Hiding a Rootkit In System Management Mode

[Steve]

Sniper223 notes a PC World article on a new kind of rootkit recently developed by researchers, which will be demoed at Black Hat in August. The rootkit runs in System Management Mode, a longtime feature of x86 architecture that allows for code to run in a locked part of memory. It is said to be harder to detect, potentially, than VM-based rootkits. The article notes that the technique is unlikely to lead to widespread expoitation: "Being divorced from the operating system makes the SMM rootkit stealthy, but it also means that hackers have to write this driver code expressly for the system they are attacking."http://slashdot.org/slashdot-it.pl?f.../05/11/2044216
Read more of this story at Slashdot.
http://rss.slashdot.org/~a/Slashdot/slashdot?i=UVcKAI


More...