Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After CIA leak, Intel Security releases detection tool for EFI rootkits

pcworld.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#51

Post by gpm »

etiam wrote: post #16

Finally some tools for this. Very good. Would this be the first reasonably doable method for extracting all the blobs? Seem like it must be a well-needed foundation to build on for security companies. But... We recommend generating an EFI whitelist after purchasing a system or when you are sure it has not been infected Not that I have a better suggestion, but with interdicted shipments and other vulnerable points alo…

> How would one otherwise be "sure it has not been infected"? Any feasible ways?

If you are willing to assume they aren't infecting every computer. Walk into a random brick and mortar store and buy it there.

If you're paranoid to the point where you don't trust the people at a random brick and mortar store, point at a display model (or if they have non-display models visible one of those) and insist on that one in particular, without it leaving your sight at any point in time.

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#52

Post by xvilka »

This can be done manually using flashrom [1] tool to read (and write) the SPI (and not only SPI) flash and UEFITool [2] to unpack the corresponding image. I've even done some patching for better support of Intel platforms here [3]. Now doesn't have much time to rebase/cleanup/improve it, but hopefully someone will start from where I've finished. Both tools clearly need more love, and I hope current revelations will help to do that.

[1] http://flashrom.org/

[2] https://github.com/LongSoft/UEFITool/tree/new_engine (use 'new_engine' branch)

[3] https://github.com/XVilka/flashrom/tree/layout_descriptor (use 'layout_descriptor' branch)

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#53

Post by fnordfnordfnord »

hguant wrote: post #17
grandalf wrote: post #7

Earlier quoted context omitted.

Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.

Why bother with employees - just go give money to intel to do this. Intel as a system is designed to produce chips that work a certain way, and my understanding is that said system is rather good at what it does, dedicating the time and energy of many rather smart people to making sure things work the way they're supposed to. Why risk throwing a monkey wrench into such a system when you can just point it in a differe…

When you have the kind of money and influence that the NSA and CIA have, you probably do both.

As for other friendly and less-friendly nations, I'd be very surprised to learn that there weren't any other nations represented in the ranks of Intel engineers.

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#54

Post by ardaozkal »

vorpalhex wrote: post #40
ardaozkal wrote: post #39

What does it mean to get this? https://s.ave.zone/066.png [CHIPSEC] Modules failed 1: [-] FAILED: chipsec.modules.common.uefi.s3bootscript

:( -- clarification Technically all it means, if the error is as advertised, is that the uefi bootscript failed to match. Now, it could be as simple as that UEFI was customized by a vendor. Or it could be something less innocent.

I just reflashed my bios and then rechecked stuff, same thing... I did more research and s3bootscript seems to be associated with secure boot. Which I have disabled.

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#55

Post by mrkgnao »

digler999 wrote: post #32
mcbits wrote: post #10

Earlier quoted context omitted.

Probably easier to find an existing employee with financial problems and offer a duffel bag of cash to plug in a USB stick for 30 seconds.

This is like the opposite or corollary of the "$5 rubber hose" cryptography cracking device.

Did you mean the xkcd "crypto nerd" wrench, or is this a reference to something else?

E: ah, TIL. https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#56

Post by Canada »

throwaway91111 wrote: post #49
Canada wrote: post #41

Earlier quoted context omitted.

If you have access to more than one identical system they can be compared. Or there could be a public list of known good hashes as you suggest. In any case having a tool to even perform the check is great.

This doesn't preclude the infect-at-the-factory issue: you'd end up verifying you HAVE the rootkit (and reverting to that if it changes).

I'm assuming not all of the machines from the factory will be infected. Because if that were so, then the chances of being found out is high and consequences would be dire for the manufacturer.

If my assumption is correct then buying a retail machine and comparing its firmware to the one you order with your credit card should be fine.

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#57

Post by sschueller »

trendia wrote: post #6

No amount of EFI rootkit detection will ever remove the possibility that malicious code is running inside the Intel Management Engine (ME), because code inside the ME would run side-by-side with the bootloader and with unlimited permissions. Unless Intel provides source code for the ME, it is impossible to 100% know whether unauthorized code is running.

Is there any reason Intel would not open source that code? It not like it will run on other hardware?

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#58

Post by tomxor »

xvilka wrote: post #52

This can be done manually using flashrom [1] tool to read (and write) the SPI (and not only SPI) flash and UEFITool [2] to unpack the corresponding image. I've even done some patching for better support of Intel platforms here [3]. Now doesn't have much time to rebase/cleanup/improve it, but hopefully someone will start from where I've finished. Both tools clearly need more love, and I hope current revelations will h…

I also used flashrom instead because it's very simple to install and use... My problem is trying to verify this against the original (I'm running linux on an old macbookpro), i've got the raw flash dump and extracted the .scap from Apple... but after much searching cannot find a way to extract the raw EFI volume to compare. Any ideas?

Re: After CIA leak, Intel Security releases detection tool for EFI rootkits

#59

Post by cityhall »

hguant wrote: post #17
grandalf wrote: post #7

Earlier quoted context omitted.

Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.

Why bother with employees - just go give money to intel to do this. Intel as a system is designed to produce chips that work a certain way, and my understanding is that said system is rather good at what it does, dedicating the time and energy of many rather smart people to making sure things work the way they're supposed to. Why risk throwing a monkey wrench into such a system when you can just point it in a differe…

There's more than one country interested in pulling off these attacks. The US can say, "Do us this favor and we won't look too hard at your tax avoidance schemes," but China or Russia might have an easier time planting a few employees.
Post reply on HN