71–80 of 125 posts
Earlier quoted context omitted.
Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.
What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.
Earlier quoted context omitted.
someone who worked on the UEFI implementation writes it
hooking into win32 kernel is not something uefi developers usually do
Also the article says it clearly that the uefi rootkit is searching and replacing functions within the kernel and then putting them back once the next phase is complete, in order to avoid security check.
Hooking in windows is a technique allowed by the OS, while this "hooking" is nothing more than just simple search/replace file operation. That's being taught like in 1st month on any coding school.
Earlier quoted context omitted.
What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.
Normal home users are administrators, they have to go through the pop-up to run things with escalated privileges but that, according to Microsoft, is not a security boundary.
> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that…
You know what'll help? Pluton. The future of computing is a signed code path from power on to end-user application code with multiple layers of sandboxing in between. With so many hostile actors, from script kiddies to government agencies out there, "general purpose computing" (which, from a security standpoint, is just arbitrary code execution) just isn't viable anymore. We need provable attestation that no layer of…
Like Microsoft? And like government actors compelling Microsoft via things like NSL’s?
Earlier quoted context omitted.
> Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. Were there? I couldn't find anything, but then again Google is garbage nowadays if you want to find older stuff. To my understanding, the limitations of the old BIOS world would've made it much harder to hack on it other than maybe enabling hidden menus. The UEFI world is so much larger, more powerful and already offers plenty of…
A buddy of mine installed some crapware he downloaded off of a warez site back in the mid-2000's which reflashed his BIOS to a very hackers-esque bootsplash that prevented boot. Fortunately, he had a Gigabyte board which ran a dual-BIOS config, so he was one jumper change away from getting back to his system and cleaning stuff up. I'm not sure it was ever intended to do anything more than punish someone, but the capa…
Earlier quoted context omitted.
"I'm sorry but your computer is not running Genuine Windows 11:tm:. You may not be secure." will be the new "An application is attempting to make changes to your computer..." Alert fatigue is real.
Alert fatigue is real but silent rootkits are way worse. Also, it's not just about booting windows or the OS, it's about the UEFI, which even fewer people are going to want to tinker with.
Earlier quoted context omitted.
The problem with pluton is not the tech. It's that: - it's proprietary - it's controlled by entities that have a terrible track record - it's going to be, as usual, forced upon everybody without consent
I have argued the same as you, it needs to be open source to fix the first two points. For the third one, nobody is forcing you to buy a specific product, but yes, it will be hard to avoid. But like for vaccines, individual consent is at odds with the greater good. Society needs computing that it can trust. Maybe the solution is a healthier hobbyist market where you can buy "use at your own risk" unlocked computers?…
Then it shouldn't mess with trust. Closed source tricks is not trust. And MS lost its credibility long ago. Every closed system on a computer inspires distrust.
My hopes of large volume fully open source systems died when I learned that beefy RISC V boards will ship with UEFI.
> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that…
I live in fear of being told my factory delivered Dell rackable servers have been EFI infected since inception on my network. It's silly to pretend a BSD OS is going to be immune of the consequences of an EFI which is compromised at birth. Sooner or later there will be a value chain in compromising my OS, through the EFI. I wish we had better out of band EFI validity checks, based on what the manufacturer thinks shou…
It would also help if there was a standard header on the mainboard that you can use to verify all of the flash chips when the computer is powered off to minimize the amount of the computer you have to trust. While some may argue that this header would be the perfect place to install a implant, doing so is vastly harder than popping some manufacturers computer. Also, since the header will be specifically checked by so…