How can I know that a network card in a server was infected by a virus or not? Are there any methods to check it?
While it's theoretically possible to insert malicious code into flash memory on peripheral equipment like network cards, it's more likely to see the use of videocard GPU systems to do rainbow table cracks for special purpose hackware, etc.
Specialized programming is needed that would be nation-state level targeted attack fodder. Peripheral equipment malware would take special knowledge and techniques that would allow the device to operate normally without crashing while filtering traffic.
If a theoretical hack was ever done to a network card, the only way you would ever detect it would be by analysis of the traffic coming in and out of it. Your standard anti-malware wouldn't have a clue.
It's more likely that this kind of attack would be done against routers and printers. They already have CPUs with plenty of left over clock cycles and flash memory storage that will easily hold a few minor mods. Our local College had an HP that had a humorous "Insert Nickel to Print" message left by one of the Electronics Majors.
Very few viruses will infect the network card on your server. Viruses typically infect your OS or other application software. Therefore, for most purposes you don't need to worry about viruses in your network card. If you're worried about viruses, take standard steps to harden your server; search the archives for server hardening for instructions (this will be OS-dependent).
It may be possible for viruses to replace the firmware on your network card with a malicious version. That'd be very bad, because then it wouldn't be detected by ordinary anti-virus software. However, this would require a very sophisticated attack, and I don't think I can recall ever seeing this strategy used in the wild. Therefore, most people won't need to worry about this.
And remember, the best defense against viruses is: don't get infected in the first place. Keep your software up to date, use firewalls, don't run vulnerable software, etc.
|show 2 more comments|