Windows 7's XP Mode is likely to cause more headaches for attackers. XP Mode is implemented using hardware virtualization extensions. A common hacker tool -- rootkits -- rely on hardware virtualization and a special privilege level called VMX root mode. With the OS now using hardware virtualization, attempts to gain the privileges necessary to launch the special hardware virtualization support needed by the rootkit tends to crash the OS or provide the user with warnings. For this reason Blue Pill, one common rootkit, doesn't work well in Windows 7.
|