Editing Hypervisor (section)

==Security implications==
{{main|Hyperjacking}}
The use of hypervisor technology by [[malware]] and [[rootkit]]s installing themselves as a hypervisor below the operating system, known as ''[[hyperjacking]]'', can make them more difficult to detect because the malware could intercept any operations of the operating system (such as someone entering a password) without the anti-malware software necessarily detecting it (since the malware runs below the entire operating system). Implementation of the concept has allegedly occurred in the [[SubVirt]] laboratory rootkit (developed jointly by [[Microsoft]] and [[University of Michigan]] researchers<ref>{{cite web |url=http://web.eecs.umich.edu/~pmchen/papers/king06.pdf |access-date=2008-09-15 |title=SubVirt: Implementing malware with virtual machines |date=2006-04-03 |publisher=[[University of Michigan]], [[Microsoft]]}}</ref>) as well as in the [[Blue Pill (software)|Blue Pill malware]] package. However, such assertions have been disputed by others who claim that it would be possible to detect the presence of a hypervisor-based rootkit.<ref>{{cite web |url=http://www.virtualization.info/2006/08/debunking-blue-pill-myth.html |title=Debunking Blue Pill myth |publisher=Virtualization.info |access-date=2010-12-10 |date=2006-08-11 |archive-date=February 14, 2010 |archive-url=https://web.archive.org/web/20100214173337/http://www.virtualization.info/2006/08/debunking-blue-pill-myth.html |url-status=dead }}</ref>

In 2009, researchers from Microsoft and [[North Carolina State University]] demonstrated a hypervisor-layer anti-rootkit called [[Hooksafe]] that can provide generic protection against kernel-mode [[rootkit]]s.<ref>{{cite book |url=http://research.microsoft.com/en-us/um/people/wdcui/papers/hooksafe-ccs09.pdf |series=CCS '09 |isbn=978-1-60558-894-0 |location=Chicago, Illinois, USA |date=11 August 2009 |publisher=[[Association for Computing Machinery|ACM]] |access-date=2009-11-11 |first1=Zhi |last1=Wang |first2=Xuxian |last2=Jiang |first3=Weidong |last3=Cui |first4=Peng |last4=Ning |title=Proceedings of the 16th ACM conference on Computer and communications security |chapter=Countering kernel rootkits with lightweight hook protection |pages=545–554 |doi=10.1145/1653662.1653728|citeseerx=10.1.1.147.9928 |s2cid=3006492 }}</ref>