[ISN] Network card rootkit offers extra stealth

From: InfoSec News <alerts_at_private>
Date: Wed, 24 Nov 2010 04:15:08 -0600 (CST)

By John Leyden
The Register
23rd November 2010

Security researchers have demonstrated how it might be possible to place 
backdoor rootkit software on a network card.

Guillaume Delugre, a reverse engineer at French security firm Sogeti 
ESEC, was able to develop proof-of-concept code after studying the 
firmware from Broadcom Ethernet NetExtreme PCI Ethernet cards.

He used publicly available documentations and open source tools to 
develop a firmware debugger. He also reverse-engineered the format of 
the EEPROM where firmware code is stored, as well as the bootstrap 
process of the device.

Using the knowledge gained from this process, Delugré was able to 
develop custom firmware code and flash the device so that his 
proof-of-concept code ran on the CPU of the network card. The technique 
opens the possibility of planting a stealthy rootkit that lives within 
the network card, an approach that gives potential miscreants several 
advantages over conventional backdoors.


Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery 
Network, Cisco Switches, SAS 70 Type II Datacenter. 
Find peace of mind, Defend your Critical Infrastructure.
Received on Wed Nov 24 2010 - 02:15:08 PST

This archive was generated by hypermail 2.2.0 : Wed Nov 24 2010 - 02:24:48 PST