SWAP: NSA Exploit of the Day
Today's item from the NSA's Tailored Access Operations (TAO) group
implant catalog:
SWAP
(TS//SI//REL) SWAP provides software application persistence by
exploiting the motherboard BIOS and the hard drive's Host Protected Area
to gain periodic execution before the Operating System loads.
(TS//SI//REL) This technique supports single or multi-processor
systems running Windows, Linux, FreeBSD, or Solaris with the following
file systems: FAT32, NTFS, EXT2, EXT3, or UFS1.0.
(TS//SI//REL) Through remote access or interdiction, ARKSTREAM is
used to reflash the BIOS and TWISTEDKILT to write the Host Protected
Area on the hard drive on a target machine in order to implant SWAP and
its payload (the implant installer). Once implanted, SWAP's frequency of
execution (dropping the playload) is configurable and will occur when
the target machine powers on.
Status: Released / Deployed. Ready for Immediate Delivery
Unit Cost: $0
Page, with graphics, is
here. General information about TAO and the catalog is
here.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.