That’s what I’ve read few moments ago on a french blog : here, I was surprised when I’ve read it, so here’s a little translation of the post:
Arrigo Triulzi made a presentation of his work called « A backdoor in the firmware », Arrigo created a “hacked” firmware for a Broadcom network card which gives him the right to make it run some actions when it (the card) receives a “magic packet” containing 0xbeef ( Hexspeak fan? ^^), as the card is connected on the PCI of the victim machine, it can access directly to the memory or communicate with other peripherals without going through the OS, so software could intercept that action.
As you know a network card has limited processing and memory capacities, so it won’t be able to do any harm; well Arrigo went a bit further in his researches and thanks to Vista (what a funny surprise) and it’s Aero which requires a good graphic card accelerator with a nice GPU, he found a nice way to make the work done, he used the power of the GPU for that, so he hacked a firmware of a graphic card, and used its power (processing/memory) for his needs.
To make the things clear, it’d be like that :
- the attacker sends a “magic packet” to the network card of the infected machine
- when this card receives the packet it communicates with the graphic card via PCI
- the graphic card launch a mini SSH server which will communicate with the infected network
- the attacker will by this way get control of the box
The mini SSH server is “nicssh”, it gives some features like reboot of the machine, read directly from the memory (where your passwords 
), without going through the CPU, so fully undetectable. A bit scary , that’s true…
Now how to get that machine infected? To do that we must be able to update the firmware of that card, knowing the current users that click on everything they receive by email, it shouldn’t be a problem. However, with he new Operating Systems which reduce the rights of the users which makes the installation of the firmware an administrator job, it shouldn’t be a problem to worry about, isn’t it?
Well, the worst is coming, Arrigo did all his best to find an other way to get in, and guess what? He found it. Some companies to reduce the time of production in large scale of component, they added to their chipsets an interesting function. When an update of the chipset is announced, the constructors and PC assemblers have to update their products, so to avoid to update the machines one by one, they (chipset constructors) offer the possibility to do it via Ethernet. To update the card it’ll be as easy as sending a particular UDP packet (which is routable 
) which make it a spread attack.
That’s it, now we have an “ultimate rootkit” which can install it self on a machine and run on it without using the CPU so avoiding all the possibilities of detection by the OS, scary…
Arrigo went a bit further (again), and he imagined an other attack which is quite nice, recently, in the security field we use PCs as IDS/IPS or even as firewalls, knowing that, a possible attack would be to send an update packet for the first eth card, update its firmware, that card sends via PCI the packet to update the seconds eth card’s firmware, and then control both sides, now the attacker is able to send data between the two cards via PCI without any filtering software do its work (Firewall/IPS). Again… it’s like a nightmare.
The good news is that: this proof of concept is hardware dependent, but as u know we don’t have that many chipset constructors, do we?
Extra links:
PCI keylogger, an existing solution
Automatic remote firmware upgrade
knuthy General firmware, rootkit, security
