Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In my class, we are discussing virtual machine based root kits.
I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines
Can someone explain me in a few words how an attacker would carry a rootkit attack against the virtual machine and how he would implement malicious services or anything regarding how installing a root kit in a virtual machine is different than on a physical machine?
As stated above, root kits work similar on a virtual host as they do on a normal host EXCEPT that many malware/virus/rootkit authors have developed mechanisms to detect whether or not they are in a virtual machine, so they can be scripted/programmed to behave differently than they would on a normal machine.
This is highly evident when reverse engineering malware, where malware will behave different if it detects it is virtualized. Some of the behavior may be to stop from doing its normal routines/functions, try to delete itself. This is similar to malware checking to see if a host is running reverse engineering tools, e.g., IDA Pro, OllyDBG, Immunity Debugger, Redline, etc.
VMWare has an "antirootkit" approach to certain things since the vmware agent will monitor things like changes to the SSDT and IDT (system service descriptor table, and interrupt descriptor tables). At the end of the day though, the behavior is MOSTLY the same.
It's not quite clear from your question, but it sounds like you may have been discussing malware which is programmed to "escape" from the virtual machine and affect the host machine. There are attacks which are more focused on virtual machines; it may be possible to affect other virtual machines besides the one guest where the malware runs.
For example, the "blue pill" attack and other forms of "hyperjacking". You may also be able to exploit the services which would only be running in a virtual machine.
However, a traditional root kit in many cases will also run against a virtual machine.
They work just as they do within a regular machine. Zero difference. The root kit would infect key files within the OS and potentially the boot partition. These principles apply to both physical and virtual machines. A regular server has key system files in the OS and a boot partition, a virtual machine has key system files in the OS and a boot partition. Most root kits within a virtual machine are not aware that they are on a virtual machine, as such they just infect the virtual machine and not the physical server hosting it.
The above only references standard root kits. There are special exploits and root kits that will not only infect the virtual machine but the machine that is hosting it, look up bluepill and virtualization for that.
