Jedi Packet Trick punches holes in firewalls

By hacking networking cards, researchers can break into networks and PCs

Hackers have hit on a new way to break into computers: by attacking the firmware used in networking cards.

Independent security researcher Arrigo Triulzi is set to unveil one such attack on Friday at the CanSecWest security conference. He calls his technique the Jedi Packet Trick. It essentially installs a clandestine virtual private network inside a firewall by hacking the firmware of the victim's networking cards.

Using a little-known remote factory diagnostic mechanism used by certain Broadcom cards, Triulzi has developed a way of installing customized firmware that instructs the card to directly pass packets to another card without telling the operating system. "You trick the operating system into believing that packets going between two different network cards don't exist," he said.

Triulzi wouldn't say what cards his attack works on, but he said that he has tried it on two similar cards, both of them about four years old.

He sends specially crafted packets to the network's firewall, which must be running a vulnerable networking card. It receives the packets and then installs the malicious firmware. That update is then leveraged to seek out and attack a second vulnerable networking card, creating a firewall-free tunnel into the network.

Because networking cards have direct access to the computer's memory, Triulzi is able to use his firmware to install code on the computer's graphics card that he can then use as a virtually undetectable back door to his victim's computer. The networking card doesn't have enough memory to handle this kind of space, but today's graphics cards are more than up to the job, he said.

Triulzi isn't the only one looking at networking card vulnerabilities at the conference. Separately, two researchers from the French Network and Information Security Agency, Yves-Alexis Perez and Loic Duflot, developed an attack that exploits a bug in an obscure remote-management feature in Broadcom's NetXtreme cards.

Their attack lets them install a back door on a Linux computer, though it could easily be modified to target any operating system, Duflot said.

For Duflot and Perez's NetXtreme attack to work, the card must have enabled a remote management feature called Alert Standard Format 2.0. Broadcom has worked out a fix for the problem and has pushed that out through its OEM partners.

This work illustrates a new type of attack that can sneak right by traditional detection techniques, said Colin Ames, a researcher with Attack Research in Santa Fe, New Mexico, who is attending the conference. "This stuff is the scary stuff," he said. "Because it's low-level."

None of the researchers at CanSecWest is releasing their code, so it's unlikely that these techniques will be used in any type of widespread attack. However, with security professionals increasingly worried about professional, targeted attacks aimed at stealing state secrets and corporate intellectual property, they raise concerns.

Duflot said hardware companies should be thinking seriously about security, especially as they develop firmware-based technologies such as Intel's Active Management Technology and Intelligent Platform Management Interface. "Nowadays, hardware is using too much embedded software," he said.

That software, he explained, can lead to bugs that give the hacker a way in. And if the hacker comes in through the network card, "the machine itself cannot even see that it has been compromised."

Tags CanSecWestJedi Packet TrickArrigo Triulzinetworking cards

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?