After CIA leak, Intel Security releases detection tool for EFI rootkits
1–10 of 61 posts
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#2And what if intel is compromised? Mass rootkit installation!
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#3This is a better link (it is Intel's original blog post):
https://securingtomorrow.mcafee.com/business/chipsec-support...
It includes a few more details about what was released:
It extracts EFI firmware from flash ROM memory
automatically if the firmware file is not
specified.
We recommend generating an EFI whitelist after
purchasing a system or when you are sure it has
not been infected:
# chipsec_main -m tools.uefi.whitelist -a generate
Then check the EFI firmware on your system
periodically or whenever you are concerned, such
as when a laptop was left unattended:
An analysis of the approach they are taking would lead to some pretty easy improvements.
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#4And what if intel is compromised? Mass rootkit installation!
My thoughts exactly! What a great way to get rootkits on people who want to protect themselves.
The code is here: https://github.com/chipsec/chipsec
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#5And what if intel is compromised? Mass rootkit installation!
You can reverse engineer the EFI modules, build a whitelist based on known safe code, and then detect subversion at Intel, so this is not a good strategy for serious adversaries.
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#6No amount of EFI rootkit detection will ever remove the possibility that malicious code is running inside the Intel Management Engine (ME), because code inside the ME would run side-by-side with the bootloader and with unlimited permissions.
Unless Intel provides source code for the ME, it is impossible to 100% know whether unauthorized code is running.
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#7And what if intel is compromised? Mass rootkit installation!
Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#8No amount of EFI rootkit detection will ever remove the possibility that malicious code is running inside the Intel Management Engine (ME), because code inside the ME would run side-by-side with the bootloader and with unlimited permissions. Unless Intel provides source code for the ME, it is impossible to 100% know whether unauthorized code is running.
Someone at https://puri.sm almost completely removed the ME. https://puri.sm/posts/neutralizing-intel-management-engine-o...
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#9And what if intel is compromised? Mass rootkit installation!
Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.
I'm not sure it's all that easy, since a) you can't know exactly how good someone is going to turn out to be (you can probably get close through), and b) you can't tell what Intel will be hiring for later, and c) to increase your odds you probably want more than a few people in this program to achieve at least a few people being hired in positions that are useful.
That said, the main hurdles seem to be managing people and funds, which government agencies seem pretty good at figuring out. So maybe not all that easy, but maybe not particularly hard either. The biggest problem might be keeping it secret, given the number of people that might need to be involved that are clandestinely working for a TLA but not as their main job and not steeped in the culture of secrecy.
Re: After CIA leak, Intel Security releases detection tool for EFI rootkits
#10And what if intel is compromised? Mass rootkit installation!
Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.
Probably easier to find an existing employee with financial problems and offer a duffel bag of cash to plug in a USB stick for 30 seconds.