Malicious microprocessor opens new doors for attack

Comments

Related

Active Comments

kev says: I really don't believe in this article. I followed the link and read the actual article. I still don't believe...

Read the rest | Reply

Anonymous says: i COULD see valid uses for this if it were controlled correctly (which it never would be)...but this would allow...

Read the rest | Reply

All Comments (15) | Post New

• Apple pimps AV: Mac bloggers shocked, PC bloggers mock
• Bad week for Microsoft. Browsers, OS and Boxes
• Too good to ignore: 6 alternative browsers
• 7 ways to cut your software costs during the economic downturn
• Netbooks: small, cheap -- and fast?

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

April 16, 2008 (IDG News Service) For years, hackers have focused on finding bugs in computer software that give them unauthorized access to computer systems, but now there's another way to break in: Hack the microprocessor.

On Tuesday, researchers at the University of Illinois at Urbana-Champaign demonstrated how they altered a computer chip to grant attackers back-door access to a computer. It would take a lot of work to make this attack succeed in the real world, but it would be virtually undetectable.

To launch its attack, the team used a special programmable processor running the Linux operating system. The chip was programmed to inject malicious firmware into the chip's memory, which then allows an attacker to log into the machine as if he were a legitimate user. To reprogram the chip, researchers needed to alter only a tiny fraction of the processor circuits. They changed 1,341 logic gates on a chip that has more than 1 million of these gates in total, said Samuel King, an assistant professor in the university's computer science department.

"This is like the ultimate back door," said King. "There were no software bugs exploited."

King demonstrated the attack on Tuesday at the Usenix Workshop on Large-Scale Exploits and Emergent Threats, a conference for security researchers held in San Francisco.

His team was able to add the back door by reprogramming a small number of the circuits on a LEON processor running the Linux operating system. These programmable chips are based on the same Sparc design that is used in Sun Microsystems' midrange and high-end servers. They are not widely used, but have been deployed in systems used by the International Space Station.

In order to hack into the system, King first sent it a specially crafted network packet that instructed the processor to launch the malicious firmware. Then, using a special login password, King was able to gain access to the Linux system. "From the software's perspective, the packet gets dropped... and yet I have full and complete access to this underlying system that I just compromised," King said.

The researchers are now working on tools that could help detect such a malicious processor, but there's a big problem facing criminals who would try to reproduce this type of attack in the real world. How do you get a malicious CPU onto someone's machine?

This would not be easy, King said, but there are a few possible scenarios. For example, a "mole" developer could add the code while working on the chip's design, or someone at a computer assembly plant could be paid off to install malicious chips instead of legitimate processors. Finally, an attacker could create a counterfeit version of a PC or a router that contained the malicious chip.

Reprinted with permission from

IDG.net
Story copyright 2008 International Data Group. All rights reserved.