BIOS based rootkits coming soon….



There have been a couple stories out of the “Blackhat federal” conference in the last couple days. Brian Krebs at the Security Fix gives a good overview. One of the more troubling notes is the possibility of creating a rootkit that can hide itself in a systems BIOS. Security Focus has some detail on this as well.


This kind of reminds me of the “old days” of computer viruses where you NEVER did a scan from within the operating system because boot sector viruses, or other infected startup files could hide themselves from a running virus scan. I guess the simplest way to put the problem is this…. ACPI is a function that most BIOS’ these days support. It supports a higher level programming language and if the ACPI BIOS is left writable, then someone COULD hide a “bootstrap” for a rootkit in the BIOS.

This “bootstrap” would then be able to download and install other, larger components later to disc. What’s disturbing about this is that the rootkit itself would survive a drive reformat, or even drive replacement. It would still lay in wait in the BIOS when running an alternative operating system or boot cd. It’s unlikely (they say) that we might have an easily transmittable rootkit that does this, but would most likely be done as “an inside job” where someone with physical access to the machine is able to load this. It’s not reassuring though. Admittedly “pysicall access” to the machine is usually game over in a security context, because really and truly if someone has physical access they can do whatever they please with the box.

Related Posts

Blog Traffic Exchange Related Posts Blog Traffic Exchange Related Websites
  • Tennis Ball Machine Advantages If you are looking for ways for you to significantly improve your techniques in tennis, then one of the best things that you can possibly to do is to invest in a tennis machine or tennis ball machine. This is a truly ideal device for anyone that is interested in......
  • WEP vs WPA Another question I get asked a lot is on Wireless security.  People get very confused by the security options out there, and the industry doesn't help by adding acronym after acronym.  So what do you do?  The answer is fairly simple - secure your network with WPA!! There are lots......
  • The Benefits of using Cloud Hosting over Traditional Hosting Servers Everybody's talking about cloud computing, and with good reason - it's likely to become a fundamental part of day-to-day life. The impact of cloud computing on web hosting can't be underestimated. Trying to figure out the best hosting option is one of the first major headaches that anyone who is......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site