Slashdot Log In
Hiding a Rootkit In System Management Mode
Posted by
kdawson
on Sun May 11, 2008 05:57 PM
from the can-you-see-me-now dept.
from the can-you-see-me-now dept.
Sniper223 notes a PC World article on a new kind of rootkit recently developed by researchers, which will be demoed at Black Hat in August. The rootkit runs in System Management Mode, a longtime feature of x86 architecture that allows for code to run in a locked part of memory. It is said to be harder to detect, potentially, than VM-based rootkits. The article notes that the technique is unlikely to lead to widespread expoitation: "Being divorced from the operating system makes the SMM rootkit stealthy, but it also means that hackers have to write this driver code expressly for the system they are attacking."
Related Stories
[+]
VM-Based Rootkits Proved Easily Detectable 128 comments
paleshadows writes "A year and a half has passed since SubVirt, the first VMM (virtual machine monitor) based rootkit, was introduced (PDF), covered in the tech press, and discussed here. Later Joanna Rutkowska made news by claiming she had a VMM-based attack on Vista that was undetectable — a claim that was roundly challenged. Now in this year's HotOS workshop, researchers from Stanford, CMU, VMware, and XenSource have published a paper titled Compatibility Is Not Transparency: VMM Detection Myths and Realities (PDF) showing that VMM-based rootkits are actually easily detectable."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
hmm (Score:5, Funny)
Re:hmm (Score:5, Funny)
Isn't that like using a gun to prevent a cold? Yes I suppose it's effective, but still...
Parent
Re:hmm (Score:5, Funny)
Parent
Re: (Score:2)
Where can I buy this gun of which you speak ?
Re: (Score:3, Interesting)
Re: (Score:2)
Re:hmm (Score:5, Funny)
Parent
I'm Canadian, you insensitive clod! (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
And outboard motors! Eh!
oooooh scary (Score:5, Insightful)
Re:oooooh scary (Score:5, Informative)
The attack vector is made a lot easier because most BIOS vendors don't blockhole the address range as they need to support USB devices DMAing into the Aseg and Tseg segments (the memory ranges utilized by SMM). This is what you pay for to be able to use a USB keyboard in DOS. Legacy emulation so that all those ancient BIOS interrupt calls continue to work with your latest input devices..
If there is a modern operating system running, there is a handoff between the OHCI driver and the SMM using a mailbox register on the usb controller so that the BIOS stops using the USB controller. What this means that modulo BIOS services that do things like control fans (and aren't implemented in ACPI), something could slip into SMM quite easily and flip the bit that makes it impossible for your antivirus to find it.
Parent
Re:oooooh scary (Score:4, Interesting)
You can even have it trigger on the first BIOS calls of the windows bootloader so that you can easily overwrite the SMM memory regions in a nice and portable way.
Parent
Re:oooooh scary (Score:4, Interesting)
Parent
Re:oooooh scary (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
That's exactly what the unstoppable supervirus wants you to think!
LiveCD (Score:2, Interesting)
I do all my internet banking via freeBSIE now - yes it takes a veeeeery long time to boot, and I know that it doesn't solve ALL of the problems but it has to eliminate enouogh problems to be a viable solution.
Agree / disagree ?
Re:LiveCD (Score:5, Informative)
Parent
Re: (Score:2)
It seems to me that there are still opportunities to get infected. On the other hand, you have reduced the danger space, so that's good.
Re: (Score:2)
Re:LiveCD (Score:4, Insightful)
It's time to look at the Intel vPro tm. tech that enables this. Look for demo videos online. The level in the BIOS enables remote powering up machines to push OS updates, remote booting repairing crashed/unbootable Windows machines, etc. This protected level of stuff is beyond the OS and even the power switch. IF it can remote boot an unbootable corrupt Windows partition, write fixes to it and boot it up, there just isn't much that a Live CD can hide. You best bet is to use your own known hardware. Turn off the remote management stuff unless your employer is using it. If the employer is using it, their top level management should be able to detect alterations to the protected area.
Parent
Difficult in practice (Score:5, Interesting)
Re:Difficult in practice (Score:4, Funny)
Exactly. Windows was written to solve this very problem. All this talk about hiding root kits in SMM is one giant leap backwards.
Parent
Re:Difficult in practice (Score:4, Interesting)
Parent
Re: (Score:2)
1. probably no unless whatever malware was loaded is actually Doing Something actively. Otherwise it is just kind of idling in a 'protected' (from OS) space of RAM
2. really not trying to be a pedantic jerk, but ROM cannot be flashed (Read Only Memory), did you mean EPROM? (which IS flashable)
Also sometimes EPROM's can be reflahed to OEM state, sometimes they can be trashed by a faulty/malicious flash-depends (YMMV)
3. I'm not sure, but as per #2 above
Re: (Score:2)
Re: (Score:2)
You are correct, it's been a few years since I have had to deal with the different types of chips.
I was just trying to help the guy out.
Re: (Score:2)
Re: (Score:3, Informative)
Manipulating the ROM image is trivial. It basically consists of the emergency boot block, a small LHARC decompressor, and a mini filesystem (basically a linked list) containing some modules of position-independent code in LHARC archives. If you want to add a module, simply compress it, read out the existing image, append your achive to the list, and write the result back. People have been doing this so often, f.e. f
Re: (Score:2)
Has something changed, or is the term ROM now commonly used for all embedded chips?
Really not trying to be a pedant, just want to know.
If this is a case of 'not confusing the proles', then okay- sometimes it is easier to 'go with the flow' instead of being bogged down in technospeak, but I'm really starting to doubt my education and (slim) knowledge here.
Re: (Score:3, Informative)
is the term ROM now commonly used for all embedded chips?
Erasable, programmable, read-only memory chips, aka EPROMs, are a type of read-only memory chip, aka ROMs.
As are EEPROMs, which is the specific type of ROM we are talking about here (electronically erasable, programmable, read-only memory), since they don't require a UV light to erase the chips.
To further confuse things, flash memory (such as SD cards, USB flash drives, internal memory for iPods, cameras, phones, as well as SSD drives) are actually a type of EEPROM, even though they aren't strictly read-on
There could be something to this (Score:4, Interesting)
It seems to me that this would be exactly the sort of thing you'd look for. Military machines are specced very precisely, you'd know exactly what hardware was on the system so drivers wouldn't be much of an issue.
All you'd have to do is sneak your code in here once, and the timebomb would be ticking for when you want to activate it. Yeah, it wouldn't be easy to get it on there, but it means breaking through once allows you to lay a trap for another time. That sounds pretty serious to me.
Re: (Score:2, Interesting)
They were using eBay to track down replacements.
Re: (Score:2)
Lets say you are an evil terrorist hell-bent on infultrating the American military and wrecking havoc.
I think this would, in fact, make you not evil, but very very good.
Re: (Score:2)
Re: (Score:2)
The point is that if you were planning some attack, you would want to co-ordinate a computer system failure with the rest of the attack. You have militants willing to die while making an attack, and you have the ability to screw up an important computer for a short period of time. If you can't co-ordinate them then all you get from both is a bit of annoyance and fear. Co-ordinate them and you get an attack at the sa
IPMI Card Vulnerabilities (Score:4, Interesting)
What about vulnerabilities in onboard IPMI [wikipedia.org] cards? Our new servers have ARM-based cards running Linux. The built-in HTTP server is vulnerable to a widely-known buffer overflow:
landonf@ahost:~> telnet XXX.XXX.XXX.XXX 80Trying XXX.XXX.XXX.XXX...
Connected to XXX.XXX.XXX.XXX.
Escape character is '^]'.
GET
Connection closed by foreign host.
landonf@timor:~> telnet XXX.XXX.XXX.XXX 80
Trying XXX.XXX.XXX.XXX...
telnet: connect to address XXX.XXX.XXX.XXX: Connection refused
Seems like a recipe for compromised data centers, to me. Re-imaging a machine won't touch the IPMI card.
Re:IPMI Card Vulnerabilities (Score:4, Insightful)
Parent
Looks like an argument for openness to me... (Score:4, Insightful)
Re: (Score:3, Insightful)
The second problem is that there is no "administrator", at least no qualified one for most of the home computers in the world. Windows needs some administration, arguably more administration th
Re: (Score:2)
Neither news or an issue (Score:2, Informative)
Re: (Score:3, Informative)
Not really an issue on recent hardware (Score:5, Informative)
Obviously, it has to be possible for the BIOS to put code their in the first place. There's a configuration flag in the northbridge (on recent Intel chipsets, it's byte 0x9d of the PCI configuration space on the host bridge) that controls whether accesses are directed to the graphics hardware or physical memory. The BIOS can set that to do the initial setup. Once it's done that, the bit is flipped and normal code can no longer see the SMM code. The vulnerability lies in the fact that OS code could reset that bit, gain access to the SMRAM and modify it. Any BIOS I've seen from the past couple of years has gone a step further and set an additional bit that prevents this from occuring. Once that bit is set, the only way for normal code to gain access to the SMRAM region is for the machine to be reset. This happens before any OS code gets run, so there's no opportunity to install hostile SMM handlers.
Is it still possible to exploit? Yes. If the attacker can modify your BIOS they can modify the code that it copies into SMRAM. However, if the attacker can modify your BIOS then they've already won even without using SMM. The initial bootloader uses BIOS calls to read data off disk, so a sufficiently intelligent attack could rewrite that in order to boot a modified kernel. In versions of Windows before Vista, most graphics drivers still made BIOS calls. A modified BIOS could do anything it wanted to with those without looking suspicious in the slightest. Like the article says, it's unlikely that this'll be common. But to be honest, I don't see it happening in the real world at all.
(Today I have been trying to work out just WTF a Dell laptop does when it enters system management mode in response to a brightness hotkey press. The locking down of SMRAM makes this effectively impossible)
Re: (Score:2)
Invisible to anti-virus? (Score:3, Insightful)
Re: (Score:3, Interesting)
Malware writers ain't dumb. They know they are the offensive player in that game and they use that advantage.
How specific of a target? (Score:4, Interesting)
TFS says the code must be specifically targeted to a particular machine which, on a PC, means a very big challenge.
On a Mac, however, you could easily target a very large number of people using only a very small number of hardware variations. Could this exploit be better suited to Macs than PCs? On the other hand, it also seems like it would be equally easier to detect the problem, since your algorithm can be fairly specific (both in terms of Macs and PCs), since the code needed to exploit would be rather specific.
Re: (Score:2)
a) Mac's have something like 1-4% market share (including the PowerPC models which may not even have this mode), all you have to do is find a processor with greater than 1-4% market share in the windows and target that.
b) These are rootkits running outside of the OS, so you wouldn't target a particular OS, you target a chip (or perhaps a chipset?). You'd want the most popular ones running. Could be a chip in Mac and Windows would be most popular. Article doesn't mention how much the OS is needed
Re:My BIOS has a toggle for virtualization feature (Score:5, Informative)
Parent