red pills",

abstract = "The blue pill is a malicious stealthy hypervisor-based rootkit. The red pill is a software package that is designed to detect such blue pills. Since the blue pill was originally proposed there has been an ongoing arms race between developers that try to develop stealthy hypervisors and developers that try to detect such stealthy hypervisors. Furthermore, hardware advances have made several stealth attempts impossible while other advances enable even more stealthy operation. In this paper we describe the current status of detecting stealth hypervisors and methods to counter them.",

keywords = "Forensics, Information security, Virtualization",

author = "Asaf Algawi and Michael Kiperberg and Roee Leon and Amit Resh and Nezer Zaidenberg",

note = "Publisher Copyright: {\textcopyright} 2019, Curran Associates Inc. All rights reserved.; 18th European Conference on Cyber Warfare and Security, ECCWS 2019 ; Conference date: 04-07-2019 Through 05-07-2019",

year = "2019",

language = "אנגלית",

series = "European Conference on Information Warfare and Security, ECCWS",

publisher = "Curran Associates Inc.",

pages = "6--14",

editor = "Tiago Cruz and Paulo Simoes",

booktitle = "Proceedings of the 18th European Conference on Cyber Warfare and Security, ECCWS 2019",

}

Algawi, A, Kiperberg, M, Leon, R, Resh, A & Zaidenberg, N 2019, Creating modern blue pills and red pills. in T Cruz & P Simoes (eds), Proceedings of the 18th European Conference on Cyber Warfare and Security, ECCWS 2019. European Conference on Information Warfare and Security, ECCWS, vol. 2019-July, Curran Associates Inc., pp. 6-14, 18th European Conference on Cyber Warfare and Security, ECCWS 2019, Coimbra, Portugal, 4/07/19.

Creating modern blue pills and red pills. / Algawi, Asaf; Kiperberg, Michael; Leon, Roee et al.
Proceedings of the 18th European Conference on Cyber Warfare and Security, ECCWS 2019. ed. / Tiago Cruz; Paulo Simoes. Curran Associates Inc., 2019. p. 6-14 (European Conference on Information Warfare and Security, ECCWS; Vol. 2019-July).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Creating modern blue pills and red pills

AU - Algawi, Asaf

AU - Kiperberg, Michael

AU - Leon, Roee

AU - Resh, Amit

AU - Zaidenberg, Nezer

PY - 2019

Y1 - 2019

N2 - The blue pill is a malicious stealthy hypervisor-based rootkit. The red pill is a software package that is designed to detect such blue pills. Since the blue pill was originally proposed there has been an ongoing arms race between developers that try to develop stealthy hypervisors and developers that try to detect such stealthy hypervisors. Furthermore, hardware advances have made several stealth attempts impossible while other advances enable even more stealthy operation. In this paper we describe the current status of detecting stealth hypervisors and methods to counter them.

AB - The blue pill is a malicious stealthy hypervisor-based rootkit. The red pill is a software package that is designed to detect such blue pills. Since the blue pill was originally proposed there has been an ongoing arms race between developers that try to develop stealthy hypervisors and developers that try to detect such stealthy hypervisors. Furthermore, hardware advances have made several stealth attempts impossible while other advances enable even more stealthy operation. In this paper we describe the current status of detecting stealth hypervisors and methods to counter them.

KW - Forensics

KW - Information security

KW - Virtualization

UR - http://www.scopus.com/inward/record.url?scp=85070002371&partnerID=8YFLogxK

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85070002371

T3 - European Conference on Information Warfare and Security, ECCWS

SP - 6

EP - 14

BT - Proceedings of the 18th European Conference on Cyber Warfare and Security, ECCWS 2019

A2 - Cruz, Tiago

A2 - Simoes, Paulo

PB - Curran Associates Inc.

T2 - 18th European Conference on Cyber Warfare and Security, ECCWS 2019

Y2 - 4 July 2019 through 5 July 2019

ER -

Creating modern blue pills and red pills

Abstract

Publication series

Conference

Keywords

Other files and links

Fingerprint

Cite this