Slashdot Mirror
Intel to Develop Hardware Rootkit Detection
Jack writes "ITO is running a story on Intel's latest initiative - a hardware rootkit detector: 'Intel is trying to eliminate the human factor when dealing with root-kits detection by developing a new hardware-based technique to discover and notify users when they are downloading unintentionally a root-kit to their computer.'"
Aside from wondering what language the IT Observer Staff speak natively (because it isn't English) I have to wonder why "hardware" is necessary to detect a root-kit. I'm all for being able to flag memory as executable (and thus "read only" to programs) and data (and thus unable to execute code) because the last time I wrote self modifying code for a legitimate purpose was on the C64. But what does "a small chip on a PCs motherboard" have to do with rootkits? A rootkit fools the *operating system*, not the processor.
Either this is only memory protection (which I thought we could already do in modern processors and thus would make an additional chip redundant) or it is going to "connect the computers directly to the data" which is content free market speak. Or trusted computing, but it that market speak sounds different.
Sig under construction since 1998.
It sounds suspiciously like memory segmentation and/or writeable bit in the page tables. It has been around since the days of the VAX at least, and in Intel chips since the 386 (and the i890 which preceded it, but died).
But the article is so vague and poorly written that it sounds like either the author didn't know anything about the subject or english was not his first language, or both.
Rootkits are rarely seen on linux boxes, but always seen on windows box.
You're joking right? Rootkits have only become a bigger part of Windows users recently. Rootkits date back to the 80's on various UNIX boxes and have certianly been installed on Linux boxes.
As it should. That would happen with Windows too. Boot sector virus detection alerts you when your boot sector is about to be written to, which is very rarely. Usually only when you install an OS. That's when you turn it off.