Jedi Packet Trick punches holes in firewalls

By hacking networking cards, researchers can break into networks and PCs

Hackers have hit on a new way to break into computers: by attacking the firmware used in networking cards.

Independent security researcher Arrigo Triulzi is set to unveil one such attack on Friday at the CanSecWest security conference. He calls his technique the Jedi Packet Trick. It essentially installs a clandestine virtual private network inside a firewall by hacking the firmware of the victim's networking cards.

Using a little-known remote factory diagnostic mechanism used by certain Broadcom cards, Triulzi has developed a way of installing customized firmware that instructs the card to directly pass packets to another card without telling the operating system. "You trick the operating system into believing that packets going between two different network cards don't exist," he said.

Triulzi wouldn't say what cards his attack works on, but he said that he has tried it on two similar cards, both of them about four years old.

He sends specially crafted packets to the network's firewall, which must be running a vulnerable networking card. It receives the packets and then installs the malicious firmware. That update is then leveraged to seek out and attack a second vulnerable networking card, creating a firewall-free tunnel into the network.

Because networking cards have direct access to the computer's memory, Triulzi is able to use his firmware to install code on the computer's graphics card that he can then use as a virtually undetectable back door to his victim's computer. The networking card doesn't have enough memory to handle this kind of space, but today's graphics cards are more than up to the job, he said.

Triulzi isn't the only one looking at networking card vulnerabilities at the conference. Separately, two researchers from the French Network and Information Security Agency, Yves-Alexis Perez and Loic Duflot, developed an attack that exploits a bug in an obscure remote-management feature in Broadcom's NetXtreme cards.

Their attack lets them install a back door on a Linux computer, though it could easily be modified to target any operating system, Duflot said.

For Duflot and Perez's NetXtreme attack to work, the card must have enabled a remote management feature called Alert Standard Format 2.0. Broadcom has worked out a fix for the problem and has pushed that out through its OEM partners.

This work illustrates a new type of attack that can sneak right by traditional detection techniques, said Colin Ames, a researcher with Attack Research in Santa Fe, New Mexico, who is attending the conference. "This stuff is the scary stuff," he said. "Because it's low-level."

None of the researchers at CanSecWest is releasing their code, so it's unlikely that these techniques will be used in any type of widespread attack. However, with security professionals increasingly worried about professional, targeted attacks aimed at stealing state secrets and corporate intellectual property, they raise concerns.

Duflot said hardware companies should be thinking seriously about security, especially as they develop firmware-based technologies such as Intel's Active Management Technology and Intelligent Platform Management Interface. "Nowadays, hardware is using too much embedded software," he said.

That software, he explained, can lead to bugs that give the hacker a way in. And if the hacker comes in through the network card, "the machine itself cannot even see that it has been compromised."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Jedi Packet TrickArrigo TriulziCanSecWestnetworking cards

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?