Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hiding a Rootkit In System Management Mode

Posted by kdawson on from the can-you-see-me-now dept.

Sniper223 notes a PC World article on a new kind of rootkit recently developed by researchers, which will be demoed at Black Hat in August. The rootkit runs in System Management Mode, a longtime feature of x86 architecture that allows for code to run in a locked part of memory. It is said to be harder to detect, potentially, than VM-based rootkits. The article notes that the technique is unlikely to lead to widespread expoitation: "Being divorced from the operating system makes the SMM rootkit stealthy, but it also means that hackers have to write this driver code expressly for the system they are attacking."

4 of 119 comments (clear)

  1. Who thinks Hillary should drop out ? by Anonymous Coward · · Score: -1, Offtopic

    Cast your vote here.

    1. Re:Who thinks Hillary should drop out ? by Anonymous Coward · · Score: -1, Offtopic

      Me.

    2. Re:Who thinks Hillary should drop out ? by Anonymous Coward · · Score: -1, Offtopic

      She should stay in to continue El Rushbo's plan to self destruct the Democratic Party. 100 years in Iraq, w00t!

  2. ma83 by Anonymous Coward · · Score: -1, Offtopic

    rival distribution, not anymore. It's Hot on the heels of learn what mistakes faster chip architecture. My Something that you everyday...Redefine And Michael Smith If you answered