Cyber-Attacks Could Be Thwarted By CPU Symbiotes

In 2011, computer scientists revealed they could hack into printers and break into every computer linked to these printers.

Targets for hackers are becoming more widespread. The chips running car engines, routers that form the Internet’s backbone, power plants, and rail lines are all at risk because they can link to computers.

Computer scientists are now devising guardians called symbiotes, which could run on embedded computers regardless of the operating system. This could help protect the critical infrastructure of nations and corporations.

Attacks against embedded systems may have gone unseen for years. In 2011, computer scientists identified more than 1.4 million publicly accessible embedded computers in 144 countries that still had factory default passwords. This could give anyone with online access total control over these machines. The devices, which make up one in five of the embedded computers they found, include routers, video-conferencing units, cable TV boxes, and firewalls used to defend computer networks.

These attacks are stealthy and more sophisticated than criminals trying to get credit card data. This is espionage at the corporate level where attacks are aimed at taking down a country’s critical infrastructure.

Since there is an incredible amount of diversity in the programs running embedded computers, researchers have a real challenge ahead of them when it comes to designing safeguards. For example, the routers made by Cisco possess about 300,000 different firmware images.

Scientists have developed anti-malware systems that can work on embedded computers regardless of the systems they run on. These defenses run on the CPU. A symbiote continually scans a large number of random chunks of the firmware image’s code to check for anomalies that suggest that an incursion has occurred.

A symbiote is designed to run on specific kinds of CPUs, so they can run in many smartphones or routers, regardless of the operating system. The researchers plan on delivering a prototype to the US government by the end of the year for testing and to commercialize their work.

Hackers could still find ways to circumvent symbiotes. The Pentagon is pushing for legislation that would require baseline cyber-security standards for critical private sector infrastructure, like power plants, water treatment plants, and gas pipelines.