Blue Pill is an attention-whoring non-threat, period

analysis
Jun 28, 20062 mins

I can't believe I even have to address this. The "Blue Pill" (BP) AMD Secure Virtual Machine (SVM) root exploit is a scam. It poses no threat to any PC secure from physical access and where administrative privileges are tightly controlled. There is no security hole in AMD's SVM implementation, and the method described by the hacker can be employed in exactly the same manner on an Intel CPU with Virtualization T

I can’t believe I even have to address this.

The “Blue Pill” (BP) AMD Secure Virtual Machine (SVM) root exploit is a scam. It poses no threat to any PC secure from physical access and where administrative privileges are tightly controlled. There is no security hole in AMD’s SVM implementation, and the method described by the hacker can be employed in exactly the same manner on an Intel CPU with Virtualization Technology (VT). What’s more, the hacker’s claim that BP cannot be discovered once it’s in place is wishful hogwash. The very infection technique to which the hacker alludes (and that’s all he does; there’s no meat on those bones) can be used to discover and disarm the exploit.

The procedure that this hacker claims to have invented is lifted directly from AMD’s Programmers Reference Manual. Any reader familiar with x86 assembly language and the PC boot sequence can hack his first baby hypervisor in a day or two. Baby hypervisor code samples abound on the ‘Net, and BP is just one more. Luckily for us, this hacker promises not to release his very, very scary code sample into the wild until after his standing ovation at a hackers’ convention in late July.

I don’t care whether the hacker’s male or female. As far as I’m concerned, all black hats are sexless in all regards.

BP might be a harmless case of “look at me! Ain’t I bad?”, but it also smacks of an effort to harm AMD’s reputation and commerce. If that seems far-fetched, consider three things: The original post’s date is just four days prior to Intel’s first deliveries of Core Microarchitecture CPUs, Intel’s first real competitors to Opteron. The post goes out of its way not to mention the fact that Intel CPUs with VT are designed to launch hypervisors using a nearly identical procedure. And the hacker discloses that he’ll have nothing to show until late July, but, golly, he had to tell us right then, just before Woodcrest shipped, that there’s proof that AMD’s SVM is a major security hole.

What this hacker really set out to prove is that we’re all gullible enough to take this bait and steer clear of AMD64. Get used to efforts to keep you misinformed. The anti-AMD FUD (fear, uncertainty, doubt) pump is just powering up.