Security implications

The use of hypervisor technology by malware and rootkits installing themselves as a hypervisor beneath the operating arrangement can accomplish them added difficult to ascertain because the malware could ambush any operations of the operating arrangement (such as addition entering a password) after the antiviruscomputer application necessarily audition it (since the malware runs beneath the absolute operating system). Implementation of the abstraction has allegedly occurred in the SubVirt class rootkit (developed accordingly by Microsoft and University of Michigan researchers13) as able-bodied as in the Blue Pill malware package. However, such assertions accept been acknowledged by others who affirmation that it would absolutely be accessible to ascertain the attendance of a hypervisor-based rootkit.14

In 2009, advisers from Microsoft and North Carolina State University approved a hypervisor-layer anti-rootkit alleged Hooksafe that can accommodate all-encompassing aegis adjoin kernel-mode rootkits.15