Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

securelist.com

Post reply on HN
Print view View original

81–90 of 125 posts

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#81

Post by zekica »

Arnavion wrote: post #69
tepitoperrito wrote: post #31

Furious searches for BIOS only era hardware are taking place on ebay as we speak. To use with a modified Linux kernel that emulates a bog standard Thinkpad uefi environment of course. EDIT: I forgot to phrase this as a question - besides missing a QubesOS or KickSecure on top, is this a decent plan for airgapped stuff?

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel. UEFI can be emulated on top of BIOS using something like Clover…

UEFI Secure Boot doesn't completely protect against physical attacks. If a person can turn off and turn on the computer, they can replace the currently active UEFI bootloader with a shim app, enroll their own key. They can then run any UEFI binary, that binary can then do whatever, and at the end remove the SHIM NVRAM variable that it used, finally loading the original OS bootloader and removing all traces.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#82

Post by Arnavion »

zekica wrote: post #81
Arnavion wrote: post #69

Earlier quoted context omitted.

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel. UEFI can be emulated on top of BIOS using something like Clover…

UEFI Secure Boot doesn't completely protect against physical attacks. If a person can turn off and turn on the computer, they can replace the currently active UEFI bootloader with a shim app, enroll their own key. They can then run any UEFI binary, that binary can then do whatever, and at the end remove the SHIM NVRAM variable that it used, finally loading the original OS bootloader and removing all traces.

>UEFI Secure Boot doesn't completely protect against physical attacks.

I didn't say it did. In fact I formulated what I wrote precisely to convey the opposite message.

>they can replace the currently active UEFI bootloader with a shim app, enroll their own key.

UEFI can be protected by a password if the implementation supports it. How secure that is is of course up to the implementation.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#83

Post by sitzkrieg »

justsomehnguy wrote: post #41
tepitoperrito wrote: post #31

Furious searches for BIOS only era hardware are taking place on ebay as we speak. To use with a modified Linux kernel that emulates a bog standard Thinkpad uefi environment of course. EDIT: I forgot to phrase this as a question - besides missing a QubesOS or KickSecure on top, is this a decent plan for airgapped stuff?

Just run your OS in a VM.

what should you run the vm on?

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#84

Post by [deleted] »

denton-scratch wrote: post #21

> One of our industry partners, Qihoo360, Ooh, I recognise that name. They were involved in certificate shenanigans with Startcom. I'm immediately suspicious. (I've barely started reading the article, but I'm predisposed to distrust anything involved with Qihoo)

[deleted]

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#85

Post by numpad0 »

stinkass wrote: post #29

Hah, this reminds of a security researcher a few years ago that was reporting malware that he couldn't research without infecting his other machines. I'm fuzzy on the details, but everyone wrote him off as a paranoid delusional and the incident was quickly swept under the rug. Makes me wonder if he found some sophisticated state sponsored stuff and got smeared to hush it up. I mean realistically, we'd be naive to not…

I had that kind of megalomaniac fantasy in the past, but the started to think that xkcd.com/2347 (“random person in Nebraska”) should apply to NSA malware too, and there can’t be as much tons of people working on it as in my imagination.

Though I’d happily cooperate if me watching team did exist and came out of shadows to clarify their doubts and pass along the taxpayer money saved :)

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#86

Post by dboreham »

hrgiger wrote: post #56
stinkass wrote: post #29

Hah, this reminds of a security researcher a few years ago that was reporting malware that he couldn't research without infecting his other machines. I'm fuzzy on the details, but everyone wrote him off as a paranoid delusional and the incident was quickly swept under the rug. Makes me wonder if he found some sophisticated state sponsored stuff and got smeared to hush it up. I mean realistically, we'd be naive to not…

Shutting down everything because of paranoia sounds a bit extreme

Eventually it electrifies its power cord so that if you try to power it off you get zapped.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#88

Post by robotnikman »

mistrial9 wrote: post #20
robotnikman wrote: post #11

Such sophisticated attacks always amaze me, and I've always wondered how people go about developing them in the first place.

someone who worked on the UEFI implementation writes it

That was one theory I had in mind. My guess is the organization developing these exploits form teams of people focusing on a single exploit, with each person on the team having deep domain knowledge in a single subject (UEFI, Windows Kernel, etc), and they use that knowledge to develop their portion of the exploit chain.

People who developed such specifications in the first place, like UEFI, would be great candidates for an organization looking for someone with deep knowledge of the subject.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#89

Post by lmm »

Arnavion wrote: post #69
tepitoperrito wrote: post #31

Furious searches for BIOS only era hardware are taking place on ebay as we speak. To use with a modified Linux kernel that emulates a bog standard Thinkpad uefi environment of course. EDIT: I forgot to phrase this as a question - besides missing a QubesOS or KickSecure on top, is this a decent plan for airgapped stuff?

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel. UEFI can be emulated on top of BIOS using something like Clover…

Presumably the point is to run something that assumes/relies on UEFI (an OS or application) without having to run and trust the giant blob of low-quality code that is a typical hardware UEFI implementation.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#90

Post by malartic »

hulitu wrote: post #48
ActorNightly wrote: post #36

Earlier quoted context omitted.

Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

Here it start from a modified motherboard firmware, stored on a chip on the board, NOT a normal partition. Harder to infect at first, but way more persistent, surviving even disks changes.
Post reply on HN