"scariest, stealthiest, and most dangerous exploit"

[geoffry]

Kinda spooky, what do ya'll think about this?

http://www.networkworld.com/community/node/39825?t51hb

 

[DrMrLordX]

That sounds . . . bad. But I know so little about SMM that it's difficult to tell exactly how this would be exploited. If the OS can't read or control SMM (as per the article), how would any software running on top of the OS (i.e. a trojan or what have you) achieve a working SMM hack?

I guess we'll find out more once details on the hack are released, or if they are released.

 

[geoffry]

Ya, I have no idea what that stuff does either.

And the writer could probably get more hits to their site by using words such as the phrase I quoted and because people don't know any better it creates a buzz.

Thats why I brought it here, theres a few ATers who know their stuff quite well and can I can get a second or third opinion.

 

[nyker96]

can't hit the link my http filter is blocking this site.

 

[Cogman]

-10 because the author used the word "powned" (and he used it more then once, that should be like -20 or something, but I am feeling generous)

Here's pretty much what it boils down to. The attack makes the code invisible to the OS because the CPU is executing the code directly and not talking to the OS. This translates into the code being invisible to the OS.

So how dangerous is it? It is about as dangerous as any other virus sent through email. If you don't run the program, you won't get the virus. If you turn off the computer, the virus will have to be booted up by the OS somewhere. So basically all it has achieved is not appearing in task manager when you hit Ctrl-Alt-Del, And virus scanners wont be able to see it/stop it while it is active (though it will still be able to see the virus file). This isn't the kind of virus that you get just by connecting your computer to the internet. You still have to somehow download and execute the virus.

You know there is FUD when the opening line says this isn't FUD. This virus is just about as dangerous as a virus that you can see in task manager. If you practice good security while using your computer, the effects of this virus shouldn't be a concern to you.

My thoughts are something like this: "Oh no, a virus that I can't see when it is running! That's almost as bad as a virus I can see while my computer is running, but instead it overwrites the boot sector of all my hard-drives"

 

[palladium]

Hmm, post this in the security forum and see what the experts there think.

 

[JeffreyLebowski]

Originally posted by: Cogman
-10 because the author used the word "powned" (and he used it more then once, that should be like -20 or something, but I am feeling generous)

Here's pretty much what it boils down to. The attack makes the code invisible to the OS because the CPU is executing the code directly and not talking to the OS. This translates into the code being invisible to the OS.

So how dangerous is it? It is about as dangerous as any other virus sent through email. If you don't run the program, you won't get the virus. If you turn off the computer, the virus will have to be booted up by the OS somewhere. So basically all it has achieved is not appearing in task manager when you hit Ctrl-Alt-Del, And virus scanners wont be able to see it/stop it while it is active (though it will still be able to see the virus file). This isn't the kind of virus that you get just by connecting your computer to the internet. You still have to somehow download and execute the virus.

You know there is FUD when the opening line says this isn't FUD. This virus is just about as dangerous as a virus that you can see in task manager. If you practice good security while using your computer, the effects of this virus shouldn't be a concern to you.

My thoughts are something like this: "Oh no, a virus that I can't see when it is running! That's almost as bad as a virus I can see while my computer is running, but instead it overwrites the boot sector of all my hard-drives"

Right, the code/virus/hack will have to get on the computer somehow and will have to go through the OS to get to the CPU

 

[aigomorla]

this kind of stuff totally reminds me a quote apple once did.

It takes mostly kid hackers in jhs, hs, and college to hack into any windows PC.

But it will take millions of dollars in sponsorship and funding to hack a mac.

:rofl:

 

[Cogman]

Originally posted by: aigomorla
this kind of stuff totally reminds me a quote apple once did.

It takes mostly kid hackers in jhs, hs, and college to hack into any windows PC.

But it will take millions of dollars in sponsorship and funding to hack a mac.

:rofl:

You forgot to mention 10 mins.

I don't know if you realize this, but this ISN'T a windows vulnerability. This is an intel vulnerability. And guess which OS also uses primarily Intel processors, yeah, that's right, the mac.

Saying windows/Mac are more secure/insecure is retarded. Yes there are more exploits for windows, but there is also a HUGE number of people using it. If the tables where switched I could guarantee the exact same things would be said about macs.

 

[plonk420]

for some (possibly/slightly) educated insight on the issue, check out http://it.slashdot.org/article.pl?sid=09/03/19/179228

 

[i7guy1]

Additional information: Note the article says data can't be transferred between protected memory and user memory. :shrug:

http://www.rcollins.org/ddj/Jan97/Jan97.html