Rootkit may spark sophisticated network security

Monday, March 30, 2009

Security researchers have created a rootkit that could prove to be more malicious than its predecessors thanks to its ability of surviving after a machine reboots and avoiding detection from anti virus software.

After the rootkit is injected into a commercial BIOS firmwire using a Phython-based tool, cybercriminals could be given complete control of the compromised machine, DarkReading.com reports. This makes the rootkit "more dangerous" because its technology allows it to use the BIOS-located network to attack other machines "as well as using normal exploits without any access to the disk or memory in the operation system."

The researchers expanded on previous rootkits with a generic implementation that can work with different operating systems, according to the article. Through this updated element, they were able to attack OpenBSD and Windows machines with the BIOS code injection.

Existing network security safeguards may have difficulty clearing this particular rootkit from machines, researchers said. It runs without a hard disk and also may allow the cybercriminal to deactivate anti virus software in the process.

The researchers suggested that organizations and SMBs interested in combating this rootkit to prevent the flashing of the BIOS by enabling write-protection on the motherboard.

View more news