An apparent design flaw in older Intel processors appears to open the chips up to rookit attacks, according to presentation at Black Hat by Christopher Domas, a security researcher with the Battelle Memorial Institute:
By leveraging the flaw, attackers could install a rootkit in the processor’s System Management Mode (SMM), a protected region of code that underpins all the firmware security features in modern computers.
Once installed, the rootkit could be used for destructive attacks like wiping the UEFI (Unified Extensible Firmware Interface) the modern BIOS or even to re-infect the OS after a clean install. Protection features like Secure Boot wouldn’t help, because they, too rely on the SMM to be secure.
The attack essentially breaks the hardware roots of trust, Domas said.
Intel did not immediately respond to a request for comment. According to Domas, the chipmaker is aware of the issue and has mitigated it in its latest CPUs. The company is also rolling out firmware updates for older processors, but not all of them can be patched, he said.
To exploit the vulnerability and install the rootkit, attackers would already need to have kernel or system privileges on a computer. That means the flaw can’t be used by itself to compromise a system, but could make an existing malware infection highly persistent and completely invisible.
The ability to install a rootkit at the chip level is both fascinating and terrifying at the same time. Security on the chip is the exact reason why Intel acquired McAfee, so hopefully we will begin to see the fruits of that labor at some point in the near future. Chips need just as much protection as software.
Disclosure: I work for Intel Security.