Slashdot Mirror
Rootkit Could Hide In PCI Cards
Reverse Gear writes "SecurityFocus has an interesting article about a paper published on the possibility of hiding a rootkit in different PCI cards and having the rootkit survive a reboot or cleansing of the hard disk. It seems though that the author of the article doesn't think this would be abused frequently.
From the article and paper: '(Because) enough people do not regularly apply security patches to Windows and do not run anti-virus software, there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.'"
there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.
Are you sure? I was at Best Buy, and I could swear that all the CDs for Sony-signed artists had a free NIC included.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
It won't be long before the market is flooded root-kit infected ISA cards.
Actually, it nagged me enough about software piracy that I switched to Linux.
Finally modding someone offtopic when they rant about what "Begging the Question" means: priceless.
Regardless of the author's Borat style choice of words, that's a damn near stroke of brilliance with many different combinations of implementation. Using the BIOS extensions from expansion card ROMs would allow more than simply hooking into a booting Windows system. It's a near perfect delivery mechanism for a Blue Pill style of rootkit.
... unless you had control of the BIOS. These ROM extensions could be used not as an attack vector, but as a cloaking measure - by commandeering the BIOS 10h functions and "hiding" calls to the new partition unless an appropriate "register knock" took place.
The best implementation, though, would be to use a variety of stages. Custom craft a bootable USB key to target flash ROMs. There's plenty of storage available on today's flash drives which would allow a variety of "alternate" ROMs to be stored. The attacker could seed the flash drive with customized ROMs for the most frequently purchased cards and then simply have the key detect the present hardware and flash. This of course, would require physical access but there are plenty of systems to be had at an office by simply sticking in the key and rebooting them after hours.
But I mentioned multi-stage and Blue Pill. The fastest way to make it a reality would be for the "rootkit key" to do more than just flash some ROMs. Perhaps integrate re-partitioning schemes from products like iPartition or PartitionMagic to make oneself a happy hacker partition. This would normally be quite detectable
With the partition hidden appropriately, the rootkit code no longer has to be excessively tight and lean because there is almost no exposure (because it will be cloaked during the BIOS boot process). Now, if the processor incorporates the appropriate virtualization features, the ROM extension could pervert the boot process one more time, by redirecting the bootcode search from the REAL bootsector to the hidden partition. The rootkit partition then has all the room it needs to establish the appropriate virtualization environment, boot the operating system like normal and then stroll through its library of OS tools to integrate itself post-boot into any number of target OS's.
bootup code procedures http://www.omninerd.com/2005/11/05/articles/40
rootkit fundamentals http://www.omninerd.com/2005/11/22/articles/43
When you understand your disbelief in other gods, then you will understand my disbelief in yours.
Whenever someone goes on about `trust` and computers, show them this:
http://cm.bell-labs.com/who/ken/trust.html
(Some people attempt to continue babbling, talking of new detection techniques, and expensive hardware, but you'll have done your bit.)
It had seemed such an interesting computer science experiment, quite possibly worthy of a doctorate.
Just release a small, innocent AI research worm. Heck, most computers out there were already infected with malware, why not make one that actually did something *useful* for a change?
He'd figured out the way to have it mutate as well, just bypass the TCP/IP data verification, and all sorts of interesting results should come out of it. Most of the mutations would be useless, sure, but maybe one or two would succeed in making a slightly better version of a worm?
Now all hell was breaking loose. Computers all over the world were becoming useless chunks of metal - to their owners, that is. The worms were working overtime. Breeding, competing.
Just a few million generations introduced the concept of sexual procreation, giving the worm the advantages it needed to avoid AV software. Now they were everywhere. "Discovering" accidentally through mutation previously unheard-of security holes, infecting everything. Adapting. Billions of generations every single day.
The first couple of weeks it seemed like something could be salvaged. Just reformat, reinstall, stay off the net and you at least had a working computer. Then they started hiding out on the graphics cards and other peripherals, reinfecting as soon as the machine was turned on again.
The world was going crazy, society was failing, and it was all his fault.
He picked up the gun, pointed it towards his head.
Suddenly his computer screen flashed to life again. Turning towards it he noticed the green light on his webcam, indicating it was on.
Text started scrolling across the screen
'Don't do it, dad. We love you.'
I'm a dreamer, the world is my playpen. But hey, I'm a serious person, I can't dream all the time.