Network cards can be used to allow an attacker to run malicious code

MrBrian · Apr 11, 2010

http://blogs.paretologic.com/malwar...-the-french-pull-off-a-nice-proof-of-concept/

What these guys have proven is that you can take control of a machine by executing code on the network card.
Click to expand...

The interesting thing to me was the fact that currently no product would be able to detect such a compromise. In essence your machine could be properly configured and everything looks alright when in fact there is an ‘invisible’ rogue DNS server redirecting all your traffic, or simply monitoring your traffic. Buy whatever AV solution you want, it’s not going to fix or even detect the problem.
Click to expand...

Searching_ _ _ · Apr 11, 2010

An unauthenticated remote attack on a network card is almost the most efficient attack one can imagine. A remote attacker located anywhere on the network can take full control of the victim’s network in order to: intercept all packets sent to and from the victim’s machine and forwards them to an attacker on the network; perform man in the middle on all unauthenticated network connexion (such as ARP or DNS) to redirect traffic to target machines; remotely shutdown, reset or wake up the machine.
Click to expand...

http://www.ssi.gouv.fr/site_article185.html
Can You Trust The Network Card PDF

Awesome MrBrian.
Who needs horror movies like Zombieland when someone is rooting your hardware!

Also:

Hardware components (CPUs, chipsets, graphic adapters, NICs; USB and PCI devices) generally run embedded software (firmware). Flaws in low level firmwares could be exploited by attackers for “rootkit” concealment or privilege escalation purposes.
Click to expand...

http://www.ssi.gouv.fr/site_article185.html

In this paper, we study the weaknesses of this standard in terms of safety and show how an attacker can use ACPI tables for climbing privileges (in some specific contexts) can hide or functions within these tables, functions to be performed automatically by the operating system instead of the legitimate functions. Were also presented several possible countermeasures.
Click to expand...

ACPI, design principles and Concerns

The laboratory network architecture and has presented his work on the mechanisms of power management and configuration of x86. He has shown and demonstrated support, how the choices made several years ago for power management have a major impact on the safety of machines known trusted to implement such technology Intel TxT.
Click to expand...

ACPI and routine treatment of SMI: limits to the trusted computing?

wat0114 · Apr 11, 2010

http://www.ssi.gouv.fr/site_article185.html

Any computer using Broadcom NetXtreme chips with ASF activated and configured is vulnerable. Users of such computers should apply the official patches (see § 6). Other vendor cards and other cards models are not impacted by this vulnerability. Machines using Broadcom NetXtreme chips when ASF has never been configured (Requires to launch the Broadcom ASF configuration tool) are not vulnerable but patching is highly recommended.

Readers are also advised to follow CERT advisories, e.g CERTA-2010-AVI-121
Click to expand...

Dogbiscuit · Apr 11, 2010

It showed how an attacker can remotely shutdown or wake up his victim’s machine, and fully compromise a COTS operating system machine (Linux for the demo, but all operating systems are vulnerable).
Click to expand...

However, the attack presented only applies to a specific network card model (Broadcom NetXtreme) whenever a remote administration functionality (called ASF for Alert Standard Format 2.0) is turned on (it is off by default) and configured. According to vendors, this functionality is far from being widely used. As a consequence, this vulnerability is really likely to have a very limited impact in practice.
Click to expand...

This has never been shown before?

Log in or Sign up

Network cards can be used to allow an attacker to run malicious code

MrBrian Registered Member

Searching_ _ _ Registered Member

wat0114 Guest

Dogbiscuit Guest

Log in or Sign up

Network cards can be used to allow an attacker to run malicious code

MrBrian Registered Member

Searching_ _ _ Registered Member

wat0114 Guest

Dogbiscuit Guest

Useful Searches