Quote:
Originally Posted by vnmlike
The mobo method described here by NZT is public. It is known, though not widely known. Nevertheless, FACEIT is certainly currently working on finding a way to best detect and block it.
If NZT claims it is not public, I will publish the relevant links. So just leave it.
|
SMM has been a public method since around 1993 to be exact. DMA in 58' when IO was first utilized. Hypervisors were first used in the 60's.
The question isn't when the method became public, it's whether it's difficult to detect. Unless you are referring to public examples utilizing SMM - which you can find on EDK2/Tianocore Docs. If you understand privilege rings then you will understand why its a smart approach.
The reason its effective is that its impossible to read the memory existing in SMM unless you already are in SMM. Blocking SMM is impossible; as you would DMA through IOMMU. DMA Blocking works because IOMMU is managed in Ring 0 (or in the case of a Hypervisor potentially Ring -1) and therefore you can make modifications to the IOMMU Range or access the DMA devices either directly or indirectly thanks to how the PCI Bus operates. For SMM, this is protected by your physical CPU chip. To evade this protection and find an SMM vulnerability then ship it to users would almost certainly get your driver blacklisted and subsequently destroy the driver owners business (AC).
While Hypervisors and DMA are reasonable solutions, the amount of detection vectors and the shifting landscape of the ability to accurately action those vectors changes quite frequently. Whereas a SMM solution, if done properly, has a set amount of truly actionable heuristics and therefore doesn't require constant cat and mouse. That being said if your DMA solution ships with a customized BIOS Firmware for the motherboard, you can keep DMA quite difficult to detect.