The scariest software vulnerabilities are the ones that have been around for years without us knowing, which is what makes this 18-year-old vulnerability that was recently discovered in the x86 processor architecture so frightening. First disclosed by Christopher Domas, a Battelle Memorial Institute security researcher, at the Black Hat security conference yesterday, this vulnerability could enable hackers to install a rootkit in the processor’s System Management Mode (SMM).
A design flaw in the x86 processor architecture dating back almost two decades could allow attackers to install a rootkit in the low-level firmware of computers, a security researcher said Thursday. Such malware could be undetectable by security products. The vulnerability stems from a feature first added to the x86 architecture in 1997. It was disclosed Thursday at the Black Hat security conference by Christopher Domas, a security researcher with the Battelle Memorial Institute. By leveraging the flaw, attackers could install a rootkit in the processor’s System Management Mode (SMM), a protected region of code that underpins all the firmware security features in modern computers. Once installed, the rootkit could be used for destructive attacks like wiping the UEFI (Unified Extensible Firmware Interface) the modern BIOS or even to re-infect the OS after a clean install. Protection features like Secure Boot wouldn’t help, because they, too rely on the SMM to be secure. The attack essentially breaks the hardware roots of trust, Domas said.
