Security Market Segment LS
Friday, 07 August 2015 15:04

And not even Wintel is safe

By

At the annual Black Hat conference delegates have been shown a new exploit for Intel and AMD x86 central processor units that has hitherto existed since 1977!

Shock horror - attackers could use this to install a rootkit in the low-level firmware that could be undetectable by security products. Well, if it 5% of the Worlds Windows/Intel computers are taken out! it until now then thank goodness we caught it in time and can do somethhas been around since 1977 and no one has found it until now then thank goodness we caught it in time and can do something about it before 95% of the Worlds Windows/Intel (and AMD) computers are taken out!

Christopher Domas, a security researcher with the Battelle Memorial Institute, discovered the flaw. “By leveraging the flaw, attackers could install a rootkit in the processors System Management Mode (SMM), a protected region of code that underpins all the firmware security features in modern computers. Once installed, the rootkit could be used for destructive attacks like wiping the UEFI (Unified Extensible Firmware Interface) the modern BIOS or even to re-infect the OS after a clean install. Protection features like Secure Boot wouldn’t help, because they too rely on the SMM to be secure. The attack essentially breaks the hardware roots of trust,” Domas said.

Domas says Intel is now aware of the issue and has mitigated it in its latest CPUs. It is also rolling out firmware updates for older processors, but not all of them can be patched. In fact patching a billion or so PCs that use Intel/AMD CPU’s will never happen.

To exploit the vulnerability and install the rootkit, attackers would need to already have kernel or system privileges on a computer. That means the flaw can’t be used by itself to compromise a system, but could make an existing malware infection highly persistent and completely invisible.

Opinion

The Black Hat Conference is a cornucopia of bad things that could be exploited by bad people. Fortunately this vulnerability is one that requires more than remote access to a PC. However, you can be sure that malware writers will be working on implementing this.

WEBINAR event: IT Alerting Best Practices 27 MAY 2PM AEST

LogicMonitor, the cloud-based IT infrastructure monitoring and intelligence platform, is hosting an online event at 2PM on May 27th aimed at educating IT administrators, managers and leaders about IT and network alerts.

This free webinar will share best practices for setting network alerts, negating alert fatigue, optimising an alerting strategy and proactive monitoring.

The event will start at 2pm AEST. Topics will include:

- Setting alert routing and thresholds

- Avoiding alert and email overload

- Learning from missed alerts

- Managing downtime effectively

The webinar will run for approximately one hour. Recordings will be made available to anyone who registers but cannot make the live event.

REGISTER HERE!

LAYER 1 ENCRYPTION A KEY TO CYBER-SECURITY SOLUTION

Security requirements such as confidentiality, integrity and authentication have become mandatory in most industries.

Data encryption methods previously used only by military and intelligence services have become common practice in all data transfer networks across all platforms, in all industries where information is sensitive and vital (financial and government institutions, critical infrastructure, data centres, and service providers).

Get the full details on Layer-1 encryption solutions straight from PacketLight’s optical networks experts.

This white paper titled, “When 1% of the Light Equals 100% of the Information” is a must read for anyone within the fiber optics, cybersecurity or related industry sectors.

To access click Download here.

DOWNLOAD!

Ray Shaw

joomla stats

Ray Shaw ray@im.com.au  has a passion for IT ever since building his first computer in 1980. He is a qualified journalist, hosted a consumer IT based radio program on ABC radio for 10 years, has developed world leading software for the events industry and is smart enough to no longer own a retail computer store!

VENDOR NEWS & WEBINARS

REVIEWS

Recent Comments