Making it harder for rootkits

[Evil_Bert]

Boffins have figured out a way to defeat many rootkits:

http://www.theregister.co.uk/2009/11...it_protection/

[pete_1967]

Let's hope that technology will be available soon.

[aleph]

Hypervisor based --> much, much slower on old hardware without VT support ;(

[Evil_Bert]

Well they say it's for Guest OS's (at the moment), so I suppose their aim is server security ... were servers are expected to increasingly be run virtualised on suitable hardware.

I'm hoping the technique will flow down to memory management in regular Linux boxes at some point.

[diamond_ramsey]

Evil_Bert, thank you for your posts!

Originally Posted by Evil_Bert

...http://www.theregister.co.uk/2009/11...it_protection/

"...
They tested the protected system against nine rootkits written for the Linux 2.6 kernel. Seven of them failed to install at all thanks to the memory protection, while the remaining two failed to hide themselves because of the hook indirection.
..."

Most excellent!!!

From research good things will come in time.

[Dies]

Originally Posted by diamond_ramsey

From research good things will come in time.

From experience, interested parties will work around it.