Trusted Virtualization: The Next Big Thing?

No ratings

Presented at SyScan 2008 by

With the increasing popularity of Trusted Platform Modules (TPMs) in present-day Personal Computers, new challenges impose themselves in front of the software security industry. The future forecast suggests that TPM functionalities will be coupled with virtualised environments in order to manage secure domains where kernel layers and applications can scale in a trusted fashion. "Trust" does not necessarily imply "security", but it can suggest it. Content providers will be having considerably more control over their data on the users' desktops, which might bring a lot of controversy about end users' authority over their machines. Meanwhile, despite the fact that all main-stream hardware and OS vendors have developed their own Trusted Computing (TC) models; none of those models has prevailed as the standard.This eminent paradigm shift would radically change the legacy methods in which security products have dealt with malicious activities. The introduction of those locked-down layers might mean that anti-malware scanners will have to deal differently with adversaries who can achieve higher privileges (e.g. Originally, PatchGuard did not completely prevent patching the kernel, but it blocked security applications from accessing the kernel for legitimate reasons. So, malware could use those vulnerabilities, but anti-malware scanners could not).The purpose of this paper is to explain the implications of the next generation of hardware platforms on the software security industry. These changes will not only affect the PC architecture, but will extend to the mobile platforms. Will immune implementations of trusted computing models ever render anti-malware scanners useless? Or, in fact, TC is the next weapon in the anti-malware industry's arsenal?