Printable View
Yep, the mighty Dell have shipped virus infected replacement server motherboards............must be something wrong with their HR and/or IT security processes?
http://www.securitynewsportal.com/cg...20with%20Virus
"Human error"..............is that the new euphemism for "they will never find the body"???? :lildevil:
Wow. That's more than egg on their faces. It's a whole chicken coop.
As if news of defective components on the boards wasn't bad enough... now this? Let's blame China. Seems about par for the course. Oh also, don't lick the cases... lead paint. :D
I do!, I do!Quote:
Let's blame China.
Seriously though, I wonder how many vendors of badged Chinese kit actually let them load the firmware? The answer should be "zero", but I wonder?
:(
i don't get it??
how could a win32 program(normally written in a high level language like c vb c#) that depend on other system library's to do it's job.
runs on a low level bios ???
Hi mostafaxx, and welcome to AO :)
I am afraid I don't have any details but can make the following suggestions:Quote:
how could a win32 program(normally written in a high level language like c vb c#) that depend on other system library's to do it's job.
runs on a low level bios ???
A number of devices in your computer have memory capabilities to store the firmware that runs them. Motherboard, CD, DVD, Video Card etc.........these can usually be "flashed"
All you need to do is add your malware to the firmware and it will run as soon as the device is activated.
Like yourself, I doubt if the malware is written in a high level language such as you mention. It is most likely to be Assembly (ASM) language, microcode or whatever, that then "phones home" to get the full version of the malware and its payload.
I still have a few 5.25" 360Kb floppies with viruses in their boot sectors.
You can write some pretty nasty stuff in Assembler ;)
MSDos 5!Quote:
Originally Posted by nihil
Steve
Only drivers can run at ring0 if thats what your getting at. The actual executables are irrelivant and serve no other purpose beyond calling and interfacing with the driver.Quote:
Originally Posted by mostafaxx
nop drivers and root-kit do...Quote:
Only drivers can run at ring0 if thats what your getting at.
i think your right nihil
i have seen couple of cmos password recovery tools
even my motherboard have a tool to flash/update the bios
Well, it all depends on how many rings you have?
Firmware generally runs at the Kernel or HAL. Drivers work in more remote rings (1 & 2) and applications beyond that (3) Obviously, some systems only have two rings, and are pretty monolithic.Quote:
In computer terms supervisor mode is a hardware-mediated flag which can be changed by code running in system-level software. System-level tasks or threads will have this flag set while they are running, whereas user-space applications will not. This flag determines whether it would be possible to execute machine code operations such as modifying registers for various descriptor tables, or performing operations such as disabling interrupts
If you infect the firmware you can make the problem travel outwards. The concept isn't really what runs where, it is more one of where do I hide my malware and get it to execute?
At the kernel level all you can really do is crash the system. You need to be in the user/applications layer to cause mahem. That is where you have your higher level language malware.
EDIT:
Here is an article on System Management Mode attacks
http://www.securityfocus.com/columnists/402