Feeds

Researchers say rootkits are headed for BIOS

Flash warning

  • alert
  • submit to reddit

High performance access to file storage

Insider attacks and industrial espionage could become more stealthy by hiding malicious code in the core system functions available in a motherboard's flash memory, researchers said on Wednesday at the Black Hat Federal conference.

A collection of functions for power management, known as the Advanced Configuration and Power Interface (ACPI), has its own high-level interpreted language that could be used to code a rootkit and store key attack functions in the Basic Input/Output System (BIOS) in flash memory, according to John Heasman, principal security consultant for UK based Next-Generation Security Software.

The researcher tested basic features, such as elevating privileges and reading physical memory, using malicious procedures that replaced legitimate functions stored in flash memory.

"Rootkits are becoming more of a threat in general- BIOS is just the next step," Heasman said during a presentation at the conference. "While this is not a threat now, it is a warning to people to look out."

The worries come as security professionals are increasingly worried about rootkits. Earlier this month, a security researcher warned that the digital-rights management software, which experts say resembled a rootkit, used by music giant Sony BMG remained on hundreds of thousands of servers. Last year,the first rootkit for the Mac OS X was released to the Internet.

While some attacks have attempted to affect a computer's flash memory, most notably the CIH or Chernobyl virus in 1998, the ability to use the high-level programming language available for creating ACPI functions has opened up the attack to far more programmers.

One rootkit expert at the conference predicted that the technology will become a fundamental part of rootkits in the near future.

"It is going to be about one month before malware comes out to take advantage of this," said Greg Hoglund, a rootkit expert and CEO of reverse engineering firm HBGary. "This is so easy to do. You have widely available tools, free compilers for the ACPI language, and high-level languages to write the code in."

The firmware on most modern motherboards has tables associating commands in the ACPI Machine Language (AML) to hardware commands. New functionality can be programmed in a higher level ACPI Source Language (ASL) and compiled into machine language and then flashed into the tables.

However, the ability to flash the memory depends on whether the motherboard allows the BIOS to be changed by default or if a jumper or setting in the machine setup program has to be changed. Security professionals at the conference disagreed over how many machines would have the ability to write to flash memory turned on by the manufacturer. While Hoglund believed that most computers would not have protections against writing to flash memory turned on by default, NGSSoftware's Heasman thought otherwise.

"The obstacles to deployment are numerous," Heasman said. "Almost all machines have a physical protection, such as a jumper on the motherboard, against flashing."

However, an insider attacker could flash their laptop before they leave a company and then use the rootkit, which would survive reinstallation of the operating system. The insider could then gain access to the corporate network at a later time.

Because the amount of memory that could be used by an attacker in the BIOS firmware is small, it is unlikely that an entire rootkit will be stored in the motherboard's memory. Instead, only specific functions and bootstrap code would likely be hidden there.

Another benefit of programming to the ACPI Source Language is that, for the most part, the code can be ported easily to any platform.

"This is platform independent," Heasman said. "We can write a backdoor for Windows that will elevate privilege, and turn around and use the code on Windows."

This article originally appeared in SecurityFocus

Copyright © 2006, SecurityFocus

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.