The IRMA Community
Newsletters
Research IRM
Click a keyword to search titles using our InfoSci-OnDemand powered search:
|
Modern Blue Pills and Red Pills
|
|
Author(s): Asaf Algawi (University of Jyväskylä, Finland), Michael Kiperberg (Holon Institute of Technology, Israel), Roee Shimon Leon (University of Jyväskylä, Finland), Amit Resh (Shenkar College, Israel)and Nezer Jacob Zaidenberg (College of Management, Israel)
Copyright: 2020
Pages: 14
Source title:
Encyclopedia of Criminal Activities and the Deep Web
Source Author(s)/Editor(s): Mehdi Khosrow-Pour D.B.A. (Information Resources Management Association, USA)
DOI: 10.4018/978-1-5225-9715-5.ch078
Purchase
|
Abstract
This article presents the concept of blue pill, a stealth hypervisor-based rootkit, that was introduced by Joanna Rutkowska in 2006. The blue pill is a malicious thin hypervisor-based rootkit that takes control of the victim machine. Furthermore, as the blue pill does not run under the operating system context, the blue pill is very difficult to detect easily. The red pill is the competing concept (i.e., a forensics software that runs on the inspected machine and detects the existence of malicious hypervisor or blue pill). The concept of attestation of a host ensuring that no hypervisor is running was first introduced by Kennel and Jamieson in 2002. Modern advances in hypervisor technology and hardware-assisted virtualization enables more stealth and detection methods. This article presents all the recent innovation in stealth blue pills and forensics red pills.
Related Content
|
Sílvia Ribeiro.
© 2024.
24 pages.
|
|
Bárbara Machado, Sónia Maria Martins Caridade.
© 2024.
21 pages.
|
|
Gabriela Mesquita Borges.
© 2024.
20 pages.
|
|
Gabriela Mesquita Borges.
© 2024.
33 pages.
|
|
Nathália Castro da Silva, Rita Faria.
© 2024.
25 pages.
|
|
Joana Torres, Jorge Gracia Ibáñez, Sónia Maria Martins Caridade.
© 2024.
22 pages.
|
|
Camila Iglesias.
© 2024.
12 pages.
|
|
|