Rootkits Specialist discovered new type of computer attacks

5th March 2007

Rootkit specialist Joanna Rutkowska in the course of the conference Black Hat demonstrated that the hardware used to capture information from the store is not as reliable as it was previously believed. Hardware solutions, in particular, the specialized PCI cards, are used by computer security experts to obtain patterns of RAM contents. Analysis of the data received this way traces the presence of even the most complex and intricate spyware and rootkits on the computer. However, Rutkowska demonstrated that the information captured from the store by means of hardware, in theory, can be falsified. Joanna Rutkowska has showed three types of attacks against systems based on 64-bit AMD processors. The rootkits specialist also showed that the attacker can fill the results of reading out the store with random information as well as with trash data. DoS attacks are also possible. According to Joanna Rutkowska, the problem is in the mere architecture of the modern PC and can be solved only by changes in the computer system. James Butler, another rootkits specialist, agrees with Rutkowska completely. According to Butler, the research made by Rutkowska is a proof that even hardware can not garantee, that information read out from the store is certain. By the way, it is noticible that recently,Rutkowska has strongly criticized the UAC (User Account Control), embedded into Windows Vista. When installing the program, UAC whether grants it full access to the system, or does not give it at all. Joanna Rutkowska calls this feature "a rather serious defect of UAC".