Joanna Rutkowska

Joanna Rutkowska is a Polish computer security researcher, born in 1981 in Warsaw, who holds a Master's degree in Computer Science from the Warsaw University of Technology. She built her early reputation on low-level operating-system and virtualization security research, particularly the study of stealth malware and rootkits that operate beneath the visibility of conventional detection tools.

Blue Pill (2006)

Rutkowska entered the wider public security spotlight in August 2006, when she presented at the Black Hat Briefings in Las Vegas a technique she called "Blue Pill," alongside an attack on the kernel-protection mechanisms of the then-upcoming Windows Vista. Blue Pill used AMD's hardware virtualization extensions (and later Intel VT-x) to transparently move a running operating system into a lightweight hypervisor controlled by the attacker, so that malicious code could operate beneath the OS without relying on traditional kernel hooks. She described the approach as theoretically "100% undetectable," a claim that provoked public disagreement from AMD and other researchers, who argued that virtualization-based rootkits could in principle be detected through timing and other side-channel methods.

Invisible Things Lab and further research

In April 2007, Rutkowska founded Invisible Things Lab (ITL) in Warsaw, Poland, a company focused on operating-system and virtual-machine-monitor (VMM) security research and related consulting. Through ITL she and her collaborators published a series of attacks against virtualization platforms and Intel security technologies, including exploits against Intel Trusted Execution Technology (TXT), a demonstrated software escape from Intel VT-d protections, and research into vulnerabilities in Intel's vPro/AMT management technology. In 2009 she coined the term "evil maid attack" to describe a method of compromising an unattended, encrypted computer by briefly tampering with its firmware or boot software using a USB drive.

Qubes OS

Starting in 2010, Rutkowska and colleague Rafał Wojtczuk began developing Qubes OS, a security-oriented desktop operating system built on the Xen hypervisor that isolates applications and data into separate virtual machines ("qubes") to contain the impact of compromise, an approach often described as "security by compartmentalization." Qubes OS reached its 1.0 release on September 3, 2012, and Rutkowska led the project as its founder for nearly a decade. She also authored technical papers such as "Intel x86 considered harmful" (October 2015) and "State considered harmful" (December 2015), examining systemic weaknesses in the x86 platform's trusted-computing model.

Later career and legacy

On October 25, 2018, Rutkowska announced she was stepping back from day-to-day leadership of Qubes OS, handing the lead role to longtime engineer Marek Marczykowski-Górecki while remaining an advisor to the project, and joined the Golem Project as Chief Strategy Officer and Chief Security Officer. Qubes OS has continued as an active open-source project under new leadership, and Rutkowska is widely credited within the security community as a pioneering figure in hypervisor-based attack research and in bringing hardware-isolation-based desktop security to a broader audience.

Timeline

• 2006-08-03Presented the "Blue Pill" hardware-virtualization rootkit concept and a Windows Vista kernel-protection bypass at Black Hat Briefings in Las Vegas.
• 2007-04Founded Invisible Things Lab (ITL) in Warsaw, Poland, focused on OS and VMM security research.
• 2009Coined the term "evil maid attack" in a blog post describing firmware/USB-based compromise of encrypted, unattended machines.
• 2010Began developing Qubes OS with Rafal Wojtczuk, a Xen-based desktop OS using compartmentalized virtual machines for security.
• 2012-09-03Qubes OS reached its 1.0 release.
• 2015-10Published the paper "Intel x86 considered harmful," analyzing systemic security weaknesses in the x86 platform.
• 2018-10-25Announced she was stepping down as lead of Qubes OS and joining the Golem Project as Chief Strategy Officer and Chief Security Officer.