A chipset level network backdoor

摘要: Chipsets refer to a set of specialized chips on computer's motherboard or an expansion card [12]. In this paper we present proof concept chipset level rootkit/network backdoor. It interacts directly with network interface hardware based widely deployed Intel 8255x, and tested it successfully two different Ethernet cards chipset. The backdoor has the ability both covertly send out packets receive packets, without need disable security software installed in compromised host order hide its presence. Because low-level position computer system, is capable bypassing virtually all commodity firewall host-based intrusion detection software, including popular, applications like Snort Zone Alarm Security Suite. Such backdoors, while complicated specific, are likely become serious threats high profile attacks corporate espionage cyber terrorist attacks.