ITL announces the new attack against a major flaw affecting all newer Intel chipsets

The attack allows for privilege escalation from Ring 0 to the SMM on many recent motherboards with Intel CPUs. This particular exploit can hide itself in the SMM space when tied with a rootkit. While we are all concerned about a probable hypervisor exploit, the SMM attacks work at an even deeper hardware level of abstraction, as SMM is more privileged than a hypervisor. The Operating System cannot disable or ignore SMI calls. To disable SMM one has to disassemble the the firmware physically. Since SMI takes precedence over any OS call, an SMM rootkit is extremely stealthy. Rafal Wojtczuk released the paper explaining the exploit and the code. Now somebody has to integrate it with a hypervisor rootkit like Blue Pill or GMER. 

The paper and the code can be found at:

http://sanjaysays.com/__oneclick_uploads/2009/03/smm_cache_fun1.pdf

This entry was posted on 19. March 2009 at 21:39 and is filed under Technology. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response or trackback from your own site.

| Print