IoT
News
News
1/27/2006
07:05 PM
50%
50%
RELATED EVENTS
The Analytics Job and Salary Outlook for 2016
Jan 28, 2016
With data science and big data top-of-mind for all types of organizations, hiring analytics profes ...Read More>>

BIOS Could Hide Rootkits

Attackers could use the PC's Advanced Configuration and Power Interface, a collection of power management controls, to code or deploy snippets of a rootkit into the BIOS flash memory, a researcher says.

Attackers armed with rootkits may hide some of their malicious code inside the PC's BIOS flash memory, a researcher said at this week's Black Hat conference, a tactic that would make it tougher for defenses to detect the cloaking, and infecting the computer permanently, even if the operating system's reinstalled.

John Heasman, principal security consultant for U.K.-based Next-Generation Security Software (NGS), laid out the threat in a presentation Wednesday at the Black Hat conference in Washington, D.C.

Attackers could use the Advanced Configuration and Power Interface (ACPI), a collection of power management controls, and its programming language to code and/or deploy snippets of a rootkit into the BIOS flash memory. Hackers could even replace legitimate functions in the ACPI's language with their own, malicious, operations, said Heasman.

Among the dangers of such BIOS rootkits, he added, were that they were immune to reboots -- eliminating the current practice of hackers re-running the code each time the machine starts up, one way security software sniffs out malicious code -- weren't detectable on the drive (which current security software spends most of its time examining), and could survive disk reformatting and operating system reinstallation.

To defend systems against such strategies, Heasman said systems could be set to prevent BIOS memory reflashing (usually done by resetting a jumped on the motherboard) or shifting to computers with use signed BIOS, such as Phoenix Technologies' TrustedCore or Intel's SecureFlash.

Comment  | 
Print  | 
More Insights
Register for InformationWeek Newsletters
White Papers
Current Issue
How to Knock Down Barriers to Effective Risk Management
Risk management today is a hodgepodge of systems, siloed approaches, and poor data collection practices. That isn't how it should be.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.