UEFI rootkits - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: July 28, 2022, 06:58:07 pm
content: Discovery of new UEFI rootkit exposes an ugly truth: The attacks are invisible to us (https://arstechnica.com/information-technology/2022/07/researchers-unpack-unkillable-uefi-rootkit-that-survives-os-reinstalls/)

author: Marco
author_rank: Super Contributor
timestamp: July 28, 2022, 07:21:46 pm
content: I want my write protect jumper back.

author: twospoons
author_rank: Frequent Contributor
timestamp: July 28, 2022, 09:48:34 pm
content: Quote from: Marco on July 28, 2022, 07:21:46 pmMe too. Its such a ridiculously simple solution to bios security.

author: MrMobodies
author_rank: Super Contributor
timestamp: July 29, 2022, 06:16:27 am
content: QuoteOh dear.So even if I install an operating system in "non UEFI" mode on a "UEFI" system and someone downloaded and run it, I wonder would it still be able to operate from the firmware despite it not booting from UEFI?.QuoteDoes that mean that older "non UEFI" systems are going to be a bit more safer from this kind of vulnerability?It seems like the same pattern to me where certain features are introduced that are out of the user's control and can end up working against them.

author: Nominal Animal
author_rank: Super Contributor
timestamp: July 29, 2022, 07:36:54 am
content: Quote from: twospoons on July 28, 2022, 09:48:34 pmMe three.Cryptographic signature checking won't fix this, either. Large companies have shown that they just cannot keep the private keys sufficiently private; they always leak, humans being humans.

author: Karel
author_rank: Super Contributor
timestamp: July 29, 2022, 07:42:20 am
content: Rootkit detection is difficult because a rootkit may be able to subvert thesoftware that is intended to find it. Detection methods include using analternative and trusted operating system, behavioral-based methods, signaturescanning, difference scanning, and memory dump analysis. Removal can becomplicated or practically impossible, especially in cases where the rootkitresides in the kernel; reinstallation of the operating system may be the onlyavailable solution to the problem.Operation "Red October" was able to stay under the radar for five years:https://securelist.com/the-red-october-campaign/57647/Antivirus software is now so ineffective at detecting new malware threatsmost enterprises are probably wasting their money buying it, an analysisby security firm Imperva has concluded.http://www.cio.com/article/2390136/antivirus-software/antivirus-software-a-waste-of-money-for-businesses--report-suggests.htmlAntivirus tools are a useless box-ticking exercise says Google security chapAdvocates whitelists and other tools that 'genuinely help' securityhttp://www.theregister.co.uk/2016/11/17/google_hacker_pleads_try_whitelists_not_just_bunk_antivirus_ids/Several Symantec AV products allow an attacker to run arbitrary code under Linux, MacOS and WIndows. Yes, it's really bad. Affected products are Symantec Endpoint Protection Cloud Client, Symantec Endpoint Protection Small Business Enterprise Client, Norton Family, Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security and Norton 360.DoubleAgent: Taking Full Control Over Your Antivirushttp://www.theregister.co.uk/2017/07/31/ai_defeats_antivirus_software/https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/

author: RoGeorge
author_rank: Super Contributor
timestamp: July 29, 2022, 08:22:27 am
content: Quote from: Marco on July 28, 2022, 07:21:46 pmYou can not have a write protect jumper.It almost look like a conspiracy.This was supposed to be a metaphor, but with each year:I don't say it's aliens, but it's aliens.

author: PKTKS
author_rank: Super Contributor
timestamp: July 29, 2022, 08:36:13 am
content: It should be a surprise?UEFI was meant insecureCan boot anything remotely by http..How other way TAG PROPRIETARY SECURE CHIPS would be forced? And paid by usersOld BIOS are order of magnitide safer..Orders...Paul

author: Nominal Animal
author_rank: Super Contributor
timestamp: July 29, 2022, 10:20:12 am
content: Perhaps it is time to throw some love towardscoreboot, then?

author: PKTKS
author_rank: Super Contributor
timestamp: July 29, 2022, 11:53:31 am
content: Quote from: Nominal Animal on July 29, 2022, 10:20:12 amI have few expectations and hopes for the x86 (aka Wintel) platform futureObviously they paved a way to lock every human out there to boot the hardwareandhave workingdrivers(aka firmware blobs) that guarantee their milking machine continue working as intended.. ( fast pace obsolescence .. locked formats of audio video.. license managers... etc)PHORONIX made a simple but realistic posthttps://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1337624-gnome-to-warn-users-if-secure-boot-disabled-preparing-other-firmware-security-helpOnly allowed "partners" playing by thesesecurerules will actually have a working system.Outside that? forget it.. it will be a joke of the very same film they repeat..TPM/IOMU/lcoked signed keys and chips...I am already searching a new safe ground to land...fuck off againPaul

author: Nominal Animal
author_rank: Super Contributor
timestamp: July 29, 2022, 01:43:30 pm
content: Quote from: PKTKS on July 29, 2022, 11:53:31 amWell, coreboot can neutralize Intel Management Engine, andLibreBootin particular has no firmware blobs at all. Seelibreboot FAQandcoreboot motherboard list.But yeah, ARM in particular is in a much better position, wrt. implementations that push their support upstream to mainline Linux, and do not rely on binary blobs. There are surprisingly many of them. (In particular, Mali OpenGL ES hardware support provided by open source Lima (Mali 400 and 450) drivers, or possibly by Panfrost (Mali T6xx/T7xx/T8xx and G3x/G5x/G7x) drivers which may or may not be stable enough for general use yet. Mali 400/450 should work well, though. If I were to think about how to efficiently separate computation and display rendering with a concise compositor/protocol, I'd definitely start by looking at whatOpenGL ES 2.0provides, as that's what Mali 400/450 supports.)I'm worried about ARM's future too, though. The NVidia takeover would have ended ARM open-source support for sure.Risc-V is a bright spark, although it could be subverted by Intel ME/AMD PSP -type implementation. @brucehoult would know a lot more about this.

author: PKTKS
author_rank: Super Contributor
timestamp: July 29, 2022, 03:21:13 pm
content: Quote from: Nominal Animal on July 29, 2022, 01:43:30 pmI am also looking all possible ARM diverted alternatives.. for quite some timeMediaTek is hopeless as they are justconsumerDRM interfaces for now...And the only possible x86 alternative (A...M....D...) has gone complete out of balls ..e.g. there is no ballsy leadership for a long time in amd..They can shift the whole x86 scenario.. with enough balls to compete Wintel**OR**https://www.techpowerup.com/297299/us-congress-passes-the-chips-and-science-actperhaps things will just sink deeper in the same shit... as they arePaul

author: AndyBeez
author_rank: Frequent Contributor
timestamp: July 29, 2022, 05:05:41 pm
content: My reading is the rootkit is on the SPI flash containing the UEFI bootstrapper. So how did it get onto the SPI flash in the first place? Seems more of a state sponsored firmware upgrade in the supply chain, rather than the homework of some random hacksters.

author: PKTKS
author_rank: Super Contributor
timestamp: July 29, 2022, 05:12:32 pm
content: Quote from: AndyBeez on July 29, 2022, 05:05:41 pmThey are F**** forcing everyone to their rules...FORCED firmware upgrade - simple procedure done by the host ..download and reflash the firmware...at their will no longer the user decides...same deceptive argumentSECURITYmatter of fact: older BIOS are orders mag more securePaul

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 29, 2022, 07:21:29 pm
content: Quote from: twospoons on July 28, 2022, 09:48:34 pmThey never meant to make it secure. The goal was to make it "reasonably secure" while allowing third-parties to update your system behind your back, while before, you actually had to take a number of manual steps to do this. Which is already a very questionable goal in itself, but it doesn't take a genius to figure out that if it is at all possible to update your system behind your back, then anybody will eventually be able to.

author: DiTBho
author_rank: Super Contributor
timestamp: July 29, 2022, 09:07:18 pm
content: Quote from: Nominal Animal on July 29, 2022, 01:43:30 pmThat's a great idea!p.s.look at IBM POWER10 and POWER11

author: Mechatrommer
author_rank: Super Contributor
timestamp: July 29, 2022, 10:18:05 pm
content: Quote from: AndyBeez on July 29, 2022, 05:05:41 pmhttps://securelist.com/cosmicstrand-uefi-firmware-rootkit/106973/from the OP's link..Quoteit just happen i'm using Asus H81 MB, so i hope there is a way of knowing if the UEFI is infected or not from an antivirus, so we know when to buy a new motherboard. and hopefully the rootkit wont simply propagate through an app from within Windows/OS.

author: AndyBeez
author_rank: Frequent Contributor
timestamp: July 30, 2022, 09:01:19 am
content: I would be interested to know where those mobos where manufactured. One supply chain 'overlap' for both Asus and Gigabyte is Taiwan; a territory that China has long wanted to annex. But as Qihoo suggests, there may be a bad actor in the retail chain.

author: PKTKS
author_rank: Super Contributor
timestamp: July 30, 2022, 09:24:16 am
content: Will not assume such restric scopeI have a half dozen Biostar mobos which very much alike use the same layout chipset and firmware manufacturer...I doubt of such restrictionsPaul

author: Mechatrommer
author_rank: Super Contributor
timestamp: July 30, 2022, 10:09:32 am
content: Quote from: AndyBeez on July 30, 2022, 09:01:19 ami got my mobo in 2015, if the rootkit came from factory, i'm not sure its effectiveness on newer windows10/11. i did upgrade the firmware some years ago, if the rootkit is embedded in the image file, there must be a way of detecting it... but then, its not my normal joe skill. i'll keep my faith on my avast antivirus... most importantly the rootkit will call home to its C2 server to get its payload, i think we can detect if our PC will try to call that server right? as long as it doesnt touch my personal files, i think i wont worry too much...

author: AndyBeez
author_rank: Frequent Contributor
timestamp: July 30, 2022, 11:22:46 am
content: Quote from: Mechatrommer on July 30, 2022, 10:09:32 amHaving a payload server is always the weakest link; the URI can be blocked or even confiscated by ICANN. It also points a finger at the threat sponsor. This rootkit was deployed as an under the radar attack that assumed no one had the skillset to notice; given the over reliance on anti virus software. And then someone did.I have no idea what the flash hardware is on those mobos -could not decipher a target from H81 mobo images? SPI Soic chip would be nice, as this can be 'clamped' - as per vehicle ECU hacks. So is this a threat? Only if that C2 server is hot.Any of you PC geeks know of a BIOS probe toolkit that can hex dump the flash without opening the case?

author: Mechatrommer
author_rank: Super Contributor
timestamp: July 30, 2022, 12:30:44 pm
content: Quote from: AndyBeez on July 30, 2022, 11:22:46 amand only if they have access to your PC or you click the firmware update from manufacturer through uefi bios utility. i think dumping flash from mobo is not necessary as they can just temper the original bios update image file with their rootkit code. but as the article stated, this is not a normal joe cracker can do it, a slight error in the code can render the mobo unbootable/crash.

author: gamalot
author_rank: Super Contributor
timestamp: July 30, 2022, 12:39:05 pm
content: Quote from: Marco on July 28, 2022, 07:21:46 pmI'm not very familiar with those Flash chips used to store BIOS code, I guess hardware write protection and QPI operation maybe not compatible.

author: Nominal Animal
author_rank: Super Contributor
timestamp: July 30, 2022, 01:39:26 pm
content: Quote from: gamalot on July 30, 2022, 12:39:05 pmThe ones with a parallel interface, e.g. Kioxia TC58B series, still have a separate write protect pin.

author: PKTKS
author_rank: Super Contributor
timestamp: July 31, 2022, 11:32:59 am
content: Quote from: Mechatrommer on July 30, 2022, 12:30:44 pmAFAIK recently hosts (read M MM MM SSS) can do that transparently from the OS unattended and without any sort of required permission.. At their will... (although we all know there is always a nice button and cute thing somewhere telling you they respect ... etc_etall )Paul

author: Njk
author_rank: Frequent Contributor
timestamp: January 12, 2023, 10:58:39 pm
content: Or course UEFI is more vulnerable, simply because it's more standardized. But it's not a technical problem, it's a compliance enforcement problem. On the other hand, it's an open standard so everyone is free to learn it and to test particular UEFI implementation to make sure there are no obvious security holes.Set a password for your bios. That simple measure will (hopefully) implement a physical presence check making it more difficult to compromise your computer.BTW Microsoft is moving in right direction mandating a TPM device on every Win11 mobo.

author: Karel
author_rank: Super Contributor
timestamp: January 13, 2023, 07:22:29 am
content: Quote from: Njk on January 12, 2023, 10:58:39 pmNo, they are not. The only reason for TPM is that they don't want you to be in control of your computer.Ideally (from the viewpoint of tech giants) you can't have a root/admin account anymore likewith android phones and ios devices (ipad, iphone). Soon, without TPM, no netflix, no online banking,no government communication, etc. They say it's for security but they don't care sh*t about security.They care about controlling what you can do with your computer. Period.

author: Njk
author_rank: Frequent Contributor
timestamp: January 13, 2023, 10:51:31 am
content: Well, I'm not going to spark another round of MS-vs-NonMS debate. Frankly, I'm not sure what is better, one big parasite or a billion of small, hungry, agile and therefore more vocal ones. All of them wants your money trying to sell something that you don't actually need. Nobody is perfect but MS is a gold standard for ordinary users. IBM, MS, Intel. Only rebellious teenagers are refusing to say thanks to them (as to anyone).As for TPM, it just provides a mechanism to verity integrity of every system component, from the root of trust (which is CPU) down to an application program. Bios included. The standard is well known and is matured enough, we have the second incarnation of it. And it's in use in the corporate computing environment over a long time. Now MS have decided to extend its usage to all users. For sure, TPM is not the only possible arrangement. The ARM world uses a different approach, but the PC world is much older so it's more difficult to implement a new thing without the risk of impacting backward compatibility.Of course, no technology provides an absolute protection, it's always a cat and mouse game. And again, the problem is not in the technology. MS is big enough to actually enforce the usage. Any enforcement creates the risk of abuse. But that's the price. And we have no monopoly anyway.

author: madires
author_rank: Super Contributor
timestamp: January 13, 2023, 12:01:23 pm
content: Please don't forget that TPM comes with its own security issues. Let's try to fix a security issue by introducing new ones.

author: Njk
author_rank: Frequent Contributor
timestamp: January 13, 2023, 12:20:57 pm
content: It's a routine task to fix something (e.g. the Infineon TPM issue). What's more important is to maintain a policy.

author: Karel
author_rank: Super Contributor
timestamp: January 13, 2023, 12:21:26 pm
content: Quote from: Njk on January 13, 2023, 10:51:31 amNot just that. It provides a means to securely identify a computer which can and will be used by third parties for "security" reasons.For example, software licences can be connected to a system much more secure using the TPM.Software can check if your system is "trusted" (for whatever that means). I would be surprised if this is not going to be used to effectively cancel out opensource softwareand opensource operating systems. There's already something similar going on with widevine from google. It's why you can't watch netflix on a raspberry & Linux for example.It's the wet dream for digital rights management.

author: Njk
author_rank: Frequent Contributor
timestamp: January 13, 2023, 01:45:50 pm
content: Agree it has some unpleasant implications. But:1. Internet security is a growing problem that needs to be addressed. I'm not sure how it can be done without a reliable method of device identification.2. There are many interested parties and it'll take a time for them to really start using the TPM to their advantages. Definitely it will not happen simultaneously.3. Technically, it's possible to migrate almost all information (except the root keys but that keys are not used directly anyway) from one TPM to another for backup purposes.4. It's not clear on what legal ground it can be used against the OSS community.BTW I think it's not convenient to watch Netflix etc. on the computer screen.

author: Karel
author_rank: Super Contributor
timestamp: January 13, 2023, 02:28:56 pm
content: Quote from: Njk on January 13, 2023, 01:45:50 pmIt cannot be addressed. At least not completely. Accepting that and using alternatives is the first step in not using TPM.And for sure, taking away control of somebodyelses computer is not the way to do that. But security is a fake argument, tech giants want to be in control for other motives.QuoteI don't care. It will happen sooner or later.QuoteIt's not in the advantage of the enduser.QuoteIt can be used to make it difficult to install alternative operating systems.Some apps don't work if you rooted your device.QuoteBecause you think it's not convenient it's less important for others? A lot of people watch streaming video on a portable device.Anyway, the Raspberry Pi I used as an example runs Libreelec/Kodi software in order to act as a multimedia player and it's connected to a normal TV.

author: Njk
author_rank: Frequent Contributor
timestamp: January 14, 2023, 03:20:32 am
content: Quote from: Karel on January 13, 2023, 02:28:56 pmTech giants, in theory, can be repelled legally. As for the swarm of a not so smart fraudsters, the only way to stop them is to set up a reasonably strong technical obstacles. Did you ever received a funny e-mails saying that you're hacked, all your sensitive data are stolen and you've to pay now, otherwise... Looks like the guys don't understanding what's this all about but have learned from the other losers about the magic words that can bring fast cash. Internet is very popular now.QuoteIf it's a banking app, maybe that's not so bad. Have you ever asked to show your ID at the supermarket?QuoteThere is no TPM on any RPi, AFAIK. And that boards are created as an eval /edu platforms. Because of that, security hardening is not enforced. If one wants to use them for a gray business, that's OK, but he's on his own. A lot of ways, as we know.Once I designed a USB device with the thumb drive functionality so the app was installing automatically when the device has plugged in. Soon after MS disabled that capability, at least for the ordinary thumb drives. No problem, because the reason was strong indeed.

author: Karel
author_rank: Super Contributor
timestamp: January 14, 2023, 07:58:58 am
content: Quote from: Njk on January 14, 2023, 03:20:32 amThat doesn't justify the use of TPM. It's the same lame excuse as "we do it to fight terrorism and childpr0n"...Again, it's not about security. It's about being in control in order to make money.QuoteQuote from: NjkIt is when banks start to not offer any alternatives anymore. That effectively means I'm obliged to buy a smartphonecontrolled by a tech giant which is controlled by shareholders in order to get access to my bank account.Fortunately I found a bank who was willing to sell me a physical token which I can use to access my account withoutthe need for some "app". But I fear the day will come that no bank will offer that possibility anymore.QuoteQuote from: NjkSecurity hardening is important for the owner of the device. So the computer owner must be in control of all partsof the hardware including any TPM. Actually, the TPM is designed to give control of your computer to a third party,that's the probem.Quote from: NjkFortunately there's Linux so people who don't like that behaviour can use an alternative.As long as if there's real choice and competion, there's usually no problem.Problems start to appear when there's a lack of choice and almost no competition like with smartphones.There's only android and ios and neither of them give you full access to all the parts of your device and neitherof them let you create a root/admin account so that you can be in control.