Re: Microsoft Research: Strider GhostBuster Rootkit Detection and "...stealth software that hides in BIOS, Video card EEPROM"

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 09/23/05 

Date: Fri, 23 Sep 2005 19:47:27 GMT

From: "Roger Wilco" <yesman@yourservice.invalid>

|
| Only if it has errors. Error in this context is a difference between the
| data the CRC's cyclic check sum was generated from and the new CRC
| cyclic check sum calculated from the data when received. How would a
| legitimate BIOS Upgrade reflash work if the checksum reference was
| inalterable? CRC's work because noise can't be expected to calculate new
| checksums, and they work better than simple parity checks for
| reliability and provide for error correction methods instead of only
| retransmission requests.
|

If it comes from the factory (malicious or not) it will not fail a CRC check. IFF code could
be appended to the BIOS routines maliciously it would fail a CRC check. 

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Relevant Pages

  • Re: crc for versioning
    ... I used to use CRC for validating images, ... mode and error pattern than serial communications, ... These days I use a Fletcher checksum, which is faster than a table ... 8-bit Fletcher sum, for sizes up to 64K a 16-bit sum, and for larger ...
    (comp.arch.embedded)
  • Re: Simple but reliable checksum for small controllers
    ... I am looking for an efficient checksum method. ... Just adding the code bytes to a 16/24/32-bit sum is simple ... For calculating a CRC with 16 or more bits, ... (not counting the loop and memory access instructions). ...
    (comp.arch.embedded)
  • Re: Is it possible to forge both CRC and checksum of a file?
    ... say you did a 8-bit sum of the file with say a 32-bit CRC. ... This means you can add any multiple of the modulus and the CRC will not ... to CRC1 until the bytesum matches. ...
    (sci.crypt)
  • Re: CRC versus CheckSum
    ... I have a situation where I have a byte in which to place either a checksum ... Our packets cannot have bytes in a packet swapped in order (the transport ... jsut as good as the CRC. ... Neither detect all errors (there are after all the same number of states for the sum in either case). ...
    (comp.arch.embedded)
  • Re: A puzzle of some code
    ... point fail to increment scale. ... First in single precision ... sum = sum + step ...
    (comp.lang.fortran)