5 ms·
Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users
by ActorNightly 4y ago
Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.
- hulitu 4y agoReally ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.
- hgazx 4y agoWhat systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.
- Arnavion 4y agoAny systemd-using Linux distro will also automount /efi as writable only by root (assuming the mount was generated by GPT auto generator, not by a specific fstab entry), so it's not that either.
- tinus_hn 4y agoNormal home users are administrators, they have to go through the pop-up to run things with escalated privileges but that, according to Microsoft, is not a security boundary.
- Arnavion 4y agoIf we're considering Administrator / root access as trivially available, then any exploit becomes trivial itself. Even on a BIOS machine root can overwrite the MBR / kernel / initramfs to contain an exploit.
- tinus_hn 4y agoSorry, the argument is: > Windows doesn’t allow you to do that by default unless you’re an admin. The refutation is that by default users are an admin. So no, they’re not protected against persistent threats like UEFI malware.
- Arnavion 4y agoYes, and thus I made the comment that I made.
- ActorNightly 4y agoSure, from your computers OS. Its not like javascript loaded from the web can write to your UEFI unless you use an insecure browser. Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.
- viknesh 4y agoI think the point of the original comment was that it's extremely feasible for attackers this sophisticated to have access to browser 0 day which would allow fs access, "insecure" browser or not
- ActorNightly 4y agoZero day exploit =/= people automagically get infected. One would have to first craft the shellcode insertion into the exploit, which is not exactly trivial, then hope that enough users visit a particular website to get infection (which is a negative feedback loop as the more users visit a website, the more likely it is to get scanned and reported as containing malware), then drop a crafted executable to presumably steal something that is worth money, which is a whole separate problem. Possible? Definitely. So is you getting held up, your car stolen, and chopped up for parts, with no available recourse. Both are rather unlikely.
- Manouchehri 4y agoI’ve personally found multiple 0days in Chrome, and I doubt anyone (including myself) would consider it an insecure browser.
- malartic 4y agoHere it start from a modified motherboard firmware, stored on a chip on the board, NOT a normal partition. Harder to infect at first, but way more persistent, surviving even disks changes.
- Melatonic 4y agoUnless the mobo has that Intel KVM thing built into the hardware and they access that. Very low level remote access this way.