Title: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: Dark_Knight on March 17, 2009, 07:09:10 PM

http://www.networkworld.com/community/node/39825 (http://www.networkworld.com/community/node/39825)

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: former33t on March 17, 2009, 07:25:53 PM

Thanks for the heads up. A little birdie told me last year that this was coming (in fact I heard that it would be out October of last year). I can't wait to see the exploit code.

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: Ketchup on March 17, 2009, 07:37:51 PM

Wow, that's sweet! Scary, but sweet indeed. I can't wait to read the paper. Thanks for posting this!

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: NickFnord on March 19, 2009, 06:25:38 PM

and it's been posted:

http://theinvisiblethings.blogspot.com/2009_03_01_archive.html

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: former33t on March 19, 2009, 08:48:42 PM

I read the article and noticed that they claim it could also be used to move from ring 3 to SMM. Did anyone quite get how that was working? I see how to move from ring 0 to SMM using this exploit. Still a major feat, but I'm missing how an unprivileged user is able to exploit this as they need to alter one of the MSR's. Even in Linux, only root has access to write to these.

I've read it twice and understand Intel architecture pretty well but I can't see how this exploit can be used (by itself) by a non-privileged user on any OS I'm familiar with to dump SMRAM.

Can anyone help with a clarification?

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: Ketchup on March 23, 2009, 10:23:48 AM

I finally made it through the article and the one referenced from Blackhat 2008. While I do not fully understand Intel architecture, it seems like this is quite real, but not as scary as it sounded. You would have to do quite a bit of recon and then write some simplistic drivers and interfaces for each function of your rootkit, such as keyboard trapping and network I/O. Like the papers state, this makes it a very targeted attack at this point. Looks like Intel is slowly but surely patching these vulnerabilities. I am guessing that if they completely drop the ball here, you are going to see people writing some automated tools to exploit these.

Former33t, you would have to escalate privs from ring 3 in order to gain access to the SMM RAM areas. There are a number of exploits in Windows and Nix that some can take advantage of for this purpose.

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: sgt_mjc on March 23, 2009, 12:06:05 PM

That is really interesting. I wonder what the final fix will be.

Title: Re: Uh Oh, rootkit code to exploit major Intel chip flaw to be posted 3/19/09
Post by: Ketchup on March 23, 2009, 03:58:36 PM

As I understood it, BIOS and Chipset manufacturers have to get together and stop allowing access to the SMRAM area of RAM from the OS. Although, if I understood it correctly, one of the exploits dealt with the area of RAM where VGA memory and SMRAM memory crossed over.

EH-Net

Ethical Hacking Discussions and Related Certifications => Malware => Topic started by: Dark_Knight on March 17, 2009, 07:09:10 PM