Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

securelist.com

Post reply on HN
Print view View original

111–120 of 125 posts

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#111

Post by fuzzfactor »

fguerraz wrote: post #7

That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…

>even good old BIOS is susceptible to rootkits

Those common rootkits were not in the BIOS firmware, they were just malicious code on the hard drive. But the code was written on drive space not used by the file system so it withstood malware scanning of the volume and often reformatting/restoration too.

The Master Boot Record (fist 440 bytes of sector 0) would often need to be renewed from trusted media, and the malicious code zeroed using a raw disk editor which can address sectors which are not within the file system.

Or the shotgun approach could be taken and the whole HDD zeroed.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#112

Post by ActorNightly »

viknesh wrote: post #67
ActorNightly wrote: post #65

Earlier quoted context omitted.

Sure, from your computers OS. Its not like javascript loaded from the web can write to your UEFI unless you use an insecure browser. Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.

I think the point of the original comment was that it's extremely feasible for attackers this sophisticated to have access to browser 0 day which would allow fs access, "insecure" browser or not

Zero day exploit =/= people automagically get infected.

One would have to first craft the shellcode insertion into the exploit, which is not exactly trivial, then hope that enough users visit a particular website to get infection (which is a negative feedback loop as the more users visit a website, the more likely it is to get scanned and reported as containing malware), then drop a crafted executable to presumably steal something that is worth money, which is a whole separate problem.

Possible? Definitely. So is you getting held up, your car stolen, and chopped up for parts, with no available recourse. Both are rather unlikely.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#113

Post by joshspankit »

haswell wrote: post #2

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that…

This has been echoed in physical security for as long as it’s been around.

Look at “bump keys” for example. Those who have the knowledge walk right through security barriers like they aren’t there and meanwhile security companies make optimistic claims of safety just to sell more locks.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#114

Post by reedjosh »

Schroedingersat wrote: post #105
reedjosh wrote: post #13

Earlier quoted context omitted.

This! ^ Tech companies are all subjects to the government in which they operate. They have become spies. The real terror is when you can't buy chips that don't spy on you.

> The real terror is when you can't buy chips that don't spy on you. So about 5 years ago?

No joke

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#115

Post by vorpalhex »

fguerraz wrote: post #9
vorpalhex wrote: post #8

Earlier quoted context omitted.

"I'm sorry but your computer is not running Genuine Windows 11:tm:. You may not be secure." will be the new "An application is attempting to make changes to your computer..." Alert fatigue is real.

Alert fatigue is real but silent rootkits are way worse. Also, it's not just about booting windows or the OS, it's about the UEFI, which even fewer people are going to want to tinker with.

I actually disagree. Silent rootkits in the bios are relatively rare, but alert fatigue is horrifically common.

It's not just the severity of harm but also it's frequency.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#117

Post by shadowpho »

figmaheart255 wrote: post #103

I wonder why more computers don't use the simple boot model that devices like the Raspberry Pi use. From what I've heard, the RPi is effectively immune from persistent malware. Firmware can't be modified [1], and while the second stage bootloader can be flashed in the RPi 4, the first stage bootloader can't be modified [2]. What this basically means is that no matter what infects your pi, you can always just replace…

Raspberry pi has firmware on the USB hub AFAIK :)

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#119

Post by buildbot »

Taniwha wrote: post #43
GoOnThenDoTell wrote: post #40

Earlier quoted context omitted.

You can implement something else, riscv is a young isa

yup, RISC-V happily boots with just uboot

Yep! You can run linux even on an entirely open source from hardware to software toolchain: https://github.com/litex-hub/linux-on-litex-vexriscv Though the FPGA IC itself of course is not open, the bitstream generation is, and there are many fully open source hardware board designs, for example the orangecrab. With a Lattice 85K gate FPGA, you can get 4x 32bit riscv cores at 50Mhz or 1 64bit riscv rocket 64 bit core at 20Mhz

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#120

Post by Arnavion »

tinus_hn wrote: post #110
Arnavion wrote: post #73

Earlier quoted context omitted.

If we're considering Administrator / root access as trivially available, then any exploit becomes trivial itself. Even on a BIOS machine root can overwrite the MBR / kernel / initramfs to contain an exploit.

Sorry, the argument is: > Windows doesn’t allow you to do that by default unless you’re an admin. The refutation is that by default users are an admin. So no, they’re not protected against persistent threats like UEFI malware.

Yes, and thus I made the comment that I made.
Post reply on HN