Black Hat USA 2008

published by clearhatconsulting on Mon, 09/01/2008 - 10:09

Deeper Door - Exploiting the NIC Chipset

Sherri Sparks and Shawn Embleton co-presented this Black Hat USA 2008 presentation. Following is the briefing abstract:

The session addressed a couple of significant problems in existing IDS / Firewall technology and presented a proof-of-concept "chipset" level rootkit / network backdoor that is capable of bypassing virtually all host based firewall and intrusion detection software on the market. These include popular, widely deployed software like Snort and Zone Alarm Security Suite. Our backdoor operates at an even deeper level than previous backdoors (e.g., Joanna's "DeepDoor" rootkit) because it interacts directly with the chipset interface of the NIC hardware. Capabilities include the ability to both covertly send AND recieve packets. We use both of these capabilities to implement a simple command and control interface. Implications for security vendors include the exfiltration of sensitive information and delayed detection of malware threats like DDOS attacks, Botnes, and Worms.

For further information, please see:
presentation video