Intel sinkhole rootkit info

aus9 · 08-12-2015, 06:43 PM

Hi

Just seen this page
http://www.itnews.com.au/News/407809...-16-years.aspx

links to
https://github.com/xoreaxeaxeax/sinkhole

I am hoping rootkit hunter and other such tools might be able to detect it?

If not, is there any concerns on Linux for people using these Intel processors made between 1995 and 2011?

thanks for reading

273 · 08-13-2015, 01:03 AM

By the looks of it this would be undetectable by rkhunter though there is a hint that the OS could, perhaps, be patched to make it detectable.
http://www.theregister.co.uk/2015/08...el_processors/
Since it's baked into the CPU though I wouldn't think there's much can be done in software.

Habitual · 08-13-2015, 09:01 AM

"with a special operating system driver, he managed to install a rootkit into the SMM." is too vague.
Is it me, or is this ironic to any one else?

16 year old hole, 5 years after the fact, and this is news?
Seems more like click-bait.

273 · 08-13-2015, 01:30 PM

Quote:

Originally Posted by Habitual

"with a special operating system driver, he managed to install a rootkit into the SMM." is too vague.
Is it me, or is this ironic to any one else?

16 year old hole, 5 years after the fact, and this is news?
Seems more like click-bait.

Is there a previous source?
If not, then I would say it's news. If a new fatal flaw were suddenly found in a rare classic car I'd still call it news for people who are into cars.

aus9 · 08-13-2015, 06:36 PM

Hi Habitual

Quote:

16 year old hole, 5 years after the fact, and this is news?
Seems more like click-bait.

Then I guess you have not even bothered to read the new link

Quote:

Domas said when he revealed the hardware bug at the Black Hat conference in Las Vegas last week.

Read more: http://www.itnews.com.au/News/407809...#ixzz3ik0JPHcY

and yes I do get offended when a LQ member may be suggesting I am some kind of troll or other such nastiness.

fatmac · 08-14-2015, 05:39 AM

You would need to get root priviledges to use it, so why bother going the extra mile, when you already have the system. I think it is more theoretical than practical.

Habitual · 08-14-2015, 07:31 AM

Quote:

Originally Posted by aus9

and yes I do get offended when a LQ member may be suggesting I am some kind of troll or other such nastiness.

I was critical of the article, not you. So Relax.

273 · 08-14-2015, 01:10 PM

Quote:

Originally Posted by fatmac

You would need to get root priviledges to use it, so why bother going the extra mile, when you already have the system. I think it is more theoretical than practical.

As somebody commented when The Register ran this: Privilege escalation bugs and server compromises happen all the time -- and the last resort is often to wipe and start again. With this method you can't wipe and start again (well, not without using the exploit yourself) as the malware is in your motherboard's firmware. So, no matter how this gets there (in second hand equipment even?) you couldn't find it or remove it at that time as you would have had no knowledge of its existence.
Oddly enough it reminds me of this:
http://www.theregister.co.uk/2015/08...irmware_nasty/

unSpawn · 08-14-2015, 06:07 PM

Quote:

Originally Posted by Habitual

"with a special operating system driver, he managed to install a rootkit into the SMM." is too vague.

Dunno but I do remember there was SMM stuff in the news a couple of years back.