26 Jul
2014
26 Jul
'14
6:45 p.m.
On Jul 26, 2014 5:45 PM, "dwight" <dkelvey at hotmail.com> wrote:
If someone was snooping, the BIOS would be the place
to do it. The space for uC update is really quite small and
only intended for a few instructions.
The point of a microcode hack wouldn't be to do the snooping. It would be
to provide a hook so that some other piece of seemingly innocuous software
that the user runs could completely bypass normal system security snd do
the snooping. For instance, a microcode hack could both make it easier to
install a rootkit, and harder to detect one.
As a purely hypothetical example, a microcode hack could be designed to let
a specially crafted ActiveX control get ring 0 system access. With somewhat
more difficulty it might even be possible to do that for Javascript or
Java, or even PDF documents or VBA scripts, based on known instruction
sequences in specific interpreters.
As compared to a normal exploit, this would be essentially undetectable,
and by virtue of that, unfixable. That's the motivation for spending vast
amounts of money developing it.