Researchers at the University of Illinois at Urbana-Champaign have demonstrated how they could take total control of a user’s computer by altering the computer chip itself. While the attack would require a significant amount of work to be used in the real-world, it would be virtually undetectable and provide complete and total access to the user’s machine.
The attack was constructed using a special programmable processor running Linux. That chip was programmed to inject the hacker firmware code into the chip’s memory (which is typically only done by the BIOS at bootup). This change to the normal operations of the CPU itself result in a system which allows any user to log in remotely and take control.
The hacker firmware code resulted in a very small number of changes to the actual CPU itself. In fact, only 1,341 of the more than 1 million gates available for reprogramming. The then created “back door,” a term used to describe a way to bypass any traditional security features which are employed on the system, like using the name “Joshua” on WOPR (remember that?), allows the user to do whatever they want by simply sending a specially crafted network packet.
While this is not your average “I’m a hacker at home” kind of attack, this demonstrated design indicates just how easily someone who truly desired to gain access to your machine could basically get anything they want. It seems like 256 KB PGP keys are truly the only way to fly, so to speak.
Read more at InfoWorld.