4th International ICST Conference on Security and Privacy in Communication Networks

Research Article

SMM Rootkits: A New Breed of OS Independent Malware

  • @INPROCEEDINGS{10.1145/1460877.1460892,
        author={Shawn Embleton and Sherri Sparks and Cliff Zou},
        title={SMM Rootkits: A New Breed of OS Independent Malware},
        proceedings={4th International ICST Conference on Security and Privacy in Communication Networks},
        publisher={ACM},
        proceedings_a={SECURECOMM},
        year={2008},
        month={9},
        keywords={System Management Mode Rootkit Malware Virtualization Operating System Security},
        doi={10.1145/1460877.1460892}
    }
    
  • Shawn Embleton
    Sherri Sparks
    Cliff Zou
    Year: 2008
    SMM Rootkits: A New Breed of OS Independent Malware
    SECURECOMM
    ACM
    DOI: 10.1145/1460877.1460892
Shawn Embleton1,*, Sherri Sparks1,*, Cliff Zou1,*
  • 1: University of Central Florida
*Contact email: sembleton@cs.ucf.edu, ssparks@cs.ucf.edu, czou@cs.ucf.edu

Abstract

The emergence of hardware virtualization technology has led to the development of OS independent malware such as the Virtual Machine based rootkits (VMBRs). In this paper, we draw attention to a different but related threat that exists on many commodity systems in operation today: The System Management Mode based rootkit (SMBR). System Management Mode (SMM) is a relatively obscure mode on Intel processors used for low-level hardware control. It has its own private memory space and execution environment which is generally invisible to code running outside (e.g., the Operating System). Furthermore, SMM code is completely non-preemptible, lacks any concept of privilege level, and is immune to memory protection mechanisms. These features make it a potentially attractive home for stealthy rootkits. In this paper, we present our development of a proof of concept SMM rootkit. In it, we explore the potential of System Management Mode for malicious use by implementing a chipset level keylogger and a network backdoor capable of directly interacting with the network card to send logged keystrokes to a remote machine via UDP. The rootkit hides its memory footprint and requires no changes to the existing Operating System. It is compared and contrasted with VMBRs. Finally, techniques to defend against these threats are explored. By taking an offensive perspective we hope to help security researchers better understand the depth and scope of the problems posed by an emerging class of OS independent malware.