Hiding a Rootkit In System Management Mode 119
Sniper223 notes a PC World article on a new kind of rootkit recently developed by researchers, which will be demoed at Black Hat in August. The rootkit runs in System Management Mode, a longtime feature of x86 architecture that allows for code to run in a locked part of memory. It is said to be harder to detect, potentially, than VM-based rootkits. The article notes that the technique is unlikely to lead to widespread expoitation: "Being divorced from the operating system makes the SMM rootkit stealthy, but it also means that hackers have to write this driver code expressly for the system they are attacking."
Re:My BIOS has a toggle for virtualization feature (Score:5, Informative)
hmm (Score:5, Funny)
Re:hmm (Score:5, Funny)
Isn't that like using a gun to prevent a cold? Yes I suppose it's effective, but still...
Re:hmm (Score:5, Funny)
Re: (Score:2)
Where can I buy this gun of which you speak ?
Re: (Score:1, Redundant)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3, Interesting)
Re: (Score:1)
I'm Canadian, you insensitive clod! (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
And outboard motors! Eh!
Re: (Score:2)
Re: (Score:2)
Re:hmm (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Norton? Bah, I have Chuck Norris [chucknorrisfacts.com]. If a rootkit tried to to invade my system, Chuck Norris would roundhouse kick it into that great digital black hole.
oooooh scary (Score:5, Insightful)
Re:oooooh scary (Score:5, Informative)
The attack vector is made a lot easier because most BIOS vendors don't blockhole the address range as they need to support USB devices DMAing into the Aseg and Tseg segments (the memory ranges utilized by SMM). This is what you pay for to be able to use a USB keyboard in DOS. Legacy emulation so that all those ancient BIOS interrupt calls continue to work with your latest input devices..
If there is a modern operating system running, there is a handoff between the OHCI driver and the SMM using a mailbox register on the usb controller so that the BIOS stops using the USB controller. What this means that modulo BIOS services that do things like control fans (and aren't implemented in ACPI), something could slip into SMM quite easily and flip the bit that makes it impossible for your antivirus to find it.
Re: (Score:1, Interesting)
Re:oooooh scary (Score:4, Interesting)
You can even have it trigger on the first BIOS calls of the windows bootloader so that you can easily overwrite the SMM memory regions in a nice and portable way.
Re:oooooh scary (Score:4, Interesting)
Re: (Score:2)
At last, someone who is familiar with the problem and the technology involved. Yes, SMM memory space is often locked by the BIOS and not subject to viewing by anti-virus. Not that anti-virus would know what code written to run in SMM looks like since it's not exactly a normal Windows or Linux binary.
are you sure? http://tech.slashdot.org/article.pl?sid=08/05/19/2223258 [slashdot.org]
sounds like colinux runs in SMM, and would be a perfect starting platform for writing a stealth rootkit with complete LAMP capabilities.. far more functionality than any normal stealth rootkit could ever hope to give hackers... and most of the code is already written for them! (sure they have to write the bit that flips the bit that makes colinux invisible, and colinux might not work on all systems yada yada yada....)
Re: (Score:2)
Re:oooooh scary (Score:4, Insightful)
Re: (Score:3, Funny)
That's exactly what the unstoppable supervirus wants you to think!
Re: (Score:1)
Who cares, its not that bad....I have neighbors constantly disturbing me to redo
their computers each time they get a virus and their comp slows down to a halt.
I tell them what to do and what NOT to do, they still do what the f*ck they want....
so it never changes. There will still be people like you that say things are still ok,
then 9/111 happens to show how wrong you / we are in thinking we are safe.
It takes a big catastrop
LiveCD (Score:2, Interesting)
I do all my internet banking via freeBSIE now - yes it takes a veeeeery long time to boot, and I know that it doesn't solve ALL of the problems but it has to eliminate enouogh problems to be a viable solution.
Agree / disagree ?
Re:LiveCD (Score:5, Informative)
Re: (Score:2)
Trustable BIOS (Score:2)
Re: (Score:2)
It seems to me that there are still opportunities to get infected. On the other hand, you have reduced the danger space, so that's good.
Re: (Score:2)
Re:LiveCD (Score:4, Insightful)
It's time to look at the Intel vPro tm. tech that enables this. Look for demo videos online. The level in the BIOS enables remote powering up machines to push OS updates, remote booting repairing crashed/unbootable Windows machines, etc. This protected level of stuff is beyond the OS and even the power switch. IF it can remote boot an unbootable corrupt Windows partition, write fixes to it and boot it up, there just isn't much that a Live CD can hide. You best bet is to use your own known hardware. Turn off the remote management stuff unless your employer is using it. If the employer is using it, their top level management should be able to detect alterations to the protected area.
Re: (Score:2)
A fast CD drive helps, as do light live distros. I find Damn Small Linux boots very quickly.
You might also boot an ISO image from a flash drive or CF card that is write-protected and/or has no persistent home directory. Google for LOTS of info on doing this. I don't find live CD boot times to be very long on modern PCs, even with full distros like Knoppix.
Difficult in practice (Score:5, Interesting)
Re:Difficult in practice (Score:4, Funny)
Exactly. Windows was written to solve this very problem. All this talk about hiding root kits in SMM is one giant leap backwards.
Re:Difficult in practice (Score:4, Interesting)
Re: (Score:1)
Re: (Score:2)
1. probably no unless whatever malware was loaded is actually Doing Something actively. Otherwise it is just kind of idling in a 'protected' (from OS) space of RAM
2. really not trying to be a pedantic jerk, but ROM cannot be flashed (Read Only Memory), did you mean EPROM? (which IS flashable)
Also sometimes EPROM's can be reflahed to OEM state, sometimes they can be trashed by a faulty/malicious flash-depends (YMMV)
3. I'm not sure, but as per #2 above
Re: (Score:2)
Re: (Score:2)
You are correct, it's been a few years since I have had to deal with the different types of chips.
I was just trying to help the guy out.
Re: (Score:1)
Please mods, this was an attempt at humor (piling on). Maybe with your help I can be rehabilitated. In the mean time, I've never seen a +5 redundant. BRING ON THE UNDERRATED POINTS!
Re: (Score:2)
One particular form of flash memory, NAND flash, uses a structure that is distinct from most other kinds of EEPROM. NOR fla
Really? I hadn't not thought of it that way (Score:2)
Re: (Score:2)
Re: (Score:1)
I can see being very careful with systems that are used for a wide range of tasks, but the desktop machine with nightly backups that you use to draft documents doesn't seem like it is going to be so important that you need to inspect all binaries. Most people use computers for stuff that is even less important than that.
Re: (Score:2)
Surely your compiler is a binary? And your BIOS? Disk firmware? Processor microcode?
Unless you built (not assembled, mind you, but rather built from bits of copper and silicon) all the hardware yourself, at some point, there is a binary black box you have to trust.
Re: (Score:1)
Re: (Score:3, Informative)
Manipulating the ROM image is trivial. It basically consists of the emergency boot block, a small LHARC decompressor, and a mini filesystem (basically a linked list) containing some modules of position-independent code in LHARC archives. If you want to add a module, simply compress it, read out the existing image, append your achive to the list, and write the result back. People have been doing this so often, f.e. f
Re: (Score:2)
Has something changed, or is the term ROM now commonly used for all embedded chips?
Really not trying to be a pedant, just want to know.
If this is a case of 'not confusing the proles', then okay- sometimes it is easier to 'go with the flow' instead of being bogged down in technospeak, but I'm really starting to doubt my education and (slim) knowledge here.
Re: (Score:3, Informative)
is the term ROM now commonly used for all embedded chips?
Erasable, programmable, read-only memory chips, aka EPROMs, are a type of read-only memory chip, aka ROMs.
As are EEPROMs, which is the specific type of ROM we are talking about here (electronically erasable, programmable, read-only memory), since they don't require a UV light to erase the chips.
To further confuse things, flash memory (such as SD cards, USB flash drives, internal memory for iPods, cameras, phones, as well as SSD drives) are actually a type of EEPROM, even though they aren't strictly read-on
There could be something to this (Score:4, Interesting)
It seems to me that this would be exactly the sort of thing you'd look for. Military machines are specced very precisely, you'd know exactly what hardware was on the system so drivers wouldn't be much of an issue.
All you'd have to do is sneak your code in here once, and the timebomb would be ticking for when you want to activate it. Yeah, it wouldn't be easy to get it on there, but it means breaking through once allows you to lay a trap for another time. That sounds pretty serious to me.
Re: (Score:2, Interesting)
They were using eBay to track down replacements.
Re: (Score:2)
Houston, we have an attack vector.
I wouldn't deem it unlikely that the military goes through similar venues to get "old hardware" that's no longer being built but has to be used because of specs. I think NASA did something similar when they needed old (and space-proof) hardware.
Re: (Score:2)
Lets say you are an evil terrorist hell-bent on infultrating the American military and wrecking havoc.
I think this would, in fact, make you not evil, but very very good.
Re: (Score:1)
Those countries always bring liberty, equality, and cell-phone coverage to all they conquer.
Re: (Score:2)
Re: (Score:2)
The point is that if you were planning some attack, you would want to co-ordinate a computer system failure with the rest of the attack. You have militants willing to die while making an attack, and you have the ability to screw up an important computer for a short period of time. If you can't co-ordinate them then all you get from both is a bit of annoyance and fear. Co-ordinate them and you get an attack at the sa
Re: (Score:2)
Let's not be paranoid, but we all know that computer hardware today is mostly built outside of the U
IPMI Card Vulnerabilities (Score:4, Interesting)
What about vulnerabilities in onboard IPMI [wikipedia.org] cards? Our new servers have ARM-based cards running Linux. The built-in HTTP server is vulnerable to a widely-known buffer overflow:
landonf@ahost:~> telnet XXX.XXX.XXX.XXX 80Trying XXX.XXX.XXX.XXX...
Connected to XXX.XXX.XXX.XXX.
Escape character is '^]'.
GET
Connection closed by foreign host.
landonf@timor:~> telnet XXX.XXX.XXX.XXX 80
Trying XXX.XXX.XXX.XXX...
telnet: connect to address XXX.XXX.XXX.XXX: Connection refused
Seems like a recipe for compromised data centers, to me. Re-imaging a machine won't touch the IPMI card.
Re:IPMI Card Vulnerabilities (Score:4, Insightful)
Looks like an argument for openness to me... (Score:4, Insightful)
Re: (Score:3, Insightful)
The second problem is that there is no "administrator", at least no qualified one for most of the home computers in the world. Windows needs some administration, arguably more administration th
Re: (Score:2)
Re: (Score:2)
That said, the continuum from appliance to fully customized system is, while not orthogonal to it, distinct from the continuum between fully closed and fully open systems.
Take the Free Telephony Project [rowetel.com] as an example. Their product is a little embedded Astrix PBX in a box. Plug it in, it works. Such a device can easily qualify as an appliance
Neither news or an issue (Score:2, Informative)
Re: (Score:3, Informative)
Re: (Score:1, Informative)
At any rate, there are many alternatives
Not really an issue on recent hardware (Score:5, Informative)
Obviously, it has to be possible for the BIOS to put code their in the first place. There's a configuration flag in the northbridge (on recent Intel chipsets, it's byte 0x9d of the PCI configuration space on the host bridge) that controls whether accesses are directed to the graphics hardware or physical memory. The BIOS can set that to do the initial setup. Once it's done that, the bit is flipped and normal code can no longer see the SMM code. The vulnerability lies in the fact that OS code could reset that bit, gain access to the SMRAM and modify it. Any BIOS I've seen from the past couple of years has gone a step further and set an additional bit that prevents this from occuring. Once that bit is set, the only way for normal code to gain access to the SMRAM region is for the machine to be reset. This happens before any OS code gets run, so there's no opportunity to install hostile SMM handlers.
Is it still possible to exploit? Yes. If the attacker can modify your BIOS they can modify the code that it copies into SMRAM. However, if the attacker can modify your BIOS then they've already won even without using SMM. The initial bootloader uses BIOS calls to read data off disk, so a sufficiently intelligent attack could rewrite that in order to boot a modified kernel. In versions of Windows before Vista, most graphics drivers still made BIOS calls. A modified BIOS could do anything it wanted to with those without looking suspicious in the slightest. Like the article says, it's unlikely that this'll be common. But to be honest, I don't see it happening in the real world at all.
(Today I have been trying to work out just WTF a Dell laptop does when it enters system management mode in response to a brightness hotkey press. The locking down of SMRAM makes this effectively impossible)
Re: (Score:2)
Invisible to anti-virus? (Score:3, Insightful)
Re: (Score:3, Interesting)
Malware writers ain't dumb. They know they are the offensive player in that game and they use that advantage.
Re: (Score:1)
Now you feel safe, now you can enter a CC number or password... but guess what - it's still not clean, BIOS was switched by the previous owner or someone who had physical access to the machine before it was sold. How do you detect this? If you can make the system log keystrokes in a comp
How specific of a target? (Score:4, Interesting)
TFS says the code must be specifically targeted to a particular machine which, on a PC, means a very big challenge.
On a Mac, however, you could easily target a very large number of people using only a very small number of hardware variations. Could this exploit be better suited to Macs than PCs? On the other hand, it also seems like it would be equally easier to detect the problem, since your algorithm can be fairly specific (both in terms of Macs and PCs), since the code needed to exploit would be rather specific.
Re: (Score:2)
a) Mac's have something like 1-4% market share (including the PowerPC models which may not even have this mode), all you have to do is find a processor with greater than 1-4% market share in the windows and target that.
b) These are rootkits running outside of the OS, so you wouldn't target a particular OS, you target a chip (or perhaps a chipset?). You'd want the most popular ones running. Could be a chip in Mac and Windows would be most popular. Article doesn't mention how much the OS is needed
Re: (Score:1)
I realize it's not targeting the OS, but it just so happens that (until very recently) all computers running Mac OS have a fixed hardware base, unlike PCs. I thought I made this fundamental concept pretty clear.
My point here is that even if Macs don't own the market, there is frequently at at least one in every major corporate/government network. Since they can be positively identified, and their hardware possibilities narrowed down to a tiny fraction of those for the PC market, it would be a logical entr
Re: (Score:2)
TFS says the code must be specifically targeted to a particular machine which, on a PC, means a very big challenge.
Regardless of this, it's still a pretty big challenge. It's well out of script-kiddie land and into "determined hacker" territory - and I can't imagine anyone would take it on unless the target was really worth it. Think large bank or governmental organisation.
Thing is, though, large banks and governmental organisations buy hundreds, if not thousands of identical PCs at a time - and they're likely to be based on relatively conservative hardware, rather than "latest and greatest gaming rig" stuff. Findin
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
int 19 (Score:1)
General Software BIOS (Score:1, Interesting)