A Hypervisor IPS based on Hardware Assisted Virtualization Technology Junichi Murakami（USA 2008 Briefings Speaker List）

（てっしーさん経由）

村上さん＠株式会社フォティーンフォティ技術研究所がブラックハットUSAは発表だそうです。

Junichi Murakami

Junichi Murakami is a Senior Research Engineer at Fourteenforty Research Institute, Inc,

Hyper-Visor IPSの話だそうです。

Recently malware has become more stealthy and thus harder to detect, than ever before. Current malware uses many stealth techniques, such as dynamic code injection, rootkit technology and much more. Moreover, we have seen full kernel mode malware like Trojan.Srizbi.
Many detection tools were released that specialize in kernel mode malware and especially in the detection of rootkits. However, these tools are a cat and mouse game, because they and the malware are executed on the same privilege level.
This is why we developed an IPS based on a hypervisor, which uses features of hardware virtualization. It is executed on Ring-1 and thus runs with higher privileges than the OS layer.
In this session, we will talk about stealth mechanisms used by recent malware and demonstrate how to protect against such malware using Hypervisor IPS.

---