By Kelly Jackson Higgins
Excerpt:
Anibal Sacco and Alfredo Ortega, both exploit writers for Core Security Technologies, were able to inject a rootkit into commercial BIOS firmware using their own Python-based tool that installed the rootkit via an update, or flash, process.
This more "persistent" rootkit is more dangerous than a regular rootkit because it could use the BIOS-located network stack to attack other machines, as well as "using normal exploits, without any access to the disk or memory in the operating system," the researchers said.
The concept of BIOS-based rootkits is nothing new in the research community. But Sacco and Ortega took it up a notch with a generic implementation that can work across various operating systems and ultimately give an attacker control of the infected machine. The researchers were able to successfully attack OpenBSD and Windows machines with the BIOS code injection attack.
Source: Dark Reading
