'Voodoo' Hackers: Stealing Secrets From Snowden's Favorite OS Is Easier Than You'd Think

by
Anonymous Coward
in security on (#J92P)
Tor has its advocates, and it's certainly our best chance at ensuring a modicum of privacy online. But it's got vulnerabilities of its own.

One attack vector is through secure BIOS systems that can be rooted and then have access to everything a computer does, regardless of operating system.
Kallenberg and Kovah have created a tool that automates the identification and exploitation of BIOS bugs, a number of which they will detail at CanSecWest. Using their own bespoke malware, they have repeatedly been able to gain access to System Management Mode (SMM), a part of the computer used by firmware that's entirely separate from other processes, but can read everything going through a machine's memory.

"Once the payload is delivered, we have an agent running in SMM," said Kallenberg during a demo session with FORBES. "The thing about SMM is that it runs independent of the operating system, the operating system has no visibility into system management mode, it's a protected region that can't be read or written by the OS - Tails can't read or write to it - but it has access to all of memory."
Check out the rest at 'Voodoo' Hackers: Stealing Secrets From Snowden's Favorite OS Is Easier Than You'd Think.

Re: FFS (Score: 1)

by evilviper@pipedot.org on 2015-08-24 21:05 (#JB8Z)

Credit goes too, to groups like Intel, who have steadily increased the 'power' and 'utility' of the BIOS to the point where it is now a fun attack vector.
Actually, the only thing that changed to make rootkits in firmware practical, is the size of the EEPROM. Back when your CMOS was 64K, there wasn't a lot of room to hide very advanced malicious code in there. Now that there's multiple megabytes to work with, there's plenty of room to store that code. You'd have these problems whether firmware got more advanced, or not. Even the simplest firmware can be modified to boot other (malicious) code first.

Requiring firmware to be cryptographically signed could solve the problem... as well as a jumper on the board that disables firmware updates. OEMs just need to be encouraged to care enough to do something... Right now, they don't.
Post Comment
Subject
Comment
Captcha
Which of ninety four, forty nine or 95 is the largest?