How can I know that a network card in a server was infected by a virus or not? Are there any methods to check it?
While it's theoretically possible to insert malicious code into flash memory on peripheral equipment like network cards, it's more likely to see the use of videocard GPU systems to do rainbow table cracks for special purpose hackware, etc.
Specialized programming is needed that would be nation-state level targeted attack fodder. Peripheral equipment malware would take special knowledge and techniques that would allow the device to operate normally without crashing while filtering traffic.
If a theoretical hack was ever done to a network card, the only way you would ever detect it would be by analysis of the traffic coming in and out of it. Your standard anti-malware wouldn't have a clue.
It's more likely that this kind of attack would be done against routers and printers. They already have CPUs with plenty of left over clock cycles and flash memory storage that will easily hold a few minor mods. Our local College had an HP that had a humorous "Insert Nickel to Print" message left by one of the Electronics Majors.
Very few viruses will infect the network card on your server. Viruses typically infect your OS or other application software. Therefore, for most purposes you don't need to worry about viruses in your network card. If you're worried about viruses, take standard steps to harden your server; search the archives for server hardening for instructions (this will be OS-dependent).
It may be possible for viruses to replace the firmware on your network card with a malicious version. That'd be very bad, because then it wouldn't be detected by ordinary anti-virus software. However, this would require a very sophisticated attack, and I don't think I can recall ever seeing this strategy used in the wild. Therefore, most people won't need to worry about this.
And remember, the best defense against viruses is: don't get infected in the first place. Keep your software up to date, use firewalls, don't run vulnerable software, etc.
I know this is an oldish question but since the last post, This has been done to a bunch of nic's. The most popular are mobile broadband or 4g lte nic's. I attended Def con this year 23, and was surprised at how easy and fast an attack could occur on nic cards firmware. it was very easy for them to gain elevated control of a pc once the new firmware was on the network interface card.
the video of that talk can be found on youtube, however I do not know the name of said talk so a little digging is required.
I will state the caveat that you will never know if X is infected, but only have a good idea.
As I see it, there are 3 areas that could be exploited on a network card.
- The Driver of the OS (but this is not part of this question)
- Network Card Firmware
- In Memory
Having something existing in memory would be unlikely as cost vs effort would be high for an attacker. A reboot would clear the virus and network cards and ntypically don't contain large amounts of memory to house a virus. Using the network card as an entry to the firmware would be far more likely.
So the remaining piece is to check the firmeware. I'll use intel's support as an example it was quickest to find. https://www-ssl.intel.com/content/www/us/en/support/software/manageability-products/000005790.html
- Prepare BootUtil for your system (download and have administrative rights)
- Run: bootutil -nic=XX -saveimage -file=C:\Temp\MyCurrentNIC.bin
- Create a (SHA1/SHA256) Hash of the saved file
- Repeat the process on another NIC of same type/firmware version or download the firmware from the website
- Create a (SHA1/SHA256) Hash of the "known" good file
- Check for a match
- (Optional) Submit your captured firmware to manufacturer for security analysis
The easier way around this is to use a NIDS/Wireshark to look for known bad packets to known signatures using a resource such as http://www.netresec.com/?page=PcapFiles. This will tell you the source IP of the machine/device that is infected typically traditional measures will allow for virus removal without resorting to firmware checking.