Slashdot Log In
Rootkit Could Hide In PCI Cards
Posted by
CowboyNeal
on Sat Nov 18, 2006 09:18 AM
from the or-under-the-bed dept.
from the or-under-the-bed dept.
Reverse Gear writes "SecurityFocus has an interesting article about a paper published on the possibility of hiding a rootkit in different PCI cards and having the rootkit survive a reboot or cleansing of the hard disk. It seems though that the author of the article doesn't think this would be abused frequently.
From the article and paper: '(Because) enough people do not regularly apply security patches to Windows and do not run anti-virus software, there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Computers are at their hearts.... (Score:2, Insightful)
Kinda like the people who build and operate them.
Computers are at their hearts.... (Score:3, Funny)
Re:Computers are at their hearts.... (Score:4, Informative)
http://cm.bell-labs.com/who/ken/trust.html [bell-labs.com]
(Some people attempt to continue babbling, talking of new detection techniques, and expensive hardware, but you'll have done your bit.)
Parent
Re: (Score:2)
Re: (Score:3, Informative)
Most noticable are video cards which *all* have one, most RAID cards, all bootable SCSI cards, and many network cards. All option ROMS are enumerated automatically by the BIOS at boot time and if present run.
Re: (Score:3, Interesting)
The commonality is that all of them can get the machine's CPU to run it by having a simple option rom signature at their beginning. That will assure them of running BEFORE the OS is loaded.
If that code hooks interrupt vector 0x13, it can then watch the boot process happen and modify code as it loads. It might potentially even virtualize the hardware and push the OS to (effectively) ring 1.
Re: (Score:2)
Option ROMs are generally in flash these days. Provided that write cycles to the "ROM" are enabled (common enough), there are standard access sequences to erase and reprogram flash chips.
One really nasty vector for a related concept would be via DVD-R. Many DVD players can update their firmware by inserting a burned disk. In spite of the many brands out there, there are only a few actual manufacturers and a lot of rebranding.
As for why none of it has been exploited to date, probably because the bar IS m
Sony (Score:3, Funny)
Dupe from a year ago. (Score:2)
Re:Dupe from a year ago. (Score:4, Insightful)
Huh? They lost my business, naybe a few other nerds, but I don't see them in chapter 13, 11, or 7. I didn't see anyone go to jail or even fired for it. In fact, I don't see where they sufferred one tiny bit. "He he, we got caught this time. Next time we'll be more careful!"
As will the other slimy, evil multinationals.
Parent
Not needed, thanks (Score:2, Insightful)
Really (Score:5, Funny)
there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.
Are you sure? I was at Best Buy, and I could swear that all the CDs for Sony-signed artists had a free NIC included.
I disagree on this remark: (Score:3, Interesting)
(Because) enough people do not regularly apply security patches to Windows and do not run anti-virus software, there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.
Note that in Windows XP, especially if you have Service Pack 2 applied, the Security Center in Windows XP SP2 nags you enough that you end up installing programs like the free editions of ZoneAlarm firewall and AVG Anti-Virus (in lieu of commercial Internet security suites) and at least reminds you to install security patches from Microsoft when it becomes available.
Re:I disagree on this remark: (Score:5, Insightful)
Parent
Re: (Score:2)
I uninstalled all networking components in Windows and disabled the network card, but somehow I'm still paranoid about the Windows side. Can I still be pwned in Windows over the wire?
Windows stopped nagging
Re: (Score:2, Funny)
Re: (Score:2)
This is a serious problem... (Score:5, Funny)
Re: (Score:2)
It's the end of the world!!!
not sure what I think about this (Score:4, Insightful)
So basically, this is a well disquised reason to implement the lastest windows DRM
Re: (Score:3, Insightful)
I'd love to have uncompromisable equipment.
Think of it this way; you have a box standing around, just serving. An exploit is found that allows arbitrary code runs, and the particular individual (not a bot) running the arbitrary code scans the hardware, checks it against a list of exploitable units, pulls up the "fix" he needs for that piece of hardware, and bam, you're screwed.
With TC, you could at least be warned that the equipment is compromi
Re: (Score:2)
Re:not sure what I think about this (Score:4, Insightful)
will be immune to this type of rootkit compromise
However the joy of "Trusted Computing" is that when someone finally DOES find a way to crack it, you'll never know and/or never be able to DO anything about it, apart from throw your computer in the trash.
Parent
Re: (Score:2)
There are many promises being made for TCM/DRM, yet there was apparently an unsigned driver wedged into a Vista system before the OS was even declared RTM. I am in no hurry to presume DRM/TCM will be as effective as some claim. It's theoretical protection capabilities are being advertised, the factual failures of previous attempts such as the XBox security chips are being conveniently "forgotten".
To claim anything is "immune" from infection ignores three fundamental truths:
Re: (Score:2)
The first viruses were written for and on a mainframe in a university setting. IIRC it was sometime in the late 60s. It's been 20 years since I read the book that described it, but it was thought a game; whose virus could kill the other viruses.
They had boot sector viruses for PCs back as early as 1983, almost as soopn as IBM started making PCs.
No need to get so fancy, just use a miniature PC (Score:4, Informative)
From RiskBloggers.com [riskbloggers.com]:
Miniature Computers That Can Break Your Network Wide Open [riskbloggers.com]
One aspect of information security that is often under looked is physical security. While attention is often paid to secure areas containing servers, network equipment and telecommunication gear not as much attention has been paid to the fringes of the network. Although some security standards such as 802.1x and various network access control (NAC) products exist that can be used to address the network fringe they all contain one major weakness.
Assuming a network has implemented end to end security in the form of 802.1x or a network access control (NAC) solution they all make one major assumption: that a man in the middle attack can't be executed once the end point has authenticated. For example 802.1x addresses this directly, if the network port detects that the connection is dropped it requires the end point to re-authenticate before it's allowed to have network access again. If the network hasn't implemented such a scheme then it becomes trivial to execute a man in the middle attack by physically inserting another computer in between the network equipment and the end machine.
But that would be pretty obvious wouldn't it? I mean you think a user (even the dullest one) would notice a second machine plugged into their network drop, with their computer daisy chained off of it.
Maybe. Maybe not.
Read More [riskbloggers.com]
Rootkit Could Hide in Your Pants (Score:2, Funny)
Re: (Score:2)
USgovt ... think couterveit measures (Score:3, Insightful)
what is to stop the Govt from having its own rootkit added to hardware?
they would have the ultimate supercomputer just waiting for their use.
Re: (Score:2)
[pounds more rivets into tinfoil hat]
Enormous Usage Possibilities (Score:5, Interesting)
The best implementation, though, would be to use a variety of stages. Custom craft a bootable USB key to target flash ROMs. There's plenty of storage available on today's flash drives which would allow a variety of "alternate" ROMs to be stored. The attacker could seed the flash drive with customized ROMs for the most frequently purchased cards and then simply have the key detect the present hardware and flash. This of course, would require physical access but there are plenty of systems to be had at an office by simply sticking in the key and rebooting them after hours.
But I mentioned multi-stage and Blue Pill. The fastest way to make it a reality would be for the "rootkit key" to do more than just flash some ROMs. Perhaps integrate re-partitioning schemes from products like iPartition or PartitionMagic to make oneself a happy hacker partition. This would normally be quite detectable
With the partition hidden appropriately, the rootkit code no longer has to be excessively tight and lean because there is almost no exposure (because it will be cloaked during the BIOS boot process). Now, if the processor incorporates the appropriate virtualization features, the ROM extension could pervert the boot process one more time, by redirecting the bootcode search from the REAL bootsector to the hidden partition. The rootkit partition then has all the room it needs to establish the appropriate virtualization environment, boot the operating system like normal and then stroll through its library of OS tools to integrate itself post-boot into any number of target OS's.
bootup code procedures http://www.omninerd.com/2005/11/05/articles/40 [omninerd.com]
rootkit fundamentals http://www.omninerd.com/2005/11/22/articles/43 [omninerd.com]
Re: (Score:2)
Might have been rather difficult to implement, tho, given the lack of brains in ISA devices.
Flash-guardian switches and other protection (Score:2, Interesting)
As for flashable BIOSes and device BIOSes as discussed in the PDF, any device with a flashable BIOS needs some type of "flash-guardian" switch. For attended systems like most home PCs, this should be a physical switch on the front of the PC. Realistical
Re: (Score:2)
Its considered a big advantage for device makers to have their devices flash upgradeable, heck, some have it as a major selling point.
The thing that neither the article nor
This is not new... (Score:2)
Unlike salamanders and lizards, most animals have lost the ability to replace missing limbs...,p>This isn't really newsworthy at all. Virii have always been able to propagate via flashing BIOSes and whatnot - doing the same to a PCI card is no different.
The only reason you don't see much of it is because it actually requires a bit more skill to perform this type of attack, instead of your average script-kiddie virus.
It was all going crazy... (Score:5, Interesting)
Just release a small, innocent AI research worm. Heck, most computers out there were already infected with malware, why not make one that actually did something *useful* for a change?
He'd figured out the way to have it mutate as well, just bypass the TCP/IP data verification, and all sorts of interesting results should come out of it. Most of the mutations would be useless, sure, but maybe one or two would succeed in making a slightly better version of a worm?
Now all hell was breaking loose. Computers all over the world were becoming useless chunks of metal - to their owners, that is. The worms were working overtime. Breeding, competing.
Just a few million generations introduced the concept of sexual procreation, giving the worm the advantages it needed to avoid AV software. Now they were everywhere. "Discovering" accidentally through mutation previously unheard-of security holes, infecting everything. Adapting. Billions of generations every single day.
The first couple of weeks it seemed like something could be salvaged. Just reformat, reinstall, stay off the net and you at least had a working computer. Then they started hiding out on the graphics cards and other peripherals, reinfecting as soon as the machine was turned on again.
The world was going crazy, society was failing, and it was all his fault.
He picked up the gun, pointed it towards his head.
Suddenly his computer screen flashed to life again. Turning towards it he noticed the green light on his webcam, indicating it was on.
Text started scrolling across the screen
'Don't do it, dad. We love you.'
Re: (Score:2)
Non-story? (Score:3, Insightful)
Of COURSE you could put a rootkit in a PCI card. It would have to be done at the factory, even if the "factory" is in Joe's basement and Joe is selling cards to his friends.
Or Joe could sell PCs with his homemade card installed already.
This is a big "duh". The article should have been "how to protect yourself against a rootkit in a PCI card". Obviously, your antispyware and antivirus software wouldn't have a ghost of a chance of finding it.
I would consider the possibility of a PCI card rootkit very low until Sony put rootkits on audio CDs, ruined a bunch of computers (mine included when my daughter played an infected audio CD she bought at the now out of business record store she worked at).
I personally am on a lifelong Sony boycott cecause if it, both hardware and software, but a one man boycott does nothing but ease my paranoia. I would EXPECT hardware from Sony to contain malware, and everyone else should too since their rootkit didn't cost them anything but one man's business. Now I wonder if the 42 inch flat screen Trinitron I bought a few years ago has a rootkit? No matter, I don't have cable and really don't care if anybody knows what I'm watching.
I'd be very interested in finding out how one could protect themselves against a hardware rootkit?
Re: (Score:3, Informative)
Of COURSE you could put a rootkit in a PCI card. It would have to be done at the factory, even if the "factory" is in Joe's basement and Joe is selling cards to his friends.
Many cards have flashable firmware. Given a way to reflash a vulnerable piece of hardware, this could be done with a trojan or worm.
Not Just All Your Base (Score:2)
The ramifications are chilling. This is not new, I first saw this in '97 when they were using hidden-persistent RAM disks (on 68k Macs) accessing VRAM space (NuNV N^NuNV (
Yes, Macs.
http://www.securityfocus.com/columnists/402 [securityfocus.com]
http://www.securityfocus.com/comments/columns/402/ 33600/threaded#33600 [securityfocus.com]
http://slashdot.org/comments.pl?sid=190931&cid=157 06785 [slashdot.org]
http://slashdot.org/comments.pl?sid=193487&ci [slashdot.org]
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Re: (Score:2)
Not a bad idea... unfortunately I've already made the PCBs :(
I'll keep that in mind for the next release :)
Dual BIOS (Score:3, Interesting)
Re: (Score:2)
Great, add another 5MB to the driver why don't you.
Re: (Score:2)
Evilution (Score:2, Funny)
Re: (Score:2)
Hightlights can be seen here [youtube.com].
Re: (Score:3, Interesting)
Hell, you don't even need to manufacture the board or chip, just rewrite the driver (shudder).
Nobody went to jail over the Sony fiasco, despite the fact that it broke a lot of laws in a lot of countries. Isn't there one single country anywhere that isn't owned by your brother, the big corporation?
Re: (Score:2)