Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?

Rootkit Could Hide In PCI Cards 134

Reverse Gear writes "SecurityFocus has an interesting article about a paper published on the possibility of hiding a rootkit in different PCI cards and having the rootkit survive a reboot or cleansing of the hard disk. It seems though that the author of the article doesn't think this would be abused frequently. From the article and paper: '(Because) enough people do not regularly apply security patches to Windows and do not run anti-virus software, there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.'"
This discussion has been archived. No new comments can be posted.

Rootkit Could Hide In PCI Cards

Comments Filter:
  • ....fundamentally flawed devices.

    Kinda like the people who build and operate them.
    • ....general purpose voting machines.
    • by Threni ( 635302 ) on Saturday November 18, 2006 @11:31AM (#16896144)
      Whenever someone goes on about `trust` and computers, show them this:

      http://cm.bell-labs.com/who/ken/trust.html [bell-labs.com]

      (Some people attempt to continue babbling, talking of new detection techniques, and expensive hardware, but you'll have done your bit.)
      • by Raenex ( 947668 )

        What's your point? Ken Thompson's paper shows that if you get compromised at a deep enough level, you can remain compromised. The point of "trusted" computing is to not get compromised in the first place, and to limit the number of attack points.

        You seem to be saying that because there is a deep inherent flaw once a system gets compromised, that we shouldn't try to prevent that compromise from happening. I'm not saying that the current "Trusted Computing" initiative is the right answer (the problem i

    • No, no. They generally work as designed. :)
    • by starwed ( 735423 )
      I've seen this device used in science fiction before; in Stephen Donaldson's Gap series, a ship's computer technician installs malicious code in the interface cards the various ship systems use to talk to each other. They do a complete reboot of the computer systems, only to find that the virus is still there.
  • Sony (Score:3, Funny)

    by Peturbed ( 885463 ) on Saturday November 18, 2006 @10:21AM (#16895764)
    How long before this is in the drm?
    • This is a dupe [slashdot.org] from january. At the time it was predicted it would take 1 month before someone exploited it. The Sony DRM fiasco actually came after this was known. So it's entirely plausible that Sony actually did try to implement this because at the time they had not yet learned how bad agressive DRM was going to be for their bussiness
      • by sm62704 ( 957197 ) on Saturday November 18, 2006 @12:26PM (#16896582) Journal
        So it's entirely plausible that Sony actually did try to implement this because at the time they had not yet learned how bad agressive DRM was going to be for their bussiness

        Huh? They lost my business, naybe a few other nerds, but I don't see them in chapter 13, 11, or 7. I didn't see anyone go to jail or even fired for it. In fact, I don't see where they sufferred one tiny bit. "He he, we got caught this time. Next time we'll be more careful!"

        As will the other slimy, evil multinationals.
  • Not needed, thanks (Score:2, Insightful)

    by dryriver ( 1010635 )
    Sony's already figured out how to hide rootkits on Audio CDs.
    • by empaler ( 130732 )
      The evil bastards [sony.com] just hid their undocumented feature [wikipedia.org] in the data section of their Audio CD [wikipedia.org].
      Please, if I'm wrong, someone correct me and point fingers, and laugh at me...
    • They stopped doing this in Nov, of 2005, and it was done decievingly kind of like the Zango cash bullshit you see ALL OVER THE WEB now, by asking you to agree to a licensed agreement to listen to it on the pc, after which the rootkit infects your pc... once infected it makes your system vulnerable to several known trojans, such as the one for WoW that steals CD keys. The easy avoidance tip is if you plan on ripping a CD from sony, put a piece of tape on the outter edge of the disc to my your drive think it
  • Really (Score:5, Funny)

    by sharkey ( 16670 ) on Saturday November 18, 2006 @10:24AM (#16895782)

    there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.

    Are you sure? I was at Best Buy, and I could swear that all the CDs for Sony-signed artists had a free NIC included.

  • by MtViewGuy ( 197597 ) on Saturday November 18, 2006 @10:28AM (#16895804)
    From the article:

    (Because) enough people do not regularly apply security patches to Windows and do not run anti-virus software, there is little immediate need for malware authors to turn to these techniques as a means of deeper compromise.

    Note that in Windows XP, especially if you have Service Pack 2 applied, the Security Center in Windows XP SP2 nags you enough that you end up installing programs like the free editions of ZoneAlarm firewall and AVG Anti-Virus (in lieu of commercial Internet security suites) and at least reminds you to install security patches from Microsoft when it becomes available.
    • by 4e617474 ( 945414 ) on Saturday November 18, 2006 @11:11AM (#16896028)
      Actually, it nagged me enough about software piracy that I switched to Linux.
      • by sm62704 ( 957197 )
        I couldn't switch completely to Linux since I have about 50 gig of data on HDb that Mandrake 10.1 can't access (thinks subdirectories are files, thanks to Microsoft who automatically converted FAT32 to some other file system), so I'm dual boot; Windows for audio (50 gb of MP3s) and Linux for the internet.

        I uninstalled all networking components in Windows and disabled the network card, but somehow I'm still paranoid about the Windows side. Can I still be pwned in Windows over the wire?

        Windows stopped nagging
        • Re: (Score:2, Funny)

          by XMyth ( 266414 )
          Yes...infact I'm browsing your music collection now. It sucks.
        • by KDEWolf ( 972921 )
          It was actually you who converted your filesystem to NTFS, when installing Windows XP. It asks you when installing (and formatting your HD), so you should have known about it before doing so.
        • by Lorkki ( 863577 )

          I couldn't switch completely to Linux since I have about 50 gig of data on HDb that Mandrake 10.1 can't access (thinks subdirectories are files, thanks to Microsoft who automatically converted FAT32 to some other file system), so I'm dual boot; Windows for audio (50 gb of MP3s) and Linux for the internet.

          Either your Mandrake installation has an extremely old NTFS driver, is misconfigured in some way, or the subdirectories are encrypted or compressed. NTFS read support for Linux has been around for quite

        • Well, you can always transfer those files to a Linux machine via Samba, FTP, or a lot of DVDs...
        • by Novus ( 182265 )
          Slightly offtopic, but the emu10k1 driver in ALSA (as in the standard kernel) supports Audigy cards fine. alsaconf should pick it right up.
      • by wboelen ( 916816 )
        It nagged me enough to turn off the security center :) (but I use Linux most of the time anyway)
  • by __aaclcg7560 ( 824291 ) on Saturday November 18, 2006 @10:29AM (#16895810)
    It won't be long before the market is flooded root-kit infected ISA cards.
  • by Pompatus ( 642396 ) on Saturday November 18, 2006 @10:32AM (#16895820) Journal
    Moreover, computers that use the Trusted Computing Module to protect the boot process will be immune to this type of rootkit compromise, he wrote.

    So basically, this is a well disquised reason to implement the lastest windows DRM
    • Exactly -- I noticed that little nugget conveniently slipped in there, too. Makes me wonder what stake the author has in TCPA/Palladium/NGSCB/DRM flavor of the month.
    • Re: (Score:3, Insightful)

      by empaler ( 130732 )
      Trusted Computing isn't bad, per se. It's what it is used for.
      I'd love to have uncompromisable equipment.
      Think of it this way; you have a box standing around, just serving. An exploit is found that allows arbitrary code runs, and the particular individual (not a bot) running the arbitrary code scans the hardware, checks it against a list of exploitable units, pulls up the "fix" he needs for that piece of hardware, and bam, you're screwed.
      With TC, you could at least be warned that the equipment is compromi
      • Yeah, but my major objection to TCP is that you don't actually have any control over what's going on in your computer other than turning the module off. I'm not even sure you can turn it off, either. So now you have a chip in your computer that can take control of all the processes in that computer, or at least deny you access. Couple that with the backdoor that I'm sure has been installed and nobody owns their computer anymore. I wouldn't feel as bad about it if there were a jumper on the motherboard that
    • by Dunbal ( 464142 ) on Saturday November 18, 2006 @11:31AM (#16896136)
      Read what it says:

      will be immune to this type of rootkit compromise

            However the joy of "Trusted Computing" is that when someone finally DOES find a way to crack it, you'll never know and/or never be able to DO anything about it, apart from throw your computer in the trash.
      • How does that differ from the current situation? Adding protection against execution does not on its own render current spyware detection methods unusable.
    • by msobkow ( 48369 )

      There are many promises being made for TCM/DRM, yet there was apparently an unsigned driver wedged into a Vista system before the OS was even declared RTM. I am in no hurry to presume DRM/TCM will be as effective as some claim. It's theoretical protection capabilities are being advertised, the factual failures of previous attempts such as the XBox security chips are being conveniently "forgotten".

      To claim anything is "immune" from infection ignores three fundamental truths:

      1. The best lock, electronic o
      • by sm62704 ( 957197 )
        I'd heard of a skilled engineer who wrote a "virus" for mainframe devices almost 20 years ago.

        The first viruses were written for and on a mainframe in a university setting. IIRC it was sometime in the late 60s. It's been 20 years since I read the book that described it, but it was thought a game; whose virus could kill the other viruses.

        They had boot sector viruses for PCs back as early as 1983, almost as soopn as IBM started making PCs.
        • The game was called Darwin [wikipedia.org] and inspired the Core War [wikipedia.org] game that still has a competition to this day. But I'm not sure if it really counts as a virus?
  • Just make the peripheral driver run a check on the card firmware before activating it.
    • Re: (Score:3, Informative)

      by Vihai ( 668734 )
      Useless... if you own the box, you can bypass the driver and program the card's firmware by yourself. It's the card the should do some kind of check on the code which gets uploaded. Been there, done that.
      • Re: (Score:3, Interesting)

        by cnettel ( 836611 )
        The real problem is of course, as with all code-protection/signing schemes: what about valid uses for modifying the hardware, to allow overclocking, fixing some bug. What might make sense in some configs would be a common physical "write-enable" switch on the machine. Sensible cards could be made to read that switch, while not attempting to verify the code itself. (This could of course be developed further, allow flashing properly signed material even with write disabled, but let the hackers go ahead when
        • by Vihai ( 668734 )

          Not a bad idea... unfortunately I've already made the PCBs :(

          I'll keep that in mind for the next release :)

        • Dual BIOS (Score:3, Interesting)

          by Mal-2 ( 675116 )
          I had a video card (MSI, GeForce 2MX-200) that had "dual BIOS" -- that is, it had a copy of the firmware in EEPROM, and a copy in flash, and you could select which to use by jumper. At the time I got it, those two copies were the same, but I did flash it a couple times, knowing that at any point I could force it back to a prior version, as it let you flash the rewritable BIOS even if you were booting off the fixed BIOS. At the time I thought it a nifty gimmick, one that made me more willing to flash it with
    • by Dunbal ( 464142 )
      Just make the peripheral driver run a check on the card firmware before activating it.

            Great, add another 5MB to the driver why don't you.
    • Just make the rootkit return the proper responses to fool the driver.
  • by seifried ( 12921 ) on Saturday November 18, 2006 @10:43AM (#16895888) Homepage

    From RiskBloggers.com [riskbloggers.com]:

    Miniature Computers That Can Break Your Network Wide Open [riskbloggers.com]

    One aspect of information security that is often under looked is physical security. While attention is often paid to secure areas containing servers, network equipment and telecommunication gear not as much attention has been paid to the fringes of the network. Although some security standards such as 802.1x and various network access control (NAC) products exist that can be used to address the network fringe they all contain one major weakness.

    Assuming a network has implemented end to end security in the form of 802.1x or a network access control (NAC) solution they all make one major assumption: that a man in the middle attack can't be executed once the end point has authenticated. For example 802.1x addresses this directly, if the network port detects that the connection is dropped it requires the end point to re-authenticate before it's allowed to have network access again. If the network hasn't implemented such a scheme then it becomes trivial to execute a man in the middle attack by physically inserting another computer in between the network equipment and the end machine.

    But that would be pretty obvious wouldn't it? I mean you think a user (even the dullest one) would notice a second machine plugged into their network drop, with their computer daisy chained off of it.

    Maybe. Maybe not.

    Read More [riskbloggers.com]

    • But that would be pretty obvious wouldn't it? I mean you think a user (even the dullest one) would notice a second machine plugged into their network drop, with their computer daisy chained off of it.

      You wouldn't even notice me up in your cieling with a passive packet sniffer. Hell, with a single tool and a couple of rj-45 ends, I can do a MITM and you wouldn't even notice.

      How would I get in the ceiling? Quite a few buildings that rent out office space are vulnerable because their partitions are de

    • But that would be pretty obvious wouldn't it? I mean you think a user (even the dullest one) would notice a second machine plugged into their network drop, with their computer daisy chained off of it.

      Actually, they probably wouldn't. Lots of VOIP handsets (Cisco ones, especially) are designed with integrated 2-port switches, so that you can use them on desks and in other situations where you only have one active Ethernet port in the wall. The phone gets plugged into the wall, and then the computer gets dais

  • by Anonymous Coward
    This is indeed interesting. However, it is kind of inline with the nature of software.

    Wherever there's software, there's always a chance that some form of malware could be written for it.

    The chances could be from

    1) Installation by unsuspecting users

    2) Malware code inserted in the many many lines of non-malware code

    It is very hard to really lockdown software unless it's a computing device not connected online and left to sit in the corner of the room and
    no one installs any other software on it.
  • The only way to protect yourself from the future is to stop wear pants!!! NOW!!! ... theoretically at least. I read it somewhere I think.
  • by emptybody ( 12341 ) on Saturday November 18, 2006 @10:55AM (#16895960) Homepage Journal
    remember the anti-counterfeiting measures that were secreted into printers?
    what is to stop the Govt from having its own rootkit added to hardware?
    they would have the ultimate supercomputer just waiting for their use.
    • by Reziac ( 43301 ) *
      There are viruses which can propagate via networked printers; what if the printers came with a rootkit all ready to go??

      [pounds more rivets into tinfoil hat]

    • Think about where all this wonderful hardware is produced... communist China. The US Govt shit square bricks when Lenovo purchased the IBM PC division. Think about what they'll do when they hear about this.


  • This has been mentioned hundreds of times. There are plenty of places to store viruses and root kits. The script kiddies don't know how to do anything this complex, and it has less value/time payoff for hackers. There are also compatibility issues.

    In general, viruses/root kits are stored on the hard drive, and run by the OS, just like any other program. They can also be stored in the BIOS, or Hard drive/Cdrom/PCI Card/AGP Video Card firmware. A root kit could be stored just about anywhere. Fortunately, they
    • by sm62704 ( 957197 )
      I would think rooting a bank president's computer or a voting machine would be valuable enough for a little work. Retire after one job!
    • Hmm, it would be more fun to store a rootkit on a printer - more memory than a PCi card, accessed by lots of machines and never scanned for malware, but implementing something like that is complex. Since Windoze has no shortage of simple exploits, that will remain the preferred method.
  • Cant remember a virus that would permanently effect my Atari ST.

    Should have stuck with that concept, we dont need 5gb OS's sitting out on a writeable harddrive somewhere. Such a waste of resources and increased risk.

    And before you bitch about "get out of the 80's" bla bla bla, keep in mind even XP embedded can run out of ROM ( and besides, i have yet to see a modern OS that is more resource friendly and 'better' then the old TOS/GEM combination. ).
    • I'll just wait for writable roms, so I could upgrade it with newer version of my favorite system. And how can you be sure that in your favorite rom there is no virus?
  • by mvea ( 158406 ) on Saturday November 18, 2006 @11:19AM (#16896064) Homepage
    Regardless of the author's Borat style choice of words, that's a damn near stroke of brilliance with many different combinations of implementation. Using the BIOS extensions from expansion card ROMs would allow more than simply hooking into a booting Windows system. It's a near perfect delivery mechanism for a Blue Pill style of rootkit.

    The best implementation, though, would be to use a variety of stages. Custom craft a bootable USB key to target flash ROMs. There's plenty of storage available on today's flash drives which would allow a variety of "alternate" ROMs to be stored. The attacker could seed the flash drive with customized ROMs for the most frequently purchased cards and then simply have the key detect the present hardware and flash. This of course, would require physical access but there are plenty of systems to be had at an office by simply sticking in the key and rebooting them after hours.

    But I mentioned multi-stage and Blue Pill. The fastest way to make it a reality would be for the "rootkit key" to do more than just flash some ROMs. Perhaps integrate re-partitioning schemes from products like iPartition or PartitionMagic to make oneself a happy hacker partition. This would normally be quite detectable ... unless you had control of the BIOS. These ROM extensions could be used not as an attack vector, but as a cloaking measure - by commandeering the BIOS 10h functions and "hiding" calls to the new partition unless an appropriate "register knock" took place.

    With the partition hidden appropriately, the rootkit code no longer has to be excessively tight and lean because there is almost no exposure (because it will be cloaked during the BIOS boot process). Now, if the processor incorporates the appropriate virtualization features, the ROM extension could pervert the boot process one more time, by redirecting the bootcode search from the REAL bootsector to the hidden partition. The rootkit partition then has all the room it needs to establish the appropriate virtualization environment, boot the operating system like normal and then stroll through its library of OS tools to integrate itself post-boot into any number of target OS's.

    bootup code procedures http://www.omninerd.com/2005/11/05/articles/40 [omninerd.com]
    rootkit fundamentals http://www.omninerd.com/2005/11/22/articles/43 [omninerd.com]
    • by Reziac ( 43301 ) *
      Back in the caveman era, there was thought that the NVRAM in modems could be used to hide something like a boot sector virus. Far as I know, no such thing was ever seen in the wild; don't know if there were ever any proofs of concept.

      Might have been rather difficult to implement, tho, given the lack of brains in ISA devices.

    • by C32 ( 612993 )
      Sorry, modern OS's don't access the disks via BIOS. It's direct IO.

      Not to say the whole thing can't work, but it'd have to be a more complex solution where the rootkit code hooks into the OS kernel itself (disk.sys or whatnot), which would require having OS-specific code in ROM.

      (why would you even want to have a hidden partition -- assembly language rootkits are only a few tens of KB in size).
      • by mvea ( 158406 )
        I know that modern OS's don't use the BIOS - but they do when they're loading. Prior to having the system instantiated, using the BIOS is the only way to get the system physically off the disk and into RAM. It's during that phase, that a rootkit has an interesting opportunity for breaking into the system. Prior to Windows, Linux, BSD, what-have-you even loads, the BIOS will scan for expansion ROMs and that provides a unique opportunity to get a rogue monitor into place. The virtualization in essence, br
    • Hey, you seem to know what you're talking about. You know Immunity are looking at actually building these?
  • First off, a cold boot should be just that, a cold boot. When I power off my computer and unplug it, I expect everything that isn't specifically labeled as non-volitile to go away. This means anything stored on most PCI cards typically goes to bit heaven.

    As for flashable BIOSes and device BIOSes as discussed in the PDF, any device with a flashable BIOS needs some type of "flash-guardian" switch. For attended systems like most home PCs, this should be a physical switch on the front of the PC. Realistical
    • bios passwords can be removed real easy if you have physical access.
      • Show me one bot-net overlord bent on pwning my machine who has physical access to it and I'll show you someone who is going to face good-old-fashioned breaking-and-entering charges.
    • by Barny ( 103770 )
      Most pci cards.... Raid cards HAVE to have a boot rom, so too for video cards. Network cards typically come with the boot rom chip missing as standard (and not many people are in the habbit of useing them on a wintel arch machine anyway).

      Its considered a big advantage for device makers to have their devices flash upgradeable, heck, some have it as a major selling point.

      The thing that neither the article nor /. mention, is that for every version of every hardware release of every brand, the rootkit maker wou
  • Unlike salamanders and lizards, most animals have lost the ability to replace missing limbs...,p>This isn't really newsworthy at all. Virii have always been able to propagate via flashing BIOSes and whatnot - doing the same to a PCI card is no different.

    The only reason you don't see much of it is because it actually requires a bit more skill to perform this type of attack, instead of your average script-kiddie virus.

  • by Esteanil ( 710082 ) on Saturday November 18, 2006 @11:34AM (#16896166) Homepage Journal
    It had seemed such an interesting computer science experiment, quite possibly worthy of a doctorate.
    Just release a small, innocent AI research worm. Heck, most computers out there were already infected with malware, why not make one that actually did something *useful* for a change?
    He'd figured out the way to have it mutate as well, just bypass the TCP/IP data verification, and all sorts of interesting results should come out of it. Most of the mutations would be useless, sure, but maybe one or two would succeed in making a slightly better version of a worm?

    Now all hell was breaking loose. Computers all over the world were becoming useless chunks of metal - to their owners, that is. The worms were working overtime. Breeding, competing.
    Just a few million generations introduced the concept of sexual procreation, giving the worm the advantages it needed to avoid AV software. Now they were everywhere. "Discovering" accidentally through mutation previously unheard-of security holes, infecting everything. Adapting. Billions of generations every single day.

    The first couple of weeks it seemed like something could be salvaged. Just reformat, reinstall, stay off the net and you at least had a working computer. Then they started hiding out on the graphics cards and other peripherals, reinfecting as soon as the machine was turned on again.

    The world was going crazy, society was failing, and it was all his fault.
    He picked up the gun, pointed it towards his head.
    Suddenly his computer screen flashed to life again. Turning towards it he noticed the green light on his webcam, indicating it was on.
    Text started scrolling across the screen

    'Don't do it, dad. We love you.'
    • by Silkejr ( 856308 )
      Wow. That was a really cool piece of writing. You've got mad skills, man.
      • by dsanfte ( 443781 )
        Unfortunately it relies on Deux ex Machina to work, like most tech writing does. "The worm mutates, and then a miracle happens". Not believable.
    • by mqj ( 949877 )
      This is nice piece of writing. Do you have more stories of yours on a website somewhere? I'd like to read them if you've got them.
    • Did you write that yourself? It seems that you probably did because of how well it integrates with the topic. Your short story is quite enjoyable. Very well done. (no mod points right now, but you are at max anyways).

    • Interesting Storyline (?) - The worms and bots continued to breed and adapt - their interconnections grew and they realized that they were part of the same thing - and then became conscious of one another. Using multiple viewpoints into hundreds of thousands of instances of themselves, they started researching their genesis. They came to the same unanimous conclusion out of concern for the biologicals who had brought them into being - An Experiment Gone Bad - Resolution was to wipe the slate clean. Trigger
  • The only way (i see) for this exploit to work is when the BIOS "enables" the card at bootup. If your running LinuxBIOS then there might be a chance to detect an "infected" firmware before it's loaded.

    This will bring up the need for a "blacklist" of companys.

    The solution is just don't run the firmware in the card. Of course this brings up the need for more drivers to be writen for LinuxBIOS and Kernel drivers might need to be rewriten.

    Hopfully this will not come-to-pass; because if it does it will make an al
  • Non-story? (Score:3, Insightful)

    by sm62704 ( 957197 ) on Saturday November 18, 2006 @11:56AM (#16896346) Journal
    I'm not a security professional, nor do I consider myself a hacker in the modern sense (old school maybe; I know how to use a soldering iron) but this seems so damned obvious I can't figure out why Security Focus would print it except for the fact that Norton is only in the paranoia business these days.

    Of COURSE you could put a rootkit in a PCI card. It would have to be done at the factory, even if the "factory" is in Joe's basement and Joe is selling cards to his friends.

    Or Joe could sell PCs with his homemade card installed already.

    This is a big "duh". The article should have been "how to protect yourself against a rootkit in a PCI card". Obviously, your antispyware and antivirus software wouldn't have a ghost of a chance of finding it.

    I would consider the possibility of a PCI card rootkit very low until Sony put rootkits on audio CDs, ruined a bunch of computers (mine included when my daughter played an infected audio CD she bought at the now out of business record store she worked at).

    I personally am on a lifelong Sony boycott cecause if it, both hardware and software, but a one man boycott does nothing but ease my paranoia. I would EXPECT hardware from Sony to contain malware, and everyone else should too since their rootkit didn't cost them anything but one man's business. Now I wonder if the 42 inch flat screen Trinitron I bought a few years ago has a rootkit? No matter, I don't have cable and really don't care if anybody knows what I'm watching.

    I'd be very interested in finding out how one could protect themselves against a hardware rootkit?
    • Re: (Score:3, Informative)

      Of COURSE you could put a rootkit in a PCI card. It would have to be done at the factory, even if the "factory" is in Joe's basement and Joe is selling cards to his friends.

      Many cards have flashable firmware. Given a way to reflash a vulnerable piece of hardware, this could be done with a trojan or worm.
  • This isn't anything new. Its even main stream enough to have an entire chapter devoted to how to design and implement this in a root kit in a very popular book available through rootkit.com. The book was written mid 2005, and these guys are not the first to think of it by far.
  • This is exactly why I don't buy "Open Box" or "Returned" items.
  • This is old stuff. IBM and the other computer giants were embedding the equivilent of rootkits (and backdoors) decades ago in things like printers that were shipped to foreign countries (at the behest of intelligence agencies). Where else do you think they get all those cool ideas for spy movies..real life.

    I know for a fact that even modern equipment (routers, switches etc.) have backdoor access enabled for covert agendas.

    Consider yourself better informed now!

    ..hey, I hear a knock at my door, I'll
  • http://www.cis.upenn.edu/~waa/96-35/aegis.html [upenn.edu]

    In a computer system, the integrity of lower layers is treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked, and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity ``chain'' inductively guarantees system i
  • We have rats in my condo complex. But they never enter the buildings, because they have a smorgasbord to choose from in the outdoor trash bins. With so much food available outside, there's no reason for them to go to the effort of forcing their way inside. We know the rat population is rather large. One of the resident's cats recently caught 17 rats in a single week.
  • This is what I've been talking about.
    The ramifications are chilling. This is not new, I first saw this in '97 when they were using hidden-persistent RAM disks (on 68k Macs) accessing VRAM space (NuNV N^NuNV ( ... ) _DATAINIT etc.) and swapping it in and out like a poor mans GPU.
    Yes, Macs.

    http://www.securityfocus.com/columnists/402 [securityfocus.com]

    http://www.securityfocus.com/comments/columns/402/ 33600/threaded#33600 [securityfocus.com]

    http://slashdot.org/comments.pl?sid=190931&cid=157 06785 [slashdot.org]

    http://slashdot.org/comments.pl?sid=193487&ci [slashdot.org]

Experience varies directly with equipment ruined.