Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

securelist.com

Post reply on HN
Print view View original

51–60 of 125 posts

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#51

Post by undersuit »

Harvesterify wrote: post #4
ggm wrote: post #3

I live in fear of being told my factory delivered Dell rackable servers have been EFI infected since inception on my network. It's silly to pretend a BSD OS is going to be immune of the consequences of an EFI which is compromised at birth. Sooner or later there will be a value chain in compromising my OS, through the EFI. I wish we had better out of band EFI validity checks, based on what the manufacturer thinks shou…

You can use the Dell Trusted Agent to to do just that: https://www.dell.com/support/kbdoc/en-us/000126098/what-is-d...

While there seems to be verification off the device how do we know the EFI attack isn't aware of this agent and presenting it with legitimate data for it to process while still remaining hidden?

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#52

Post by eikenberry »

fguerraz wrote: post #7

That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…

As long it is implemented so the end user has complete control of the system in one way or another then these things are great ideas. Hard to think of how they'd do that given they seem designed more for central control than security, but if they did it'd be interesting to see what developers could do with it.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#54

Post by [deleted] »

fguerraz wrote: post #7

That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…

[deleted]

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#55

Post by hgazx »

hulitu wrote: post #48
ActorNightly wrote: post #36

Earlier quoted context omitted.

Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#56

Post by hrgiger »

stinkass wrote: post #29

Hah, this reminds of a security researcher a few years ago that was reporting malware that he couldn't research without infecting his other machines. I'm fuzzy on the details, but everyone wrote him off as a paranoid delusional and the incident was quickly swept under the rug. Makes me wonder if he found some sophisticated state sponsored stuff and got smeared to hush it up. I mean realistically, we'd be naive to not…

Shutting down everything because of paranoia sounds a bit extreme

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#57

Post by fezfight »

blueflow wrote: post #53

I remember being called a reactionary naysayer like, 8 years ago, because i told that this would happen.

A lot of people don't like negativity so strongly that they'd rather be screwed over than have to consider the possibility that something bad is happening.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#58

Post by blueflow »

fezfight wrote: post #57
blueflow wrote: post #53

I remember being called a reactionary naysayer like, 8 years ago, because i told that this would happen.

A lot of people don't like negativity so strongly that they'd rather be screwed over than have to consider the possibility that something bad is happening.

A lot of people don't like idealism so strongly that they'd rather stick with old hardware over the newest hyped-to-death shit.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#59

Post by colinsane »

mistrial9 wrote: post #20
robotnikman wrote: post #11

Such sophisticated attacks always amaze me, and I've always wondered how people go about developing them in the first place.

someone who worked on the UEFI implementation writes it

if you were handed the UEFI implementation codebase like a new-hire, how long would it take to figure out this potential codepath? a couple days?

now if you were handed only the binaries, and left to objdump them etc, how long? evidently there’s symbol names since the article uses those. so hopefully no more than an extra order of magnitude: a couple weeks, maybe a full month if my manager’s asking for a deadline and i want to be conservative?

also, think about where/how they hooked: it sounds like they hooked at the equivalent of an interface boundary, where it’s easiest to inject a new implementation — but then they have to check the return address to know where in the larger scope of the process they’re currently at: if you had access to the codebase and build tools why wouldn’t you patch your exploit into the code more directly and just rebuild it? why abuse the return address like that?

i don’t mean to say it’s not impressive, but it’s not magic. there are lots of competent engineers out there capable of reverse engineering a UEFI implementation.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#60

Post by fezfight »

blueflow wrote: post #58
fezfight wrote: post #57

Earlier quoted context omitted.

A lot of people don't like negativity so strongly that they'd rather be screwed over than have to consider the possibility that something bad is happening.

A lot of people don't like idealism so strongly that they'd rather stick with old hardware over the newest hyped-to-death shit.

Just in case it isn't clear, I wouldn't have called you reactionary or paranoid back then because I would have agreed with you. Its just sad that others choose not to open their eyes.
Post reply on HN