Slashdot Mirror
First-Ever UEFI Rootkit Tied To Sednit APT (threatpost.com)
Researchers hunting cyber-espionage group Sednit (an APT also known as Sofacy, Fancy Bear and APT28) say they have discovered the first-ever instance of a rootkit targeting the Windows Unified Extensible Firmware Interface (UEFI) in successful attacks.
From a report: The discussion of Sednit was part of the 35C3 conference, and a session given by Frederic Vachon, a malware researcher at ESET who published a technical write-up on his findings earlier this fall [PDF]. During his session, Vachon said that finding a rootkit targeting a system's UEFI is significant, given that rootkit malware programs can survive on the motherboard's flash memory, giving it both persistence and stealth.
"UEFI rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise systems at this level," he said. The rootkit is named LoJax. The name is a nod to the underlying code, which is a modified version of Absolute Software's LoJack recovery software for laptops. The purpose of the legitimate LoJack software is to help victims of a stolen laptop be able to access their PC without tipping off the bad guys who stole it. It hides on a system's UEFI and stealthily beacons its whereabouts back to the owner for possible physical recovery of the laptop.
"UEFI rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise systems at this level," he said. The rootkit is named LoJax. The name is a nod to the underlying code, which is a modified version of Absolute Software's LoJack recovery software for laptops. The purpose of the legitimate LoJack software is to help victims of a stolen laptop be able to access their PC without tipping off the bad guys who stole it. It hides on a system's UEFI and stealthily beacons its whereabouts back to the owner for possible physical recovery of the laptop.
Bringing you September's news, today!
Still have to have that human interaction with a click.
How long until this can be pushed down direct from a website?
Domestic spying is now "Benign Information Gathering"
What is an "APT" in this context? Even the original article doesn't explain it. Does nobody think about proper editing any more?
UEFI isn't a rootkit immuniser. Funny, that.
Just one more reason that UEFI is a BAD BAD IDEA!!!!!!!!!!
It has extra-super-secure technology. Why do people keep deifying that company? They're in it for the money; they're just more transparent about it. If you want their junk buy it, be happy, and move on. But stop the genuflecting already.
Lojack got jacked by jackoffs so they can hijack you from the back without even using JTAG.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
I wonder why my computer wanted to update UEFI when i rebooted it today...hm
Whatever happened to requiring the insertion of a jumper on the motherboard to update the BIOS? That would stop this thing in its tracks.
I am really tired of everything new being broken. We do know how to do this better. Why are these severe mistakes still being made?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Anyone with a working brain can see that non-removable persistent storage on the mainboard, that can be written from inside a running OS and only be inspected under the control of the software in that storage, is an extraordinarily stupid mistake. Then there are a variety of "management" systems (SMM, IME, ...) which also evade inspection and have full access to everything. The most trustworthy computers these days are small embedded processors (but not phones!). Desktop systems and laptops can practically not be secured. If there is a possibility of a hack, there is no reliable way to restore the system to a safe state.
Why aren't manufacturers being sued for criminal negligence?
Don't worry. AI and autonomous driving and quantum computing are right around the corner. That will fix all these issues.
Don't worry. AI and autonomous driving and quantum computing are right around the corner. That will fix all these issues.
No, because then the malware writers will 3D print their virus!
I don't think it's a matter of not knowing how...I think other forces are at play in making some of these mistakes. Just IMO, but I've done my time in this game. And it's not so simple a function as to be a short drop-down list unless you just want to put an entry on it like "human nature" or "I've got kids to feed" or "it looks good for the next quarter" - which explain little other than that humans do dumb technical things for dumb human motivations that prioritize other than getting it really right technically.
Why guess when you can know? Measure!
Thank you thank you thank you 110010001000 as I certainly realize you are being facetious. Good to know I'm not the only one recognizing the generally ignored via Tunnel vision AI experts of the dangers of AI tech
Because NEW is seen as a virtue in itself. Rather than just make a needed improvement to old, we throw away the years of debugging and testing and jump into making something NEW. Often the argument is that the NEW can be much simpler. Alas, then a zillion corner cases pop up that explain well why OLD was as complex as it was. But now we have NEW, so OLD must go!
So here we are with NEW and decades less debugging and testing behind it, no discernible benefit over OLD, and bugs are coming out of the wood work.
Don't get me wrong, new has it's place, just not in fundamental code that everything else depends on.
From my POV and experience, the tech industry is slowly crashing as the fails are increasing in numbers. And like cooking a frog, turning up teh heat slowley, so the tech industry is like the frog cooking itself.
It is true. Demand legacy software support. Go stable, go old.
The frog stuff is a weird myth, not a real thing.
We are in deep sht because of greedy giant companies. M$ and intel designed this UEFI to be a pain in case u wanted to install Linux. Same with systemd, thanks to Red Hat and its minion who built systemd.
Since there is no such thing is the Linux kernel. And there never will be.
Also, it’s Digital RESTRICTION Management anyway. ;)
So UEFI allows persistent code to exist in it from a 3rd party for example these laptop security/tracking apps? Who didn't think this would eventually be abused by malware or some 3 letter agency?
What's even better than the malware back in the day that would attempt to modify known BIOS code, or maybe brick a BIOS it didn't know? A known documented API into UEFI that allows for "sanctioned" persistent code! yay!
UEFI and IME sounds like a 3 letter agencies wet dream.
Money. To a lot of companies, the top brass feels that security gives zero return to them, so they skimp as much as possible on it. In fact, the faster they can rush a product out the door, no matter how many odious show-stopping bugs, the better.
I wish we had something like Underwriter's Laboratories, except for computer product security, and security in the correct ways, as most companies only focus on security against the intended user, so a broken device can't be reflashed with custom firmware and made useful again. Or perhaps, take that one step further and go with a Sold Secure like system, where products are white-box tested, black box tested, source code is audited, chip supplies are audited, and so on. Of course, the downside here is regulatory capture, but if this is a multinational organization with people who are not beholden to one country, this could be an acceptable solution.
Until this, or some regulatory system is in place, these compromises will only happen more often, as one attack based on UEFI allows others to happen, and we have only seen the start persistant threats. Things like ransomware that quietly encrypts files via a transparant driver, so even backups have the files encrypted, then a certain date elapses, and the decryption keys are chucked, all drives are ATA locked and the machine puts up a message demanding whatever currency is in fashion (Bitcoins, e-Gold, etc.)
Thank you thank you thank you 110010001000 as I certainly realize you are being facetious. Good to know I'm not the only one recognizing the generally ignored via Tunnel vision AI experts of the dangers of AI tech
The dangers of AI tech are the same as the dangers of "trusting the computer". ML algorithms all have an error rate. That's part of the package. The problem is that humans don't seem to understand this. This is fixable just as people now understand that the DB might have been updated incorrectly and there might be a mistake that can be investigated.
"Those that start by burning books, will end by burning men."
Of course, silly me -- UEFI was never about protecting people's OSes from viruses, as originally claimed -- it was about enabling big vendors like Microsoft to be gatekeepers of what OSes we can install on *our* hardware; and adding lots of yummy complexity in which to hide backdoors for spooks.
"... Because we need everything to be new & better & faster with "more connections" so we can keep collecting fees for the new exciting version xyz.12b23 and keep our income coming in ... "
It is a crock. We don't need more than a few standard features to run business.
Ever heard of the Rube Golberg OS, aka Windows?
Assuming this is null in void on a UEFI equipped computer running a windows vm in a hypervisor ? Seems a bad a idea to run anything outside of a sandboxed VM now a days.
Why? Listen to the Rolling Stones/Marianne Faithful "As tears go by" and then you'll know.
Why do you believe there are any "mistakes" and the system is not working entirely as designed?
Because software teams only fix critical and important bugs. They have tons of bugs left in their bug tracker, and some of them happen to be security bugs.
"First they came for the slanderers and i said nothing."
Why do you think they are negligent? Just because *YOU* do not like the design does not mean that the design is negligent, only that YOU do not agree with it. Thus the problem is entirely and completely YOUR NEGLIGENCE in failing to understand the intended operation.
One man's fish is another man's poison.
One man's fish is another man's poison.
You misspelled "poisson".
Secure Boot allegedly prevents infection from Lojax. Most OEM systems ship with Secure Boot active, so the vast majority of Windows UEFI machines are not vulnerable. Users generally don't know enough to disable Secure Boot on their own. The current attack vector is in the form of Windows malware. If you are using a Linux distro that does not have keys for Secure Boot, you still can't get it (yet) since the observed attack vendor will not function in your OS environment.
There may be a Linux version of Lojax out there by now. The article does not discuss that possibility.
$1.2 billion got approved for quantum computers in those budgets that Trump won't sign.....
I doubt we'll ever see the back of "Entanglement teleportation across space and time" given how much money is invested to propagate that lie.
One thing to have a bug, another to be invested in pretending the bug is a feature! Especially now IBM is in on the fraud.
Granted, a factory reset would make things like Computrace impossible, but it will mean you can be confident you are back in a known good state.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I am really tired of everything new being broken. We do know how to do this better. Why are these severe mistakes still being made?
They're not severe mistakes. They're severe INTENTIONAL mistakes.
By enabling Secure Boot, and making sure their UEFI firmware is up to date, end users can protect themselves against attack, Vachon said.
This rootkit is *NOT* a bypass of secure boot. If UEFI Secure Boot is enabled, unsigned UEFI modules cannot be installed into the UEFI firmware configuration.
We've seen BIOS rootkits before. This is just an UEFI version of the same concept, except UEFI Secure Boot does exactly what it is supposed to do: Prevent unauthorized updating of the firmware.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
It actually has a basis in fact - the "experiment" was conducted - but people tend to use the analogy in the context of the frog getting boiled. In fact, the frog will actually jump out of the water once it becomes too warm for the frog, so the correct usage would be to either describe the scenario and posit a "what you you do?" type scenario, or make the actual outcome clear with the implication that even a frog is smart enough to get out of the water.
UNIX? They're not even circumcised! Savages!
Well, autonomous driving may be real and fix it. If I get run over, I do not have to deal with this crap anymore!
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
is available, like most of the talks for 35c3, on media.ccc.de: https://media.ccc.de/v/35c3-95...
windows lock in is not what we need or apple storage lock in where you pay a lot more then other systems to have the storage locked to the MB.
if so, where can i find it on github...or can you point me to the nearest free walmart gift card site?
Actually things are much, much better than they used to be.
This attack requires the user to first compromise the OS in order to attack the UEFI firmware, so they need multiple unpatched vulnerabilities. Realistically that means either tricking the user into running some malware or getting through the web browser, the web browser's sandbox, the OS sandbox, the OS user level protections, the OS kernel security protections and finally attacking the particular UEFI implementation being used.
Compare to back in the 90s when everyone ran Internet Explorer as admin and code running in the browser itself could effortlessly install a rootkit. The filesystem was FAT32, it didn't even have access controls.
These days exploits tend not to be nearly as serious because we have so many layers of defences. That's one reason attacks have changed in nature, focusing on things like the CPU itself or on stealing information rather than trying to take control of the system.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Not mistakes - surveillance.
The idiots amongst the national security management STILL don't get that there is no such thing as a backdoor for the good guys only.
You're right. Someone may find it very helpful for UEFI to hold malware. Myself? Not so much.
0.0.0.0 secao.org
0.0.0.0 ikmtrust.com
0.0.0.0 sysanalyticweb.com
0.0.0.0 lxwo.org
0.0.0.0 jflynci.com
0.0.0.0 remotepx.net
0.0.0.0 rdsnets.com
0.0.0.0 rpcnetconnect.com
0.0.0.0 webstp.com
0.0.0.0 elaxo.org
FROM https://www.welivesecurity.com...
* Block those in your hosts file to NULLIFY this threat...
APK
P.S.=> For the best hosts file:
APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between chars & download)
APK Hosts File Engine 10++ SR-1 32/64-bit for Windows https://hosts-file.net/?s=Down... (DL link @ bottom)
Soon for MacOS too (I just got a NEW Mac-Mini to port it there too)... apk
The frog stuff is a weird myth, not a real thing.
That the story you're repeating claims to be based on something real is part of the myth, as with most myths.
The frog stuff is a weird myth, not a real thing.