Matasano Chargen - Latest Comments in Joanna: We Can Detect BluePill. Let Us Prove It!

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Nathan McFeters — Wed, 04 Jul 2007 15:05:12 -0000

Is anyone else as excited for blackhat this year as any in recent history? I'm looking forward to this showdown!

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Thomas Ptacek — Mon, 02 Jul 2007 12:28:39 -0000

No, Joanna's rootkit doesn't persist itself.

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Nicholas Weaver — Mon, 02 Jul 2007 00:35:21 -0000

Does the rootkit have to be persistent? Can the system BIOS be write protected?

If so, there is always Yi Min Wang's Ghostbuster trick from Microsoft Research.

Persistent stealthy rootkits, in the face of a defender who can reboot the system and has a trusted BIOS and trusted media, are always detectible, unless the rootkit author solves the program-intent-detection problem (aka, the AV version of the Halting problem), gives up on stealth (not a rootkit), or gives up on persistent (reboot clears rootkit)

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Thomas Ptacek — Thu, 28 Jun 2007 20:14:05 -0000

I'm assuming it's Vista, but don't have a strong opinion.

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Technocrat — Thu, 28 Jun 2007 18:10:59 -0000

Will you agree on an OS to use? XP? Vista?

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Thomas Ptacek — Thu, 28 Jun 2007 17:08:04 -0000

I don't think having our source code is going to help her make Blue Pill less detectable, even in the medium-short term.

What I do like is, "you can't peg the CPU for more than a second because it will be a drag for users". Like the performance cost of having SVM/VTX enabled isn't?

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Nate — Thu, 28 Jun 2007 14:59:55 -0000

I've posted my response to Joanna here.

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

one.miguel — Thu, 28 Jun 2007 14:19:52 -0000

Yeah, and she wants you to find sponsors to pay her $384,000 so she can play! Six months, two developers @ $200/hr per developer to develop blue pill = lame.

Re: Joanna: We Can Detect BluePill. Let Us Prove It!

Fionnbharr Davies — Thu, 28 Jun 2007 10:26:57 -0000

Looks like Joanna has turned the contest around and given you the short straw, haha. Her blog post pretty much says that it's not even half finished so of course you'll be able to detect it with all your fancy timing tricks. Not to mention she'll get the source code to these tricks after the competition and it's not like you don't already have a similar rootkit so you don't get much out of that transaction.

This is interesting indeed!