Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I know that a network card in a server was infected by a virus or not? Are there any methods to check it?

share|improve this question
    
What NIC are we talking about? There are very, very few where this is possible. For those, the answer is NIC-specific. (For example, most don't have storage that persists across a power loss, so cut the power and you're safe.) –  David Schwartz Jun 6 '12 at 11:14
    
@DavidSchwartz, are you saying that most NIC cards do not have any firmware that is stored in updateable non-volatile memory? (e.g., flash, EEPROM, etc.) –  D.W. Jun 6 '12 at 16:24
2  
@DavidSchwartz Most network cards and other discrete components have reflashable firmware. –  Gilles Jun 6 '12 at 17:44

2 Answers 2

up vote 5 down vote accepted

While it's theoretically possible to insert malicious code into flash memory on peripheral equipment like network cards, it's more likely to see the use of videocard GPU systems to do rainbow table cracks for special purpose hackware, etc.

Specialized programming is needed that would be nation-state level targeted attack fodder. Peripheral equipment malware would take special knowledge and techniques that would allow the device to operate normally without crashing while filtering traffic.

If a theoretical hack was ever done to a network card, the only way you would ever detect it would be by analysis of the traffic coming in and out of it. Your standard anti-malware wouldn't have a clue.

It's more likely that this kind of attack would be done against routers and printers. They already have CPUs with plenty of left over clock cycles and flash memory storage that will easily hold a few minor mods. Our local College had an HP that had a humorous "Insert Nickel to Print" message left by one of the Electronics Majors.

share|improve this answer
1  
Even if the network card isn't the primary target (and it may be; that would be a good place to send spam), it can be the infection vector. An example (discovered in the lab, not in the wild): CVE-2010-0104 (short summary). –  Gilles Jun 6 '12 at 17:43
1  
Noted over on Heise Security 07/30/2012: At the Black Hat hacker conference, Australian security expert Loukas K (aka Snare) has demonstrated a rootkit which is able to insert itself into a Macbook Air's EFI firmware and bypass the FileVault hard drive encryption system. We'll have to see how far this goes... –  Fiasco Labs Jul 30 '12 at 15:01

Very few viruses will infect the network card on your server. Viruses typically infect your OS or other application software. Therefore, for most purposes you don't need to worry about viruses in your network card. If you're worried about viruses, take standard steps to harden your server; search the archives for server hardening for instructions (this will be OS-dependent).

It may be possible for viruses to replace the firmware on your network card with a malicious version. That'd be very bad, because then it wouldn't be detected by ordinary anti-virus software. However, this would require a very sophisticated attack, and I don't think I can recall ever seeing this strategy used in the wild. Therefore, most people won't need to worry about this.

And remember, the best defense against viruses is: don't get infected in the first place. Keep your software up to date, use firewalls, don't run vulnerable software, etc.

share|improve this answer
    
Would you like to comment on whether it's probable that a NIC could be infected (presuming it was clean when first installed, and no malicious insider activity) without first having an OS infection? –  Iszi Jun 6 '12 at 12:37
    
I'd guess that infecting the NIC firmware probably requires first getting Administrator or root level privileges. However, that does not require infecting the OS or installing any lasting malware into the OS. –  D.W. Jun 6 '12 at 16:23
    
Perhaps you don't need to install lasting malware on the OS, but such activity as you describe would still have to pass the sniff-test of the OS-level Antivirus. –  Iszi Jun 6 '12 at 16:41
2  
There are very few viruses against network cards in the wild. But it is certainly possible to write one, and administrator access to the OS is not the only possible way in. Network cards parse packets, hence they have buffers that may overflow. How about CVE-2010-0104 (short summary), which not only doesn't require any OS-level access (the card is the point of entry for the attacker), but doesn't even require the computer to be switched on? –  Gilles Jun 6 '12 at 17:41
1  
Well, I didn't mean to say that fooling or bypassing antivirus was impossible - just that antivirus, OS- and software-level patching, and the principle of least privilege, seem to be your only real defenses against this sort of attack. You could maybe add a HIDS, but those can suck up system resources and are really not much more reliable than AV. There's nothing you can do on the NIC that will help defend against or detect these attacks. –  Iszi Jun 6 '12 at 18:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.