PC hardware can pose rootkit threat

TalkBack 35 of 43:

Next »

« Previous

• Thread View
• Flat View

Although a remote attack would take MANY steps to achieve...

...if it did, the computer would be an almost useless paperweight.

The attack would have to rely on a number of steps
1) Privelege escalation to LocalSystem*
2) Re-flash the device on-the-fly from within Windows*
3) Wait until a reboot
4) System BIOS will load the code in from the expansion ROMs
4) Get the code to survive real-mode to protected-mode switch
5) Use said code to modify key structures / files

Detection is now a nightmare:
Every devices firmware would need to be compared to a 'good', but if the rootkit was running at the time then this could alter the results of the comparison. A side-by-side comparison would seem the only way forward, maybe using another OS to boot into (providing the rk only looked for NT kernel locations, and not Linux 2.x ones as well).

The above is how I understand this attack would happen, researched from the [url=http://www.ngssoftware.com/research/papers/implementing_And_Detecting_A_PCI_Rootkit.pdf]NGSSoftware paper[/url] on rootkits of this nature. My knowledge of this is very basic, and I apologise for any errors in my interpretation.

*Why the hell does Windows allow IOPL to be raised to 3 anyway? I thought the whole point of NT's HAL (Hardware bloody ABSTRACTION LAYER) was to remove direct access ability to hardware...

Posted by: Scrat   Posted on: 03/01/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now