Group of computer components that starts at a trust nexus. Through a series of operations, each component in the chain adds functionality and verifies the next component. The final component is trusted if all components in the chain complete successful verification and then the nexus can indeed be trusted.
Published in Chapter:
Modern Blue Pills and Red Pills
Asaf Algawi (University of Jyväskylä, Finland), Michael Kiperberg (Holon Institute of Technology, Israel), Roee Shimon Leon (University of Jyväskylä, Finland), Amit Resh (Shenkar College, Israel), and Nezer Jacob Zaidenberg (College of Management, Israel)
Copyright: © 2020
|Pages: 14
DOI: 10.4018/978-1-5225-9715-5.ch078
Abstract
This article presents the concept of blue pill, a stealth hypervisor-based rootkit, that was introduced by Joanna Rutkowska in 2006. The blue pill is a malicious thin hypervisor-based rootkit that takes control of the victim machine. Furthermore, as the blue pill does not run under the operating system context, the blue pill is very difficult to detect easily. The red pill is the competing concept (i.e., a forensics software that runs on the inspected machine and detects the existence of malicious hypervisor or blue pill). The concept of attestation of a host ensuring that no hypervisor is running was first introduced by Kennel and Jamieson in 2002. Modern advances in hypervisor technology and hardware-assisted virtualization enables more stealth and detection methods. This article presents all the recent innovation in stealth blue pills and forensics red pills.