Security researchers Joanna Rutkowska and Loic Duflot are planning to release information on what NetworkWorld blogger Jamey Heary calls "the scariest, stealthiest, and most dangerous rootkit" he's seen.
According to Heary, on Thursday (March 19, 2009) the researchers will release a research paper and exploit code for a new SMM (System Management Mode) rootkit that utilizes an Intel CPU caching vulnerability. The attack allows the rootkit to hide in the SMM space and take control of the PC. Heary warns that there is no software that can detect the rootkit once it is installed.
"Thursday, March 19th, 1600 UTC, we will publish a paper (+ exploits) on exploiting Intel® CPU cache mechanisms. The attack allows for privilege escalation from Ring 0 to the SMM on many recent motherboards with Intel CPUs. Rafal implemented a working exploit with code execution in SMM in a matter of just a few hours."
Why are they releasing the code to the public? Rutkowska and Duflot claim that Intel has known about the vulnerability for years and hasn't done anything to fix it. So, they are simply reporting what someone with less than legal intentions is already exploiting.
"If there is a bug somewhere and if it stays unpatched for enough time, it is almost guaranteed that various people will (re)discover and exploit it, sooner or later. So, don't blame researchers that they find and publish information about bugs — they actually do a favor to our society."
(ITBE)
. And this is how we learnt that Loic came up with the same attack (back then there was no talk description at the conference website) — apparently he approached Intel about this back in October 2008, so 3-4 months before us — and also that he's planning to present it at the CanSecWest conference in March. So, we contacted Loic and agreed to do coordinated disclosure next Thursday.
HEHEHE
Total Members: 14197
