[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Feb 2017 15:31:11 -0800
From: Kees Cook <keescook@...omium.org>
To: Matthew Giassa <matthew@...ssa.net>
Cc: "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, KVM <kvm@...r.kernel.org>,
Matthew Garrett <matthewgarrett@...gle.com>
Subject: Re: Introduction + new project: "rootkit detection
using virtualization".
On Fri, Feb 10, 2017 at 3:27 PM, Kees Cook <keescook@...omium.org> wrote:
> On Fri, Feb 10, 2017 at 2:00 PM, Matthew Giassa <matthew@...ssa.net> wrote:
>> Good day,
>>
>> I am a volunteer developer taking up a project originally proposed by
>> Rik van Riel, "rootkit detection using virtualization", and am
>> planning to contribute regularly to this project over the coming
>> months. I was advised to contact these mailing lists to introduce
>> myself, and I also wanted to inquire about any existing projects that
>> coincide with this work. My initial work will involved diving into KVM
>> + qemu source and deciding how best to approach the problem. While I
>> have the attention of list members, are there any specific
>> individuals/groups I should contact directly with respect to this type
>> of project?
>>
>> Thank you.
>
> Hi! Welcome to the list(s)!
>
> I think this is an interesting area of research, though it may be a
> tricky cat/mouse game. Some of this kind of
> hypervisor-protects-the-kernel work has been done on some Android
> phones in small areas (see the cred protection near the end):
>
> http://keenlab.tencent.com/en/2016/06/01/Emerging-Defense-in-Android-Kernel/
And some privilege monitoring work done by Matthew Garrett:
https://github.com/mjg59/rkt/commits/privilege
-Kees
--
Kees Cook
Pixel Security
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
