New BIOS attack renders antivirus useless

By Iain Thomson
27 March 2009 10:45AM
A new form of attack that installs a rootkit directly onto a computer’s BIOS system would render antivirus software useless researchers have warned.

Alfredo Ortego and Anibal Sacco of Core Security Technologies explained that the attack was possible against almost all types of commonly used BIOS systems in use today.

The two devised a 100 line Python script that could be flashed onto the BIOS to install a rootkit. Because the BIOS software activated before any other program on a computer when it starts up then normal antivirus software would be unable to detect it.

“We tested the system on the most common types of BIOS,” said Ortega.

“There is the possibility that newer types of Extensible Firmware Interface (EFI) BIOS may be resistant to the attack but more testing is needed.”

The attack is only possible if the attacker already has full administrative control of the target PC, but this is possible through a standard virus infection. Once that is achieved the malware operator would be able to flash a rootkit directly onto the BIOS.

Even if the initial virus was detected and removed the computer would still be under remote control. Even a full wipe of the hard drive and complete reinstallation of the operating system would not remove it they warned.

If a sophisticated rootkit was put onto the BIOS it could be even more difficult for an administrator to debug the system, said Ivan Arce, chief technology officer at Core Security Technologies.

“You’d need to reflash the BIOS with a system that you know has not been tampered with,” he said.

“But if the rootkit is sophisticated enough it may be necessary to physically remove and replace the BIOS chip.”

The attack vector is also usable against virtual systems the researchers said. The BIOS in VMware is embedded as a module in main VMware executable and thus could be altered.

However it is possible to protect against this attack by locking down the BIOS chip from flash updates, either by password protecting the system against unauthorised changes or physically.

“The best approach is prevention, preventing the virus from flashing onto the BIOS,” said Sacco.

“You need to prevent flashing of the bios, even if it means pulling out jumper on motherboard.”

Copyright © 2009 vnunet.com

New technology of rootkits: Unreal

There is report of new Rootkit technology that can bypass all known Anti-Rootkit. This rootkit can be downloaded for testing.

Check out the forum site from Sysinternal:
http://forum.sysinternals.com/forum_posts.asp?TID=9630&PN=1&TPN=1

Review on 6 Rootkit revealers from Informationweek

Check out full review from Informationweek.

They gives you some good background information that normal people can understand and reveals 6 well known Rootkit revealers. But they missed one more good program Sophos Anti-Rootkit (Which is best out of 6 rootkit revealers reviewed on below link).

Six reviewed anti-rootkit products:-
• F-Secure BlackLight• IceSword• RKDetector• RootkitBuster• RootkitRevealer• Rootkit Unhooker

Sophos Anti-Rootkit can be download from http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Full review from Informationweek:-
Link: http://www.informationweek.com/shared/printableArticle.jhtml?articleID=196901062

Mark Russinovich's video on malware detection and cleaning!

Check out some interesting video on Rootkit hunting

http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=359