4 ms·

Amateur hour, quite a few rootkits out there are almost completely undetectable...

• lawnchair_larry 14y ago
  Really? Can you name one?
  • stevenrace 14y ago
    Anything that lives outside of userspace. If one has root and patience - flash BIOS and wait for a coldboot. One can even get an IP stack to pull down new firmware between boots. The user sees a normal post screen and your hypervisor sees normal hardware adapters. See Jonathan Brossard's 'prior work' slide from his Defcon talk on his work [1] for more details on the state of X86 backdooring. 'Trusted computing' and all that. [1] http://www.youtube.com/watch?v=yRxDvkKBMTc http://www.youtube.com/watch?v=yRxDvkKBMTc https://media.defcon.org/dc-20/presentations/Brossard/DEFCON-20-Brossard-Hardware-Backdooring-is-Practical.pdf https://media.defcon.org/dc-20/presentations/Brossard/DEFCON...
    • lawnchair_larry 14y ago
      I know how they work, I'm asking GP to name one that he could have used. There isn't actually much "out there" that is undetectable. You'd likely have to write your own, which is highly non-trivial.
      • trotsky 14y ago
        Obviously undetectable isn't true, but i'd guess that kbeast is likely to go undetected in all but the most prepared operations. Forensics shouldn't count since you already know you're fucked by then.
      • ttrreeww 14y ago
        You get what you paid for.