Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

securelist.com

Post reply on HN
Print view View original

101–110 of 125 posts

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#101

Post by andrekandre »

fguerraz wrote: post #7

That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…

  > Of course all this crap needs to be open source
slightly pedantic maybe, but i would just add that without being able to replace said software/hardware (while maintaining a root of trust of course) just being open source (you can look but don't touch) isn't enough

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#102

Post by userbinator »

fguerraz wrote: post #7

That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…

Does anyone else find it really too coincidental that the anti-Pluton article goes under, and not long after, this one appears with such comments?

All I can hypothesise is that some entity with huge vested interests is now trying to do damage control.

to prevent not trusted binaries

"trusted" by who? The faceless bureaucracy that wants to control every bloody aspect of your life?

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#103

Post by figmaheart255 »

I wonder why more computers don't use the simple boot model that devices like the Raspberry Pi use. From what I've heard, the RPi is effectively immune from persistent malware. Firmware can't be modified [1], and while the second stage bootloader can be flashed in the RPi 4, the first stage bootloader can't be modified [2]. What this basically means is that no matter what infects your pi, you can always just replace the SD card and restore it to a clean state. In contrast, I've heard so much news about how USB firmware can get reprogrammed [3], how PC malware can survive BIOS reflashing [4], how malware can live in external drive firmware, etc. Of course, if there's a bug in the raspi firmware, it also can't be fixed, but the attack surface is so small I'm willing to make the trade-off (and buy a new pi if it comes to light).

[1]: https://raspberrypi.stackexchange.com/questions/8963/are-the...

[2]: https://www.raspberrypi.com/documentation/computers/raspberr...

[3]: https://security.stackexchange.com/questions/97246/badusb-wh...

[4]: https://security.stackexchange.com/questions/44750/malware-t...

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#104

Post by Manouchehri »

ActorNightly wrote: post #65
hulitu wrote: post #48

Earlier quoted context omitted.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

Sure, from your computers OS. Its not like javascript loaded from the web can write to your UEFI unless you use an insecure browser. Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.

I’ve personally found multiple 0days in Chrome, and I doubt anyone (including myself) would consider it an insecure browser.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#105

Post by Schroedingersat »

reedjosh wrote: post #13
mistrial9 wrote: post #6

as a civilian, I am repeatedly amazed at the relentless, intrusive and manipulative tactics that the "heroes" use on the "sheep" .. I am quite capable of managing my own affairs and have invented and solved using computers for decades. I have a sense of personal sovreignty that is offended and threatened by one-way-mirror, controlling, destructive Spy-vs-Spy comic books being played out by eternally funded jerks. I a…

This! ^ Tech companies are all subjects to the government in which they operate. They have become spies. The real terror is when you can't buy chips that don't spy on you.

> The real terror is when you can't buy chips that don't spy on you.

So about 5 years ago?

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#106

Post by Schroedingersat »

fguerraz wrote: post #14
BiteCode_dev wrote: post #10

Earlier quoted context omitted.

The problem with pluton is not the tech. It's that: - it's proprietary - it's controlled by entities that have a terrible track record - it's going to be, as usual, forced upon everybody without consent

I have argued the same as you, it needs to be open source to fix the first two points. For the third one, nobody is forcing you to buy a specific product, but yes, it will be hard to avoid. But like for vaccines, individual consent is at odds with the greater good. Society needs computing that it can trust. Maybe the solution is a healthier hobbyist market where you can buy "use at your own risk" unlocked computers?…

> For the third one, nobody is forcing you to buy a specific product, but yes, it will be hard to avoid.

Yes it is being forced. We have single digit years before participation in society becomes impossible without a device that attests that it is not under the control of the owner. First it will be banks, then government services, then access to the social graph, and so on.

> But like for vaccines, individual consent is at odds with the greater good. Society needs computing that it can trust.

So not under the control of centralised corporations that get paid when they successfully manipulate you into doing something you wouldn't otherwise, and have a proven track record of unaccountable censorship.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#107

Post by userbinator »

belthesar wrote: post #33
iforgotpassword wrote: post #27

Earlier quoted context omitted.

> Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. Were there? I couldn't find anything, but then again Google is garbage nowadays if you want to find older stuff. To my understanding, the limitations of the old BIOS world would've made it much harder to hack on it other than maybe enabling hidden menus. The UEFI world is so much larger, more powerful and already offers plenty of…

A buddy of mine installed some crapware he downloaded off of a warez site back in the mid-2000's which reflashed his BIOS to a very hackers-esque bootsplash that prevented boot. Fortunately, he had a Gigabyte board which ran a dual-BIOS config, so he was one jumper change away from getting back to his system and cleaning stuff up. I'm not sure it was ever intended to do anything more than punish someone, but the capa…

but the capability of doing plenty even on that tiny ROM was there.

That sounds more like he just got the BIOS erased and replaced with something else entirely, rather than something intended to parasitically coexist.

Also, for a while, they had write-protect jumpers.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#108

Post by yjftsjthsd-h »

figmaheart255 wrote: post #103

I wonder why more computers don't use the simple boot model that devices like the Raspberry Pi use. From what I've heard, the RPi is effectively immune from persistent malware. Firmware can't be modified [1], and while the second stage bootloader can be flashed in the RPi 4, the first stage bootloader can't be modified [2]. What this basically means is that no matter what infects your pi, you can always just replace…

I would actually be on board with that, if the boot/firmware (micro)SD was separate from the main OS drive, because the annoying thing about the Pi is that it can't take generic images - you have to flash a pi-specific image to your card because it has to include the firmware. There's a part of me that says by the time you've put the boot firmware on a dedicated card and made that card robust enough to survive the lifetime of the machine you've just reinvented built-in flash chips, but I agree that the ability to trivially remove it and have all the (changable) firmware in one card is an improvement over the status quo.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#109

Post by agiacalone »

haswell wrote: post #2

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that…

Shameless self-plug here.

I wrote about the potential for this problem in 2014 for my graduate thesis.

https://search.proquest.com/openview/cd06aab6e06951ba6cdc064...

Edit: to the parent, I shared many of the same concerns back then, too. I tried to speak to those anxieties in my final product.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#110

Post by tinus_hn »

Arnavion wrote: post #73
tinus_hn wrote: post #71

Earlier quoted context omitted.

Normal home users are administrators, they have to go through the pop-up to run things with escalated privileges but that, according to Microsoft, is not a security boundary.

If we're considering Administrator / root access as trivially available, then any exploit becomes trivial itself. Even on a BIOS machine root can overwrite the MBR / kernel / initramfs to contain an exploit.

Sorry, the argument is:

> Windows doesn’t allow you to do that by default unless you’re an admin.

The refutation is that by default users are an admin. So no, they’re not protected against persistent threats like UEFI malware.

Post reply on HN