5 ms·
"... persistence across OS reinstalls [...] even effective against Windows 10 installations..." Since Windows 8 I have always enabled safeboot in the UEFI sett
by Maarten88 8y ago
"... persistence across OS reinstalls [...] even effective against Windows 10 installations..."
Since Windows 8 I have always enabled safeboot in the UEFI settings before installing the OS. Machines with pre-installled Windows usually come with this setting enabled by default. I would expect this type of malware would not run on machines with safeboot, or cause a BSOD on the next startup.
The article doesn't say anything about this, does it require an unlocked bootloader, does it silently fallback when it detects safeboot, or does it have a by-pass?
- rocqua 8y agoI really found this part of the article lacking. How deep does the rootkit go to persist across OS reinstalls? Does it simply hijack windows's restore functionality? Or does it write itself to firmware to essentially become baked into the hardware.
- nisa 8y agoThis seems to be source for the article: https://labs.bitdefender.com/2018/06/six-years-and-counting-inside-the-complex-zacinlo-ad-fraud-operation/ https://labs.bitdefender.com/2018/06/six-years-and-counting-... (there is a PDF linked), no mention of surviving a format or clean reinstall.
- vetinari 8y agoUEFI safeboot usually works fine with laptops, but it can be a can of worms on desktops. For example, in the past I've seen a board where the combination of booting from NVMe drive, setting up Intel RAID on SATA HDDs and Secure Boot simply didn't work together. You had to give up one of these to continue.