CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit • Hacker News Board

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#121

Post by [deleted] » Thu, Jul 28, 2022, 1:54 AM UTC

Arnavion wrote: post #69

tepitoperrito wrote: post #31

Furious searches for BIOS only era hardware are taking place on ebay as we speak. To use with a modified Linux kernel that emulates a bog standard Thinkpad uefi environment of course. EDIT: I forgot to phrase this as a question - besides missing a QubesOS or KickSecure on top, is this a decent plan for airgapped stuff?

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel. UEFI can be emulated on top of BIOS using something like Clover…

[deleted]

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#122

Post by tepitoperrito » Thu, Jul 28, 2022, 2:21 AM UTC

lmm wrote: post #92

Arnavion wrote: post #91

Earlier quoted context omitted.

Sure, but we know that the OS they're asking about is Linux, and none of the major Linux distros require UEFI to boot.

I understood them to be talking about using Linux as the hypervisor that would emulate a UEFI environment, the guest OS might be something different.

Yup.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#123

Post by tepitoperrito » Thu, Jul 28, 2022, 2:22 AM UTC

lmm wrote: post #89

Arnavion wrote: post #69

Earlier quoted context omitted.

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel. UEFI can be emulated on top of BIOS using something like Clover…

Presumably the point is to run something that assumes/relies on UEFI (an OS or application) without having to run and trust the giant blob of low-quality code that is a typical hardware UEFI implementation.

Nope.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#124

Post by richardfey » Sun, Jul 31, 2022, 2:41 AM UTC

This exploit would only work when CSM is enabled? Nowadays with SecureBoot I think it would have to be much more complex? (patching all functions in UEFI, bootloader and OS to bypass the verification).

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#125

Post by saltminer » Mon, Aug 01, 2022, 2:46 AM UTC

haswell wrote: post #2

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that…

> I can’t help but wonder just how utterly compromised we all are, and won’t know it until many years down the line.

It's not hard to imagine.

USB-C 3.0+ cables all need chips inside them for negotiating USB-PD, among other things.

Imagine what could be done with an infected USB-C cable. Yes, of course, keyloggers are possible (that's been done plenty in the past with regular old USB-A 2.0), but think about one of USB-C's common applications: docking stations.

If you hooked up your laptop to a docking station with a malicious USB-C cable and you had ethernet, an external monitor, and a keyboard plugged into the dock, you would basically be giving an attacker a VNC session. It could scoop up everything you type, everything on your screen, and communicate via a connection that is entirely transparent to the OS.

At that point, your only hope is a firewall flagging the connection, otherwise you'll be completely oblivious to the ongoing surveillance. And it could compromise a network connection to insert a malicious payload into a file you're downloading, just to make the surveillance persistent when you're not plugged in.