Oh, what a pill!
Russ CooperMarch 19th, 2009
So rumors abound that a paper and exploit code will be published today that use a vulnerability in a processor’s caching mechanism to install code that is being called “undetectable.”
If it appears that we’re obviously not stating names and vendors, you’re right, we aren’t. At the time of writing all we’ve seen is speculation.
But let’s just take one aspect of the current hoopla: “Can something be installed on your computer and become undetectable?”
Quite simply, no. At least not if it expects to do anything that would gain the criminal something. What use is it to control your computer…but not have it do anything?? The criminal wants information off your system, or to have your system do something on their behalf be it host crimeware, send spam or participate in a DoS.
Any or all of those actions would be detectable. True, you might not be able to identify the binary after its installed itself, but for it to get there in the first place it is likely to do something like any other piece of crimeware…and in that process be detectable.
So let’s not go diving off the deep-end and consigning all PC’s to the whims of criminals exploiting Virtualization System Management Mode. As long as we’re not thinking in terms of a single layer of security, we’re bound to identify criminal activity on any system that might be compromised.
Tags: Computer Attacks, Hype, Information Security, InfoSec, risk, Threat
As with “bluepill” before it, discoveries of vulnerabilities or even creation of proof of concept code does not equate to risk for enterprises and users. Unless and until criminals begin using these issues for successful attacks, these vulnerabilites should continue to be filed with all the tens of thousands of others that have never been used. If the are not, have not and will not be used, there’s no reason to spend time or money defending them.
Posted by: Dave Kennedy on March 22nd, 2009 at 1:26 am