If we are talking about an antivirus, we are talking about software responsible for analyzing the files of a team and storage units connected in search of malicious files. An antivirus is not able, at least today, to detect whether a component is infected with a certain type of malicious software that can endanger the safety of equipment.
The most dangerous software we can find is ransomwareSoftware that includes the content of a hard drive requiring a reward to get the deciphering key. Fortunately, most market antiviruses are able to detect them before it is too late, however, which could change the future.
Infected by ransomware a processor
After having experienced the vulnerability of AMD processors, Christiaan Beek, principal director of the threats of the Rapid7 security company, had the possible consequences that the friends of others could have access to the charge Microcode in processors (Something Google has demonstrated when he discovered this vulnerability) thus breaking the encryption of the material level and modifying the operation of the processor at will.
Google has shown that this vulnerability that affected the new generation Ryzen processors, has made it possible to inject code so that when a random number has been requested, it will always show number 4. As we can imagine, this would mean a very hard blow to the safety of all equipment, especially for large companies that are the most sensitive to receiving ransomware attacks.
In theory, the only ones to be able to modify the microcode of a processor It is the manufacturer, but, if it has a vulnerability, as has been the case with the aforementioned AMD processors, anyone, with the appropriate knowledge, could take the opportunity to do a lot of damage.
As we can read in Register, half that Beek gave an interview by telling his conclusion, when he worked in security, he weighed that he could write a CPU ransomware to demonstrate his theory, a code which, as it is logical, will not make known, although it does not mean that the friends of others did not have the same idea that they are already working on a similar method. This is a serious problem for the safety of the equipment which only changes their protection on dedicated software, because, as we commented at the beginning of this article, they will not be able to detect it and take the appropriate measures.
On the black market, tools such as knowledge is found Blacklotus For several years which allow you to skip the start -up in complete safety and to introduce malicious software into the firmware of BIOS, malware which is practically impossible to eliminate and charge always whenever the equipment is activated. Malicio software has been, is and will continue to be a problem which, like technology, also evolves to ignore the protective measures with which it is usually found. Personally, on the basis of my experience, the chances of a moment when we can do without an antivirus are distant.
