Slashdot Mirror
Persistent BIOS Rootkit Implant To Debut At CanSecWest
msm1267 writes Research on new BIOS vulnerabilities and a working rootkit implant will be presented on Friday at the annual CanSecWest security conference. An attacker with existing remote access on a compromised computer can use the implant to turn down existing protections in place to prevent re-flashing of the firmware, enabling the implant to be inserted and executed. The devious part of the exploit is that the researchers have found a way to insert their agent into System Management Mode, which is used by firmware and runs separately from the operating system, managing various hardware controls. System Management Mode also has access to memory, which puts supposedly secure and privacy focused operating systems such as Tails in the line of fire of the implant.
Their implant, the researchers said, is able to scrape the secret PGP key Tails uses for encrypted communication, for example. It can also steal passwords and encrypted communication. The implant survives OS re-installation and even Tails' built-in protections, including its capability of wiping RAM.
Their implant, the researchers said, is able to scrape the secret PGP key Tails uses for encrypted communication, for example. It can also steal passwords and encrypted communication. The implant survives OS re-installation and even Tails' built-in protections, including its capability of wiping RAM.
It's getting to where you don't trust ANYTHING.
This isn't anything new, Amiga in the 90's had a CMOS happy virus that used the battery power to stay in memory. It wasn't in the clock but rewrote that area of the working bios to stay resident. I remember having to take the battery out of my A500 to get rid of it, as it survived reboots and power offs.
UEFI bio is going to be a real hassle going forward, its going to be much easier to write something for this vs the older bios with all of its limitations. USB controller firmware, Bridge firmware, controller firmware, soon to be memory controller firmware like Power8, ethernet, ssd/hd firmware, and sound card firmware. There are a lot of places if you can inject your version during the download update to the customer where harm can be done.
This. Even if you can't stand to mar your product's sleek lines with a ghastly physical switch, would it be that hard to put a reed switch somewhere along the periphery of the device, so that nobody can flash the firmware unless you first put the Big Honking Update Magnet next to it?
Wouldn't it just be easier to have a dip switch and require cracking the case open to flash the bios? At least then, a switch can detect the case opening and send a signal to something or tick a counter that can be checked every once in a while easily.
A magnet would likely not provide the same level of obviousness. For instance, would you be noticed if you opened the case more easily than if you put a magnet on the side of the case? I know that as a kid, i was able to cut a small square of fridge magnet and combine it with a broken rare earth magnet and place on top of the reed switch for our security alarm so i could sneak out and back in without tripping our alarm system or having the record of my code being entered. Of course i had the benifit of being able to experiment by looking at the alarm pannel until the door read closed while it was open and testing it. But i do not think someone smarter than me with physical access couldn't do something similar with other tools availible. But magnets are common in the office (paperclip holders, speakers, phone parts) and not too dificult to conceal.
.. but you can't make it drink. I am doing IT security for almost 30 years. I've been an advisor to the highest government branches, I have lectured on countless occasions in front of hundreds if not thousands of people. I have developed security software and environments. And all I can say is: Most people simply don't give a damn. Sure - they listen to what one has to say. And they even promise to change or adapt the way they do things. But after just a few days they've forgotten all of it. Because being safe(r) is inconvenient.
People are just not getting it. They don't delete cookies or browser caches (I don't want to have login to facebook all the time) they send even the most personal or confidential data via unsecured email (why would somebody else read this email), they store their whole life or business data on dropbox, Google Drive or comparable services and they sync all of their cell phone content, phone numbers and contact data. It doesn't hurt if someone steals your data. You don't feel it, if a government monitors your every move. And the classic: I ain't got nothing to hide. CEOs told me: The government should be responsible to protect my data - why should I pay for it? Though they spent thousands of dollars on a state of the art security system for their offices - they don't feel it to be necessary to spend money to train their employees or to purchase technology to protect their data.
The Snowden leaks didn't help - quite the opposite happened: People are now saying: There's nothing one can do anyway. What the government wants, the government gets. Why bother to protect the data? Most people actually believe encryption to be worthless because the NSA can hack it anyway. In conclusion: I have stopped to try to convince the general population that they can have a safe(r) digital life. I am supporting those who really want to keep their data protected. So - before starting to worry about BIOS hacks - check the other 99.999% of vulnerabilities that are much easier to exploit. As usual: Just my two cents.