Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Steve Gibson of Security Now fame claims that viruses can attack a video card and infect it. I assume that he means it can infect the Video BIOS. However I'm skeptical. BIOSes are so numerous and different, what are the chances of someone writing a virus to infect the Video BIOS?

Any clues?

share|improve this question
    
Without a proper context, my guess is that he is referring to attacking the GPU and it's associated memory. It is possible, but that depends on what qualifies as an infection. –  SteveS Jul 20 '11 at 19:19
6  
It wouldn't surprise me much to learn of viruses on video cards. But it would help if you could provide a link to the story you're referring to, and provide key quotes so we don't have to wade thru podcasts. Note also that he doesn't have the best reputation: Steve Gibson: a "fringe charlatan" who "seems to know enough buzzwords and ideas to be dangerous to his clients." –  nealmcb Jul 20 '11 at 19:25
4  
Since he posts transcripts (this one should be up in a day or so) why not examine what he said before the reference to charlatan on this site yet again. There is a similar question on StackOverflow with a different, more positive, take on the question. He also addressed the issue episode 292 quoting an Al Jazeera claim.grc.com/sn/sn-292.htm Let's review today's transcript before slamming the dude. Then let's talk about the history of attrition.org both good and bad since they are the source of the charlatan listing. –  zedman9991 Jul 20 '11 at 20:25
add comment

2 Answers

It is certainly conceptually possible for a virus to attack firmware such as video BIOSes. The virus would have to be tailored for each firmware, so there would have to be a large variety, but that's only an economic argument, not a technical argument. The economics means that you're only likely likely to see firmware viruses in targeted attacks (where at least part of the virus development is specific to one target) or in attacks against popular, standardized hardware platforms (iPhone attacks technically count here).

For an example of a real firmware vulnerability, try CVE-2010-0104: Broadcom NetXtreme management firmware ASF buffer overflow. This is a bug in some Ethernet firmware that allows a remote attacker to take control of the network firmware (and so at the very least actively attack all network traffic), and potentially of the whole computer (I don't know if there's an exploit for that, but once you have access to the PCI bus, I doubt that much is barred). Interestingly, the bug is in a remote management protocol parser, which in particular handles wake-on-LAN — so a computer is more likely to be vulnerable when it's switched off.

At Black Hat USA 2012, Jonathan Brossard presented “a generic proof of concept malware for the intel architecture, Rakshasa, capable of infecting more than a hundred of different motherboards”. The proof-of-concept (not publicly released) infects many BIOSes and common peripherals including network chips. It's only a matter of time until someone adds support for video cards.

share|improve this answer
add comment

My first question to you is, what are the chances of someone writing a virus to infect SCADA systems? And then there was stuxnet....

As for your question, it is possible. The normal call back for this issue is the 2007 blackhat demonstration about hardware hacking. Here are a couple articles that hit on that demonstration... eweek, zdnet.

Frankly, when it comes to video cards in particular, i have no solid evidence either way. I would not think of it as a major threat at this time. Personally i have no doubt that video cards could be used for persistance, the only question is when will we find the first one in the wild?

Also, if anyone knows of an actual case of this in the wild, i would love to hear of it.

At the moment, i'm more afraid of a technology company being compromised that produces memory sticks than one that produces video cards. If you're looking for money, then you're going to go after the easiest route, and that seems like an easy choice at this point. If i remember correctly there was a sandisk incident similar to what i just mentioned, though i haven't done any research to back that up.

share|improve this answer
3  
research.microsoft.com/apps/pubs/default.aspx?id=70147 also discusses malicious use of a video card EEPROM –  Ormis Jul 20 '11 at 19:40
    
Re SCADA, we've been saying for YEARS that it is highly likely. I've heard laments re the state of SCADA systems since I began being aware of security as an industry... I'm actually more suprised that it took so long. –  AviD Jul 21 '11 at 10:01
    
I guess it wasn't the best example, i was simply trying to make a point that those type directed attacks are a reality. –  Ormis Jul 22 '11 at 13:36
    
Fair enough, it's not like many listened. :). For all intents, what you said is correct, and explains your premise well: just because you dont expect there to be a virus on a "niche" platform, doesn't mean there wont be one soon enough... –  AviD Jul 22 '11 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.