Hackers Find A New Hiding Place for Rootkits
- by Bill Lindner on 20080515 @ 10:35PM EST | google it | send to friends
- Filed under Security | (related terms: system, smm rootkit, computer memory, sparks, operating system)
Security researchers have reportedly developed a new type of malicious rootkit software capable of hiding itself in an obscure part of a computer's microprocessor, hidden from current antivirus products.
Dubbed a System Management Mode (SMM) rootkit, the software runs in a protected part of a computer's memory that can be locked and rendered invisible to the operating system, but it can give attackers details of what's happening in a computer's memory.
The SMM rootkit, built by Shawn Embleton and Sherri Sparks, operators of security company Clear Hat Consulting, comes with keylogging and communications software, and could be used to steal sensitive information from a victim's computer. It will be demonstrated for the first time at the Black Hat Security conference in Las Vegas this August.
Sparks notes that rootkits are going more and more toward hardware, and the deeper into the system you go, the more power you have because it's harder to detect. Sparks wrote another rootkit three years ago called Shadow Walker.
Rootkits garnered a lot of attention in late 2005 when Sony BMG Music used rootkit techniques -- resulting in the recall of millions of CDs amid the ensuing scandal -- to hide its copy protection software.
The SMM rootkit uses a feature that dates back to Intel's 386 processors where it was added as a way to help hardware vendors fix bugs in their products using software. The technology is also used to help manage a computer's power management, such as taking it into sleep mode.
Not being a part of the operating system makes the SMM rootkit stealthy and harder to detect. It also means that hackers have to write the driver code expressly for the system they are attacking. Detection techniques will be discussed during the Black Hat conference in August.
Visit Bill's Links and More for more great tips, just like this one!
Related articles:
- 2008/03/06 Tool Can Hack Into A Windows PC Sans Password
- 2008/03/14 WalMart Ditches In-Store Linux PCs
- 2008/02/28 Protein Adds Muscle to Computer Memory
- 2008/04/22 PC-Based Windows Rival Still Unlikely
- 2007/02/06 HP Urge Computer Chip Industry to Adopt Nanotechnology
- 2008/02/27 Young Hacking Ring Busted by Quebec Authorities
- 2008/03/24 Windows Vista SP1 Causing More Problems
- 2006/01/06 Rootkits and Windows
- 2008/01/29 Once Again Microsoft Says Windows Vista 'Most Secure'
- 2008/05/30 New Study Reveals Developers Prefer XP
Stay Informed: Subscribe Free to Infopackets, Today! Get your daily fix of Microsoft Windows news, reviews, tech tips, plus free software (freeware) goodies daily -- all absolutely free -- delivered straight to your email inbox! Bonus: join our website today and you'll also receive our highly coveted Top 10 Tech Reports, including: Top 10 PC Security Essentials, Windows Optimization Secrets, Top Freeware Antivirus, MS Office alternatives and more. Don't delay: subscribe today! Click here for more info.
Infopackets Game of the Week
Secrets of the Dark: Eclipse Mountain Collector's Edition
