Firmware could be new frontier in hiding malicious code
Connecting state and local government leaders
John Heasman, a principal security consultant, spends his time looking for new and better ways to hide rootkits.
John Heasman, a principal security consultant for NGS Software Ltd. of the U.K., spends his time looking for new and better ways to hide rootkits. He told an audience Wednesday at the Black Hat Federal Briefings in Arlington, Va., that firmware in your computer could be a fertile field for this type of code.
'Operating system security, application security, software security in general is getting better,' Heasman said. But that software is running on increasingly complex hardware with multiple processing and storage devices built into it. 'Unless we address hardware security, we're leaving an interesting avenue of attack open.'
A rootkit is code installed and running on a computer that typically burrows deep enough into the operating system kernel that it is not easily detected. If installed surreptitiously, it can be used to hide malicious activity by a third party.
Heasman's presentation was a follow-up to a presentation at last year's conference on a proof-of-concept for hiding a rootkit in the Basic Input-Output System on a computer. This is code on the motherboard that runs when a computer is powered up. Because it runs beneath the operating system, a rootkit operating there could survive reboots, reinstallation of the operating system or even replacement of the hard drive.
His technique involved using the Advanced Configuration and Power Interface to copy malicious code from the BIOS to the operating system. Although the technique worked, installing it probably would require physical access to the target computer and it could not be easily spread. If the computer would not allow unsigned updates of the BIOS, the trick would not work.
Because of those limitations, 'I set out to come up with a means of persisting a rootkit elsewhere in the system,' Heasman said. Current rootkit detection tools look only at a computer's disk, 'but many devices on the PC have firmware' that can be flash upgraded. 'The PCI Bus was an obvious target.'
The PCI Bus is used for attaching peripheral devices such as graphics and sound cards to a motherboard. The PCI Expansion ROM holds initialization code for the bus that is queried by the operating system and executed when the system boots up. The Expansion ROM often can be flash upgraded without removing the chip, providing an avenue for inserting rootkit code below the operating system.
'That's relatively complex to get up and running,' Heasman said of his trick. But it worked, and he was also able to use Intel's Preboot Execution Environment, a tool often used to image machines and for network diagnostics, to update the rootkit and give it further instructions. Data could also be sent out by the rootkit using this path.
'This is going to be quite easy to detect, although it could be made harder,' Heasman said of the update path.
Once again, this new rootkit environment is not particularly practical for hackers. Installing malicious code on the Expansion ROM is no easy task. On the other hand, malicious code would not be easy to spot, because there are no databases of good firmware initialization code to compare it with, and no signatures for the malicious code.
'Prevention is going to be pretty hard without TCP,' Heasman said.
The Trusted Computing Platform uses a microcontroller for a secure start-up process by providing a hash of system boot events so that changes can be identified. Unfortunately, the modules, although available from most PC manufacturers, are not widely used.
But Heasman does not expect to see malware being developed to exploit this technique. Although possible to do, it is a targeted one-off attack that would not provide much of a return on investment to a hacker community focused on compromising huge numbers of computers for financial gain.
'Currently, this is not worth doing,' he said. There are too many machines on the world's networks that can be compromised much more easily.