6 ms·

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today? I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that makes me lose sleep at night. I can’t help but wonder just how utterly compromised we all are, and won’t know it until many years down the line.

joshspankit 4y ago
This has been echoed in physical security for as long as it’s been around. Look at “bump keys” for example. Those who have the knowledge walk right through security barriers like they aren’t there and meanwhile security companies make optimistic claims of safety just to sell more locks.
loldk 4y ago
teawrecks 4y ago
Yeah, I assume that either everything is infected and backdoored and there's no way to detect it until it's too late, or almost nothing is infected because doing so would be the cross platform compatibility nightmare of all nightmares. I don't know which one it is.
- rtev 4y ago
  Definitely the first. Beacons have better cross-platform support than most Microsoft products.
  - eikenberry 4y ago
    Microsoft sets an extrememly low bar as they only want one platform, theirs.
ActorNightly 4y ago
Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.
- hulitu 4y ago
  Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.
  - hgazx 4y ago
    What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.
    - Arnavion 4y ago
      Any systemd-using Linux distro will also automount /efi as writable only by root (assuming the mount was generated by GPT auto generator, not by a specific fstab entry), so it's not that either.
    - tinus_hn 4y ago
      Normal home users are administrators, they have to go through the pop-up to run things with escalated privileges but that, according to Microsoft, is not a security boundary.
      - Arnavion 4y ago
        If we're considering Administrator / root access as trivially available, then any exploit becomes trivial itself. Even on a BIOS machine root can overwrite the MBR / kernel / initramfs to contain an exploit.
        4y ago
bitwize 4y ago
You know what'll help? Pluton. The future of computing is a signed code path from power on to end-user application code with multiple layers of sandboxing in between. With so many hostile actors, from script kiddies to government agencies out there, "general purpose computing" (which, from a security standpoint, is just arbitrary code execution) just isn't viable anymore. We need provable attestation that no layer of the software stack has been tampered with.
- eikenberry 4y ago
  As long as we control each layer this sounds great. What are you thinking, some sort of physical switches on the computer that turns on and off access to the layers from software so you can control them individually? That's the tricky part, how to switch those layers on and off so you can work with them in a non-software controlled way.
  - rolph 4y ago
    yes that is a problem, even bigger is that pluton is intended to make this as close to impossible as is possible. pluton is about burying TPM and keys in the processor package rather than as a separate host on the bus. this could be defeated by using microsurgical technique to reveal the die and alter the connections, an extreme effort requireing an extreme motivation.
- hulitu 4y ago
  So you will have backdoored SW but you will not be able to replace it because it is "secure".
- OneLeggedCat 4y ago
  “With so many hostile actors” Like Microsoft? And like government actors compelling Microsoft via things like NSL’s?
fsflover 4y ago
If you care about security, consider using Qubes OS. It will be extremely hard to infect your UEFI from a VM.
agiacalone 4y ago
Shameless self-plug here. I wrote about the potential for this problem in 2014 for my graduate thesis. https://search.proquest.com/openview/cd06aab6e06951ba6cdc064f959e8cb9/1?pq-origsite=gscholar&cbl=18750 https://search.proquest.com/openview/cd06aab6e06951ba6cdc064... Edit: to the parent, I shared many of the same concerns back then, too. I tried to speak to those anxieties in my final product.
saltminer 4y ago
> I can’t help but wonder just how utterly compromised we all are, and won’t know it until many years down the line. It's not hard to imagine. USB-C 3.0+ cables all need chips inside them for negotiating USB-PD, among other things. Imagine what could be done with an infected USB-C cable. Yes, of course, keyloggers are possible (that's been done plenty in the past with regular old USB-A 2.0), but think about one of USB-C's common applications: docking stations. If you hooked up your laptop to a docking station with a malicious USB-C cable and you had ethernet, an external monitor, and a keyboard plugged into the dock, you would basically be giving an attacker a VNC session. It could scoop up everything you type, everything on your screen, and communicate via a connection that is entirely transparent to the OS. At that point, your only hope is a firewall flagging the connection, otherwise you'll be completely oblivious to the ongoing surveillance. And it could compromise a network connection to insert a malicious payload into a file you're downloading, just to make the surveillance persistent when you're not plugged in.

joshspankit 4y ago

This has been echoed in physical security for as long as it’s been around. Look at “bump keys” for example. Those who have the knowledge walk right through security barriers like they aren’t there and meanwhile security companies make optimistic claims of safety just to sell more locks.

loldk 4y ago

teawrecks 4y ago

Yeah, I assume that either everything is infected and backdoored and there's no way to detect it until it's too late, or almost nothing is infected because doing so would be the cross platform compatibility nightmare of all nightmares. I don't know which one it is.

rtev 4y ago
Definitely the first. Beacons have better cross-platform support than most Microsoft products.
- eikenberry 4y ago
  Microsoft sets an extrememly low bar as they only want one platform, theirs.

ActorNightly 4y ago

Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.

hulitu 4y ago
Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.
- hgazx 4y ago
  What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.
  - Arnavion 4y ago
    Any systemd-using Linux distro will also automount /efi as writable only by root (assuming the mount was generated by GPT auto generator, not by a specific fstab entry), so it's not that either.
  - tinus_hn 4y ago
    Normal home users are administrators, they have to go through the pop-up to run things with escalated privileges but that, according to Microsoft, is not a security boundary.
    - Arnavion 4y ago
      If we're considering Administrator / root access as trivially available, then any exploit becomes trivial itself. Even on a BIOS machine root can overwrite the MBR / kernel / initramfs to contain an exploit.
      - 4y ago

bitwize 4y ago

You know what'll help? Pluton. The future of computing is a signed code path from power on to end-user application code with multiple layers of sandboxing in between. With so many hostile actors, from script kiddies to government agencies out there, "general purpose computing" (which, from a security standpoint, is just arbitrary code execution) just isn't viable anymore. We need provable attestation that no layer of the software stack has been tampered with.

eikenberry 4y ago
As long as we control each layer this sounds great. What are you thinking, some sort of physical switches on the computer that turns on and off access to the layers from software so you can control them individually? That's the tricky part, how to switch those layers on and off so you can work with them in a non-software controlled way.
- rolph 4y ago
  yes that is a problem, even bigger is that pluton is intended to make this as close to impossible as is possible. pluton is about burying TPM and keys in the processor package rather than as a separate host on the bus. this could be defeated by using microsurgical technique to reveal the die and alter the connections, an extreme effort requireing an extreme motivation.
hulitu 4y ago
So you will have backdoored SW but you will not be able to replace it because it is "secure".
OneLeggedCat 4y ago
“With so many hostile actors” Like Microsoft? And like government actors compelling Microsoft via things like NSL’s?

fsflover 4y ago

If you care about security, consider using Qubes OS. It will be extremely hard to infect your UEFI from a VM.

agiacalone 4y ago

Shameless self-plug here. I wrote about the potential for this problem in 2014 for my graduate thesis. https://search.proquest.com/openview/cd06aab6e06951ba6cdc064f959e8cb9/1?pq-origsite=gscholar&cbl=18750 https://search.proquest.com/openview/cd06aab6e06951ba6cdc064... Edit: to the parent, I shared many of the same concerns back then, too. I tried to speak to those anxieties in my final product.

saltminer 4y ago

> I can’t help but wonder just how utterly compromised we all are, and won’t know it until many years down the line. It's not hard to imagine. USB-C 3.0+ cables all need chips inside them for negotiating USB-PD, among other things. Imagine what could be done with an infected USB-C cable. Yes, of course, keyloggers are possible (that's been done plenty in the past with regular old USB-A 2.0), but think about one of USB-C's common applications: docking stations. If you hooked up your laptop to a docking station with a malicious USB-C cable and you had ethernet, an external monitor, and a keyboard plugged into the dock, you would basically be giving an attacker a VNC session. It could scoop up everything you type, everything on your screen, and communicate via a connection that is entirely transparent to the OS. At that point, your only hope is a firewall flagging the connection, otherwise you'll be completely oblivious to the ongoing surveillance. And it could compromise a network connection to insert a malicious payload into a file you're downloading, just to make the surveillance persistent when you're not plugged in.