Symantec Found Virus Codes In An Online Meeting Place For Virus Writers

Security is indeed a moving target. A new proof of concept virus is found by security researchers at Symantec that targets processors rather than the computer’s OS (operating system). Presently, the proof-of-concept worms that Symantec have found, namely, w32.bounds that targets 32-bit processors and w64.bounds that targets 64 bit processors, are rated as low risk and harmless. They infect Windows executables only currently.

It’s not completely correct to say that the malware in question attacks processors, but this quote from Vincent Weafer, senior director of Symantec’s Security Response Group, illustrates the potential danger of the virus: “If I can get to the processor level, potentially I can really start tying myself into the core hardware. I can potentially evade some of the kernel protection and user protection. There is an attraction to virus writers to get to the lowest level possible,” said Weafer.

This means that anti-viruses may not be able to detect such a virus, as it is able to hide in hardware. Such a virus would also evade Microsoft‘s kernel security enhancements on Vista, and virus writers could conceivably target any operating system this way. What the viruses do is infect systems by tying themselves to Windows executable files, which disqualifies them as so-called chip level threats. They do, however, employ elements of such attacks by showing an ability to executive chip level assembly code. Symantec found the code in an online meeting place for virus writers, like IRC chat channels for example.

Via itnews

Security is indeed a moving target. A new proof of concept virus is found by security researchers at Symantec that targets processors rather than the computer’s OS (operating system). Presently, the proof-of-concept worms that Symantec have found, namely, w32.bounds that targets 32-bit processors and w64.bounds that targets 64 bit processors, are rated as low risk and harmless. They infect Windows executables only currently.

It’s not completely correct to say that the malware in question attacks processors, but this quote from Vincent Weafer, senior director of Symantec’s Security Response Group, illustrates the potential danger of the virus: “If I can get to the processor level, potentially I can really start tying myself into the core hardware. I can potentially evade some of the kernel protection and user protection. There is an attraction to virus writers to get to the lowest level possible,” said Weafer.

This means that anti-viruses may not be able to detect such a virus, as it is able to hide in hardware. Such a virus would also evade Microsoft‘s kernel security enhancements on Vista, and virus writers could conceivably target any operating system this way. What the viruses do is infect systems by tying themselves to Windows executable files, which disqualifies them as so-called chip level threats. They do, however, employ elements of such attacks by showing an ability to executive chip level assembly code. Symantec found the code in an online meeting place for virus writers, like IRC chat channels for example.

Via itnews