John Heasman, principal security consultant for UK based Next-Generation Security Software has demonstrated at the Black Hat Federal conference in Amsterdam recently how rootkit’s are headed for the BIOS.In a number of demonstrations Heasman showed how to elevate privileges and read physical memory, using malicious procedures that replaced normal functions stored in flash memory.
Researchers at the conference are divided as to how this sort of rootkit will progress. While there may well be rootkit’s written in the near future using flash memory their effectiveness may be reduced by the fact that many motherboards have flash memory protected. When the rootkit attempts to write to the flash memory it is stopped in its tracks.
While the effectiveness of BIOS rootkit’s seems small at the moment, one can imagine incidents of where motherboard flash memory is has the write protect removed or a rootkit installed in the manufacturing plant by a rogue employee. This sort of rootkit could also be installed by a trusted person at a large corporation who would have access to a turning off the flash memory write protect by switching jumpers on the motherboard.
John Heasman’s full demonstration Implementing and Detecting an ACPI BIOS Rootkit can be found here.
Keep Safe
regards
Steo
www.antirootkit.com