3 ms·
The IPMI module can do DMA. It would be trivial to shim into the running kernel and talk to any interface the host has.
by dsl 8y ago
The IPMI module can do DMA. It would be trivial to shim into the running kernel and talk to any interface the host has.
- angry_octet 8y agoBut that means the implant has to be active on every server, actively patching the kernel (and how long would that patch work with kernel changes). It would cause bugs, and be likely to be discovered. Maybe an option on a specific machine that you knew was being used by the target.