Hackers Innovate Way to Store and Execute Malware from Video Memory to Evade Anti-Malware

[btarunr]

Cybercriminals have innovated a way to store malware code inside GPU dedicated memory (video memory), and execute code directly from there. Execution from video memory may not be new, but they've mostly been confined to the academic space, and unrefined. This would be the first time a proof-of-concept of a working tool that injects executables to video memory, surfaced on a hacker forum.

The tool relies on OpenCL 2.0, and its developers claim to have successfully tested it on Intel Gen9, AMD RDNA, NVIDIA Kepler, and NVIDIA Turing graphics architectures (i.e. UHD 620, UHD 630, Radeon RX 5700, GeForce GTX 740M, and GTX 1650). What makes this ingenious is that the malware binary is stored entirely in GPU memory address-space and is executed by the GPU, rather than the CPUs. Conventional anti-malware software are only known to scan the system memory, disks, and network traffic for malware; but not video memory. Hopefully this will change.



View at TechPowerUp Main Site

 

[Deleted member 24505]

The hackers might be twots, but no denying they are clever.

 

[ZoneDymo]

henceforth nothing made to this day will meet the requirements of windows 11, cannot be too careful !!

 

[Metroid]

Directstorage is coming and that will make easier for this hack to work.

 

[Kelutrel]

Any microchip can be a malware if you are brave enough...

 

[freeagent]

How do windows 11 users fare?

 

[P4-630]

How do windows 11 users fare?

I was reading somewhere they could store and execute malware from TPM....

 

[lexluthermiester]

Cybercriminals have innovated a way to store malware code inside GPU dedicated memory (video memory), and execute code directly from there.

I've wondered if that would work for decades, guess we have an answer now. THIS will piss a few people off!

The hackers might be twots, but no denying they are clever.

True!

I was reading somewhere they could store and execute malware from TPM....

Yuppers. It takes some doing but can be done. This is also why TPM is useless outside of a certain usage context and why microsoft requiring it for Windows 11 is as pointless as it is transparent.

 

[zlobby]

I'm pretty sure some guys in some govt agencies are now swearing profoundly because someone was lame enough to reveal this lucrative hax.

 

[MentalAcetylide]

Proof-of-concept has been known for years, but there really wasn't much need for it given the simpler alternatives available.

I've wondered if that would work for decades, guess we have an answer now. THIS will piss a few people off!

Eventually we're all going to be using AV programs running mirrors of our system on virtual machines because sometimes the only way to detect this stuff is by identification through its behavior(dynamic analysis).

Until countries band together and agree to start tracking down and putting bullets into the heads of individuals that do this kind of stuff, its just going to continue.

 

[R-T-B]

I was reading somewhere they could store and execute malware from TPM....

First I've heard of it. Malware can use the TPM to store keys away from the user, but it can't run from it.

 

[zlobby]

Even NIC's have some sort of firmware and write-enabled memory.

Usually all firmware have some interface for writing things in its memory. Also, usually vendors rely on non-documented interfaces or ones that are under NDA with the OEM/ODM, i.e. bad for us.

There are so many places to hide malware or exploit freely writeable memory that I get the hibbidyjibbies just thinking about it.

Proof-of-concept has been known for years, but there really wasn't much need for it given the simpler alternatives available.


Eventually we're all going to be using AV programs running mirrors of our system on virtual machines because sometimes the only way to detect this stuff is by identification through its behavior(dynamic analysis).

Until countries band together and agree to start tracking down and putting bullets into the heads of individuals that do this kind of stuff, its just going to continue.

Complete virtualization and isolation, in combination with dynamic root of trust can solve 99% (or maybe around 95%?) of all problems.

It's not yet implemented because it is expensive and has a significant performance hit. Also, very few SOHO users demand it. Enterprises already run almost everything on some form of (somewhat) secure virtualization platform.

 

[Tartaros]

Until countries band together and agree to start tracking down and putting bullets into the heads of individuals that do this kind of stuff, its just going to continue.

Forget about that, that's were everyone get their security operators/advisors/hackers for their own interests. It's the same as demilitarizing, should be the common goal, no ones does because of what others might do.

 

[zlobby]

Until countries band together and agree to start tracking down and putting bullets into the heads of individuals that do this kind of stuff, its just going to continue.

And what if it's the countries themselves?

 

[MentalAcetylide]

And what if it's the countries themselves?

We set them adrift with fierce rebukes and nukes.

 

[zlobby]

We set them adrift with fierce rebukes and nukes.

Ah, if only... Sorry, I ran out of nukes.

 

[MentalAcetylide]

Ah, if only... Sorry, I ran out of nukes.

Sheesh, nobody here lives in Sherwood Forrest? You can at least buy some uranium glassware. Just be sure to aim for the brain bucket!

 

[InhaleOblivion]

Takes buying an open box or used GPU to a whole different level.