Hardware Protection Ineffective Against Rootkits

by Navin Maini on 5 March 2007, 13:21

Quick Link: HEXUS.net/qah2h

Add to My Vault: x

Joanna Rutkowska, a rootkit specialist, announced at the Blackhat DC conference this year, that hardware protection is ineffective against more advanced forms of rootkits.

The report from The Inquirer, details the findings which Rutkowska presented during her presentation at the conference.

Regardless of the fact that hardware protection against rootkits has been touted as being more effective than software based solutions, three demonstrations by Rutkowska depicted attacks against a computer, where images of volatile RAM were manipulated so they differed from the actual physical RAM contents, as seen by the system processor.

Perhaps more concerning, were Rutkowska's findings that sophisticated rootkits could be dangerous to the extent that relying on images from memory would be not be feasible for forensic examiners.

One of the demonstrations conducted actually displayed how a rootkit could deliver invalid information to any potential examiners.

Ryan Naraine of ZDNET also reported, that one of the attacks demonstrated involved malware designed to provide garbage data to system hardware trying to access system memory.

According to her findings, Rutkowska believes that a fusion of software and hardware technologies are required to work with rootkits during forensic examination.

Also expressed was her belief that a more verifiable design from motherboard manufacturers would be of great benefit, whereas a special interface to allow direct access to, amongst other things, system RAM, would go some way to make computers safer against rootkits attacks.

HEXUS.links

HEXUS.community :: Voice your opinion.


HEXUS Forums :: 0 Comments

Login with Forum Account

Don't have an account? Register today!
Log in to be the first to comment!