Slashdot Mirror
First-Ever UEFI Rootkit Tied To Sednit APT (threatpost.com)
Researchers hunting cyber-espionage group Sednit (an APT also known as Sofacy, Fancy Bear and APT28) say they have discovered the first-ever instance of a rootkit targeting the Windows Unified Extensible Firmware Interface (UEFI) in successful attacks.
From a report: The discussion of Sednit was part of the 35C3 conference, and a session given by Frederic Vachon, a malware researcher at ESET who published a technical write-up on his findings earlier this fall [PDF]. During his session, Vachon said that finding a rootkit targeting a system's UEFI is significant, given that rootkit malware programs can survive on the motherboard's flash memory, giving it both persistence and stealth.
"UEFI rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise systems at this level," he said. The rootkit is named LoJax. The name is a nod to the underlying code, which is a modified version of Absolute Software's LoJack recovery software for laptops. The purpose of the legitimate LoJack software is to help victims of a stolen laptop be able to access their PC without tipping off the bad guys who stole it. It hides on a system's UEFI and stealthily beacons its whereabouts back to the owner for possible physical recovery of the laptop.
"UEFI rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise systems at this level," he said. The rootkit is named LoJax. The name is a nod to the underlying code, which is a modified version of Absolute Software's LoJack recovery software for laptops. The purpose of the legitimate LoJack software is to help victims of a stolen laptop be able to access their PC without tipping off the bad guys who stole it. It hides on a system's UEFI and stealthily beacons its whereabouts back to the owner for possible physical recovery of the laptop.
Still have to have that human interaction with a click.
How long until this can be pushed down direct from a website?
Domestic spying is now "Benign Information Gathering"
Yea, a definition would be quite apt here: Advanced Persistent Threat. (per wikipedia APT)
Whatever happened to requiring the insertion of a jumper on the motherboard to update the BIOS? That would stop this thing in its tracks.
I am really tired of everything new being broken. We do know how to do this better. Why are these severe mistakes still being made?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Anyone with a working brain can see that non-removable persistent storage on the mainboard, that can be written from inside a running OS and only be inspected under the control of the software in that storage, is an extraordinarily stupid mistake. Then there are a variety of "management" systems (SMM, IME, ...) which also evade inspection and have full access to everything. The most trustworthy computers these days are small embedded processors (but not phones!). Desktop systems and laptops can practically not be secured. If there is a possibility of a hack, there is no reliable way to restore the system to a safe state.
Don't worry. AI and autonomous driving and quantum computing are right around the corner. That will fix all these issues.
So UEFI allows persistent code to exist in it from a 3rd party for example these laptop security/tracking apps? Who didn't think this would eventually be abused by malware or some 3 letter agency?
What's even better than the malware back in the day that would attempt to modify known BIOS code, or maybe brick a BIOS it didn't know? A known documented API into UEFI that allows for "sanctioned" persistent code! yay!
UEFI and IME sounds like a 3 letter agencies wet dream.
Money. To a lot of companies, the top brass feels that security gives zero return to them, so they skimp as much as possible on it. In fact, the faster they can rush a product out the door, no matter how many odious show-stopping bugs, the better.
I wish we had something like Underwriter's Laboratories, except for computer product security, and security in the correct ways, as most companies only focus on security against the intended user, so a broken device can't be reflashed with custom firmware and made useful again. Or perhaps, take that one step further and go with a Sold Secure like system, where products are white-box tested, black box tested, source code is audited, chip supplies are audited, and so on. Of course, the downside here is regulatory capture, but if this is a multinational organization with people who are not beholden to one country, this could be an acceptable solution.
Until this, or some regulatory system is in place, these compromises will only happen more often, as one attack based on UEFI allows others to happen, and we have only seen the start persistant threats. Things like ransomware that quietly encrypts files via a transparant driver, so even backups have the files encrypted, then a certain date elapses, and the decryption keys are chucked, all drives are ATA locked and the machine puts up a message demanding whatever currency is in fashion (Bitcoins, e-Gold, etc.)
Because software teams only fix critical and important bugs. They have tons of bugs left in their bug tracker, and some of them happen to be security bugs.
"First they came for the slanderers and i said nothing."
By enabling Secure Boot, and making sure their UEFI firmware is up to date, end users can protect themselves against attack, Vachon said.
This rootkit is *NOT* a bypass of secure boot. If UEFI Secure Boot is enabled, unsigned UEFI modules cannot be installed into the UEFI firmware configuration.
We've seen BIOS rootkits before. This is just an UEFI version of the same concept, except UEFI Secure Boot does exactly what it is supposed to do: Prevent unauthorized updating of the firmware.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
is available, like most of the talks for 35c3, on media.ccc.de: https://media.ccc.de/v/35c3-95...
A jumper on the board would do that, and restrict upgrades to people who know at least the basics of hardware maintenance.
The firmware is right at the root of your trusted computing base. If you require opening up the case and moving a jumper in every machine to push out an update, then most people are never going to do it. This means that, if there's a security vulnerability then it will never be patched for 95% of users. Given that BIOS vendors are responsible for some of the worst code in production, which is often able to be attacked over the network or via USB, do you really think that this would improve security?
I am TheRaven on Soylent News
Actually things are much, much better than they used to be.
This attack requires the user to first compromise the OS in order to attack the UEFI firmware, so they need multiple unpatched vulnerabilities. Realistically that means either tricking the user into running some malware or getting through the web browser, the web browser's sandbox, the OS sandbox, the OS user level protections, the OS kernel security protections and finally attacking the particular UEFI implementation being used.
Compare to back in the 90s when everyone ran Internet Explorer as admin and code running in the browser itself could effortlessly install a rootkit. The filesystem was FAT32, it didn't even have access controls.
These days exploits tend not to be nearly as serious because we have so many layers of defences. That's one reason attacks have changed in nature, focusing on things like the CPU itself or on stealing information rather than trying to take control of the system.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC