Comments on: Black Hat 2008: NIC based rootkit

By: wat.

wat. — Fri, 15 Aug 2008 07:09:09 +0000

“Not a hack”?

This is one of the most important parts once your are post-root (meaning you have root by physical access or SSH etc.) Having a rootkit on a machine is insurance that you will not get noticed. It doesn’t matter how you get one on.

By: supernova_hq

supernova_hq — Thu, 14 Aug 2008 11:00:42 +0000

I just find it amusing that they said it was easier to code directly for the hardware than to use the API Microsoft probably spent hundreds of thousands of dollars to develop.

By: TJHooker

TJHooker — Thu, 14 Aug 2008 02:36:34 +0000

@Casey Banner: ^^

By: Casey Banner

Casey Banner — Wed, 13 Aug 2008 23:04:30 +0000

Where does it say they required physical access?

They are writing drivers, which are run on the pc...all this can be done remotely.

By: TJHooker

TJHooker — Wed, 13 Aug 2008 22:17:33 +0000

Where they tapping hardware or writing drivers?

By: stealthed-port

stealthed-port — Wed, 13 Aug 2008 21:05:02 +0000

This is not a hack. Changing the MAC address on the fly is more practical.

By: stealthed-port

stealthed-port — Wed, 13 Aug 2008 21:04:30 +0000

This is not a hack. Changing the MAC address on the fly is more practical.

By: stealthed-port

stealthed-port — Wed, 13 Aug 2008 20:49:31 +0000

This is not a hack. Changing the MAC address on the fly is more practical.

By: Cypress

Cypress — Wed, 13 Aug 2008 20:45:55 +0000

This is not a hack. It's just direct hardware access. You're simply skirting the system. I'd also consider this obvious.

Tapping an Ethernet cable and injecting/sniffing data in transit, is also not hacking, its just like anything else.

By: Comm_Hawk

Comm_Hawk — Wed, 13 Aug 2008 20:03:21 +0000

Not a hack. If someone is soldering things to my network card….

Now if they could remotely rewrite the ROM(Joke intended) thats a hack!

By: Eric

Eric — Wed, 13 Aug 2008 18:39:48 +0000

… just another supporting reason for the physical security of your infrastructure!