Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

securelist.com

Post reply on HN
Print view View original

91–100 of 125 posts

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#91

Post by Arnavion »

lmm wrote: post #89
Arnavion wrote: post #69

Earlier quoted context omitted.

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel. UEFI can be emulated on top of BIOS using something like Clover…

Presumably the point is to run something that assumes/relies on UEFI (an OS or application) without having to run and trust the giant blob of low-quality code that is a typical hardware UEFI implementation.

Sure, but we know that the OS they're asking about is Linux, and none of the major Linux distros require UEFI to boot.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#92

Post by lmm »

Arnavion wrote: post #91
lmm wrote: post #89

Earlier quoted context omitted.

Presumably the point is to run something that assumes/relies on UEFI (an OS or application) without having to run and trust the giant blob of low-quality code that is a typical hardware UEFI implementation.

Sure, but we know that the OS they're asking about is Linux, and none of the major Linux distros require UEFI to boot.

I understood them to be talking about using Linux as the hypervisor that would emulate a UEFI environment, the guest OS might be something different.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#94

Post by extrapickles »

yjftsjthsd-h wrote: post #80
extrapickles wrote: post #30

Earlier quoted context omitted.

It would also help if there was a standard header on the mainboard that you can use to verify all of the flash chips when the computer is powered off to minimize the amount of the computer you have to trust. While some may argue that this header would be the perfect place to install a implant, doing so is vastly harder than popping some manufacturers computer. Also, since the header will be specifically checked by so…

I think it would be easier to do it safely if you made it so that the number of chips to be flashed was small and they were easy to pop on and off the motherboard. I grant that this is more work to use than a single master connector, but it removes that point of vulnerability both for undermining the ability to flash things and the massive backdoor that is a single port with the ability to reimage every chip in the m…

Ideally the write enable line of the flash chips would be hooked up to their respective application processors, so when you are reading them via this header they will be read-only as the processor would still be powered down. For an adversary that is able to remove soldered chips there isn't much you can do without going completely custom for everything.

Having sockets would increase the costs ($1-20/flash chip) and doesn't raise the sophistication level of the attacker from unskilled labor (literally anyone in the chain of custody) to skilled labor (eg: someone that can do SMT or BGA rework).

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#95

Post by ccbccccbbcccbb »

fezfight wrote: post #57
blueflow wrote: post #53

I remember being called a reactionary naysayer like, 8 years ago, because i told that this would happen.

A lot of people don't like negativity so strongly that they'd rather be screwed over than have to consider the possibility that something bad is happening.

We'll see a lot more 'conspiracy theories' proving out to be perfect practices in the near future, and the funniest thing is that none of those who label critically thinking people as tinfoil hats would admit their fallacy, on the contrary - they'll be ardently asserting that they 'definitely saw it coming' too!

Cognitive dissonance is a scary thing, makes people doublethink by repressing the conflict between expectation and observation into the subconscious.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#96

Post by _kbh_ »

ggm wrote: post #3

I live in fear of being told my factory delivered Dell rackable servers have been EFI infected since inception on my network. It's silly to pretend a BSD OS is going to be immune of the consequences of an EFI which is compromised at birth. Sooner or later there will be a value chain in compromising my OS, through the EFI. I wish we had better out of band EFI validity checks, based on what the manufacturer thinks shou…

Whilst it’s not perfect and not exactly what you want, you can use chipsec to check for a bunch of known UEFI security vulnerabilities.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#97

Post by lmm »

Avamander wrote: post #19
dhx wrote: post #12

Earlier quoted context omitted.

I would argue that the complexity of TPMs[1] and UEFI[2] leads to a larger attack surface with more bugs present, making it easier to launch attacks such as the one described. The opaqueness of these technologies and inability for and difficulty of security researchers to investigate and debug implementations of these technologies does not help either. There is no chance of a typical system owner having the time and…

In theory yes, more functionality means more surface, but then some aspects are fundamentally designed to be less exposed or dangerous. We will keep on finding a bunch of bugs in those implementations, but I suspect the end result is better than what we could've ever had with BIOS. I don't think there was any chance for a typical system owner to have the time or skill or even the foundation required to understand if…

> I suspect the end result is better than what we could've ever had with BIOS.

I would take that bet, if there were any way to objectively assess. The surface area of BIOS is just so much smaller.

> I also think there is a real opportunity to write open-source versions of these components in safe/verifiable languages.

In theory yes. In practice they're always going to be giant blobs of C written by hardware makers, massaged just enough to get Windows to boot.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#98

Post by Melatonic »

ActorNightly wrote: post #36
haswell wrote: post #2

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that…

Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.

Unless the mobo has that Intel KVM thing built into the hardware and they access that. Very low level remote access this way.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#99

Post by nyanpasu64 »

extrapickles wrote: post #94
yjftsjthsd-h wrote: post #80

Earlier quoted context omitted.

I think it would be easier to do it safely if you made it so that the number of chips to be flashed was small and they were easy to pop on and off the motherboard. I grant that this is more work to use than a single master connector, but it removes that point of vulnerability both for undermining the ability to flash things and the massive backdoor that is a single port with the ability to reimage every chip in the m…

Ideally the write enable line of the flash chips would be hooked up to their respective application processors, so when you are reading them via this header they will be read-only as the processor would still be powered down. For an adversary that is able to remove soldered chips there isn't much you can do without going completely custom for everything. Having sockets would increase the costs ($1-20/flash chip) and…

I've recently reflashed BIOS/UEFI chips by soldering plastic-ended jumper wires (easier to work with than regular breadboard wire) directly to the BIOS chips, and plugging the other end to a Raspberry Pi's SPI host pins and running flashrom. It's definitely involved to learn and tricky to pull off (like any form of complex soldering), but much lower in equipment costs than desoldering surface-mount flash chips (which I hear requires hot air to do without damaging the chips or board).

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#100

Post by ineedasername »

This rootkit is old by computing standards (2016), and apparently found somewhat by chance in that it was found in free (probably consumer) users of their product.

Could this indicate a higher likelihood of it being a consumer board supply chain attack? It might explain the lack of detection in business oriented computers, though it also would seem to indicate that it was not precisely targeted.

Post reply on HN