What is this miracle called a hypervisor? Hackers from CrackWatch explained how to secure your PC if you want to play cracked games.
What is this marvel - a hypervisor? CrackWatch hackers explained how to secure your PC if you want to play cracked games
The CrackWatch group has published a guide on protecting against risks associated with using Hypervisor-based bypasses. The authors propose a solution as close as possible to air-gap - physical separation of systems.
The main method is using two separate PCs or, at a minimum, two independent physical drives. The "safe" installation (for work and personal data) is recommended to be encrypted using Veracrypt. This will protect the system from unwanted changes by a potentially compromised OS. To restore the bootloader, you will need to create a Veracrypt recovery disk on a FAT32 flash drive - it will allow booting directly, bypassing malicious modifications.
The "unsafe" OS (intended for games with Hypervisor) should be installed on a separate physical disk, not on another partition of the same drive. Modern motherboards allow completely disabling specific SATA or M.2 ports, thanks to which malware won't even be able to detect the existence of the "safe" installation.
For convenience, you can create two separate BIOS profiles: one for safe work with all protection functions enabled (Secure Boot and disabling drives with valuable data), the other - for gaming. When switching to the safe profile, Secure Boot should block any unauthorized bootloader. If this doesn't happen, the Veracrypt recovery disk comes to the rescue.
The author acknowledges the theoretical possibility of infecting the firmware with malware having kernel-level privileges. However, in practice such attacks are extremely rare and complex: to overwrite the BIOS requires exploiting vulnerabilities in System Management Mode and bypassing several levels of protection - from the SPI flash memory controller to Intel Boot Guard. The vast majority of documented cases (Lojax, MoonBounce, etc.) are associated with targeted attacks by state hackers on politicians, journalists, or large companies. This type of malware is not intended for mass distribution.