Hackers Find A New Hiding Place for Rootkits
Hackers Find A New Hiding Place for Rootkits
Security researchers have reportedly developed a new type of malicious rootkit software capable of hiding itself in an obscure part of a computer's microprocessor, hidden from current antivirus products.
Dubbed a System Management Mode (SMM) rootkit, the software runs in a protected part of a computer's memory that can be locked and rendered invisible to the operating system, but it can give attackers details of what's happening in a computer's memory.
The SMM rootkit, built by Shawn Embleton and Sherri Sparks, operators of security company Clear Hat Consulting, comes with keylogging and communications software, and could be used to steal sensitive information from a victim's computer. It will be demonstrated for the first time at the Black Hat Security conference in Las Vegas this August.
Sparks notes that rootkits are going more and more toward hardware, and the deeper into the system you go, the more power you have because it's harder to detect. Sparks wrote another rootkit three years ago called Shadow Walker.
Rootkits garnered a lot of attention in late 2005 when Sony BMG Music used rootkit techniques -- resulting in the recall of millions of CDs amid the ensuing scandal -- to hide its copy protection software.
The SMM rootkit uses a feature that dates back to Intel's 386 processors where it was added as a way to help hardware vendors fix bugs in their products using software. The technology is also used to help manage a computer's power management, such as taking it into sleep mode.
Not being a part of the operating system makes the SMM rootkit stealthy and harder to detect. It also means that hackers have to write the driver code expressly for the system they are attacking. Detection techniques will be discussed during the Black Hat conference in August.
Visit Bill's Links and More for more great tips, just like this one!

My name is Dennis Faas and I am a senior systems administrator and IT technical analyst specializing in cyber crimes (sextortion / blackmail / tech support scams) with over 30 years experience; I also run this website! If you need technical assistance , I can help. Click here to email me now; optionally, you can review my resume here. You can also read how I can fix your computer over the Internet (also includes user reviews).
We are BBB Accredited
We are BBB accredited (A+ rating), celebrating 21 years of excellence! Click to view our rating on the BBB.