Joanna Rutkowska
Portrait of Rutkowska, May 2018
Born1981 (age 44–45)
Warsaw, Warsaw Capital Voivodeship, Polish People's Republic[1]
EducationWarsaw University of Technology (Master's degree in computer science)
OccupationsSecurity researcher; founder of Invisible Things Lab
EmployerInvisible Things Lab
Known forBlue Pill, Evil Maid attack, Qubes OS
Websitetracesofhumanity.org

Joanna Rutkowska (born 1981) is a Polish computer security researcher, primarily known for her research on low-level security and stealth malware,[2] and as founder of the Qubes OS security-focused desktop operating system.[3]

Career

She became known in the security community after the Black Hat Briefings conference in Las Vegas in August 2006. At the time a researcher with the security firm COSEINC, she gave a talk titled "Subverting Vista Kernel For Fun And Profit", in which she demonstrated two attacks: a method of loading unsigned code into the Vista kernel, bypassing its driver signing requirement, and a technique dubbed Blue Pill, which used AMD's SVM hardware virtualization to move a running OS into a virtual machine controlled by a thin hypervisor. She claimed that malware using this technique would be undetectable.[4] Subsequently, she was named one of the Five Hackers Who Left a Mark on 2006 by eWeek Magazine for her research on the topic.[5] The original concept of Blue Pill was published by another researcher at IEEE Oakland in May 2006 under the name VMBR.[6]

During the following years, Rutkowska continued to focus on low-level security. In 2007 she demonstrated that certain types of hardware-based memory acquisition (e.g. FireWire based) are unreliable and can be defeated.[7] At Black Hat USA in August 2007 she argued that Vista's kernel protection could be bypassed using poorly written third-party drivers, citing ATI and NVIDIA video drivers as examples, and presented a new version of Blue Pill, rewritten from scratch, with support for nested virtualization. Together with team member Alexander Tereshkin, she disputed claims by other researchers that such virtualization-based malware could be reliably detected.[8][9] In 2008, Rutkowska with her team focused on Xen hypervisor security.[10] In 2009, together with team member Rafał Wojtczuk, she presented an attack against Intel Trusted Execution Technology and Intel System Management Mode.[11]

In April 2007, Rutkowska founded Invisible Things Lab in Warsaw, Poland. The company focuses on OS and VMM security research and provides various consulting services. At the company she carried out offensive system security research together with Rafał Wojtczuk and Alexander Tereshkin, which later informed the work on Qubes OS.[12] In a 2009 blog post she coined the term "evil maid attack", detailing a method for accessing encrypted data on disk by compromising the firmware via an external USB flash drive.[13]

In 2010, she and Rafał Wojtczuk began working on the Qubes OS security-oriented desktop Xen distribution, which currently[14] utilizes Fedora Linux as the admin qube.[15] The initial release of Qubes 1.0 was completed by 3 September 2012.[16] Its main concept is "security by compartmentalization", using domains implemented as lightweight Xen virtual machines to isolate various subsystems. Each compartment is referred to as a qube, which operates as a separate virtual machine.[17] The project refers to itself as "a reasonably secure operating system" and has received endorsements by numerous privacy and security experts.[18][19][failed verification] It is fairly unique in its capabilities, having a design informed by research on proven vulnerabilities in the trusted compute base (TCB), that are unaddressed in most common desktop operating systems.

She has published seminal works on systems trustability, most recently Intel x86 Considered Harmful[20] and State Considered Harmful - A Proposal for a Stateless Laptop.[21] Rutkowska has been invited as an esteemed presenter at security conferences, such as Chaos Communication Congress, Black Hat Briefings, HITB, RSA Conference, RISK, EuSecWest & Gartner IT Security Summit.

In October 2018, after nine years spent mostly on Qubes OS, Rutkowska announced that she was handing over the leadership of the project to Marek Marczykowski-Górecki, who had already been leading most of its day-to-day development, while she would remain an advisor to the project. The same month she joined the Golem Project as Chief Strategy Officer, also serving as Chief Security Officer.[12]

References

  1. ^ "About Me". The Invisible Things Blog. Retrieved 4 October 2026.
  2. ^ "About". Invisible Things Lab. Archived from the original on 6 June 2016. Retrieved 12 June 2016.
  3. ^ Porup, J. M. (5 October 2015). "Finally, a 'Reasonably-Secure' Operating System: Qubes R3". Vice: Motherboard. Retrieved 20 November 2017. 'Security by Isolation,' as Qubes founder Joanna Rutkowska puts it.
  4. ^ Kerner, Sean Michael (4 August 2006). "Black Hat Takes Vista to Task". InternetNews. Retrieved 4 October 2026.
  5. ^ Naraine, Ryan (2 January 2007). "Five Hackers Who Left a Mark on 2006". eWeek. Retrieved 11 June 2016.
  6. ^ King, Samuel T.; Chen, Peter M.; Wang, Yi-Min; Verbowski, Chad; Wang, Helen J.; Lorch, Jacob R. (1 January 2006). "SubVirt: Implementing Malware with Virtual Machines". 2006 IEEE Symposium on Security and Privacy (S&P'06). IEEE Computer Society. pp. 314–327. doi:10.1109/SP.2006.38. ISBN 978-0-7695-2574-7. S2CID 1349303.
  7. ^ Rutkowska, Joanna (28 February 2007). Beyond The CPU: Defeating Hardware Based RAM Acquisition (PDF). Black Hat DC. Washington, D.C.
  8. ^ Kerner, Sean Michael (2 August 2007). "Windows Vista Gets Another Dose of The 'Blue Pill'". InternetNews. Retrieved 4 October 2026.
  9. ^ Rutkowska, Joanna; Tereshkin, Alexander (August 2007). IsGameOver(), anyone? (PDF). Black Hat USA. Las Vegas, Nevada.
  10. ^ Walker-Morgan, Dj (12 August 2008). "Xen virtualisation swallows a "Blue Pill"". The H. Archived from the original on 8 December 2013.
  11. ^ Attacking Intel Trusted Execution Technology
  12. ^ a b Rutkowska, Joanna (25 October 2018). "The Next Chapter: From the Endpoint to the Cloud". Qubes OS. Retrieved 4 October 2026.
  13. ^ Rutkowska, Joanna (16 October 2009). "The Invisible Things Lab's blog: Evil Maid goes after TrueCrypt!". The Invisible Things Lab's blog. Retrieved 30 October 2018.
  14. ^ "Change the OS used in dom0 · Issue #1919 · QubesOS/qubes-issues". github.com. Retrieved 6 January 2026.
  15. ^ "Glossary – Qubes OS Documentation". doc.qubes-os.org. Retrieved 6 January 2026.
  16. ^ "Introducing Qubes 1.0!". blog.invisiblethings.org. Retrieved 1 February 2017.
  17. ^ "Glossary – Qubes OS Documentation". doc.qubes-os.org. Retrieved 21 November 2025.
  18. ^ @Snowden (29 September 2016). "If you're serious about security, @QubesOS is the best OS available today. It's what I use, and free. Nobody does VM isolation better" (Tweet) – via Twitter.
  19. ^ @hashbreaker (15 March 2015). "Happy thought of the day: An attacker who merely finds a browser bug can't listen to my microphone except when I've told Qubes to enable it" (Tweet) – via Twitter.
  20. ^ Rutkowska, Joanna (October 2015). "Intel x86 considered harmful" (PDF). The Invisible Things. Retrieved 12 June 2016.
  21. ^ Rutkowska, Joanna (December 2015). "State Considered Harmful - A Proposal for a Stateless Laptop" (PDF). The Invisible Things. Retrieved 12 June 2016.