88 ms·
First in-the-wild UEFI bootkit bypassing UEFI Secure Boot
- TacticalCoder 4y ago> UEFI bootkits may lose on stealthiness when compared to firmware implants – ... – as bootkits are located on an easily accessible FAT32 disk partition. It's kinda a surprise that it's only detected in the wild now if it's that obvious.
- deleted 4y ago[deleted]
- mjg59 4y agoThis is kind of weird in that it's exploiting a vulnerability in the Windows bootloader, but once exploited it's pivoting to using shim+grub (edit: apparently it's not actually grub, it's their own bootloader that's just called grubx64.efi because that's what shim boots by default). There's no absolute requirement to do this, but it's presumably easier to implement their full payload in grub rather than getting it all running in the context of the Windows bootloader. This means it probably doesn't work on the Secured Core PCs that only ship with support for the Windows signing key (but also it can't be used to attack Linux systems that remove trust in the Windows key). This pivot means that the keys measured into PCR 7 of the TPM will change, which breaks the Bitlocker policy, which is presumably why stage 1 disables Bitlocker before exploiting the bootloader. This means it's also detectable using Remote Attestation (I think Microsoft's Device Health Attestation ought to notice, but haven't verified it), which is nice for all 3 of the people who've rolled that out. In terms of why the known vulnerable bootloaders weren't already revoked - I have no inside knowledge here, but my guess would be the impact on users with existing install media (including factory restore images). We've revoked a bunch of vulnerable Linux bootloaders, but the level of pain involved in revoking a Windows one is almost certainly way higher.
- AshamedCaptain 4y ago> We've revoked a bunch of vulnerable Linux bootloaders, but the level of pain involved in revoking a Windows one is almost certainly way higher. Revoking other OSes install media en-masse is fine, but not Windows ?
- Sunspark 4y agoLinux users tend to be their own support. Windows users are commercial support which is $.
- LoganDark 4y agoYou can't exactly swap out the bootloader on Windows install media. You can on Linux because it's a modular component of the system, but on Windows the entire OS + kernel + bootloader is a single image.
- deleted 4y ago[deleted]
- michaelt 4y agoI wouldn't be surprised if 50% of Linux users already have Secure Boot disabled - and probably 98% of Linux users have the wherewithal to get into the BIOS and disable it if they needed to. And doing so has negligible downsides, as almost nobody on Linux has been fool enough to make use of the TPM.
- candiddevmike 4y agoTPM support on Linux (for drive encryption) is getting better with tools like clevis. Additionally, systemd can do a ton of cool things with TPM, and projects like dm-verity can make linux's boot process more locked down than Windows. I personally will always use a passphrase for device encryption.
- Laaas 4y agoPassphrase + TPM is best.
- cryptonector 4y ago> [...] almost nobody on Linux has been fool enough to make use of the TPM. Can you elaborate as to what is foolish about using a TPM?
- amluto 4y agoI continue to dislike the PCR 7 mechanism. Remote attestation, etc should have a means to accept or reject specific bootloaders, not just their signing keys. </grump>
- mjg59 4y agoThat information is still in PCR 4, the reason for just encoding the policy and signing key in PCR 7 is that it remains stable even if you update the bootloader.
- amluto 4y agoHmm, I guess there could have been a mechanism by which a boot manager would, as the very first thing it does, extend a PCR with its own version number, and other later things that want to require a specific or newer version could check that PCR. Then at least old versions could be reliably distrusted without actually being revoked and thus rendered unable to boot.
- mjg59 4y agoMeasuring the version is easy enough, and having that in the event log makes it easy to parse out remotely, but given the PCR is just going to end up as the SHA256 of it you can't write policy that says "Unlock if this value is x or greater". There's some stuff you could do with a monotonic counter, but they have some subtly complicated semantics that would make me a little scared of trying.
- amluto 4y agoI realize it would need SGX or make TPM even more horribly complicated, and the TCG has about zero change of getting it right, but it would be really nifty if one could unseal data based on a flexible predicate that can read the event log. Imagine something like an eBPF or Ethereum VM program that takes the event log as input and says yea or nay.
- trelane 4y ago
- pl4nty 4y agoRemote Attestation (DHA) is enabled by default with Microsoft's mobile device management product (Intune), so it's likely rolled out to a good number of enterprise customers. Not sure how many use DHA for access control though, and Intune doesn't support servers.
- megous 4y agoSo the revocation list is distributed by BIOS updates? If yes, then secure boot seems like a joke for most consumers.
- mjg59 4y agoNo, revocation lists can be updated from the OS and are freely available from https://uefi.org/revocationlistfile https://uefi.org/revocationlistfile
- megous 4y agoSo the OS just doesn't do it automatically?
- skozharinov 4y agoIt does. Windows ships them as part of security updates, Linux distributions can use fwupd.
- mjg59 4y agoAs noted in the other comment, Linux (if running fwupd) and Windows support doing it automatically, but the files are made public so other operating systems and distributions can also implement that.
- megous 4y agoI find it hard to square with: "In this blogpost we present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled."
- mjg59 4y agoMicrosoft has not yet chosen to revoke the vulnerable bootloader
- 4y ago
- AaronFriel 4y agoAmusingly, this exploit titled BlackLotus priced at $5,000 is cheaper than its likely namesake, the Magic: the Gathering card Black Lotus. The cheapest Black Lotus cards are around $10k[1], an artist proof, signed Black Lotus may be worth around $800,000[2]. [1] https://www.tcgplayer.com/search/magic/product?productLineName=magic&productName=Black+Lotus&Language=English&view=grid https://www.tcgplayer.com/search/magic/product?productLineNa... [2] https://www.rollingstone.com/product-recommendations/lifestyle/post-malone-magic-the-gathering-secret-lair-card-packs-1234608197/ https://www.rollingstone.com/product-recommendations/lifesty...
- AdmiralAsshat 4y agoWell, sure. I mean, one of these things just lets you hijack the boot process of a fully-patched operating system. The other one lets you add three mana to your mana pool at no cost! It's really no contest.
- AaronFriel 4y agoYou're right. One is a necessary tool for the most skilled actors to use against their greatest threats; the other is merely another vector for exploiting trusted computing primitives.
- deleted 4y ago[deleted]
- WhackyIdeas 4y agoI would love to take a look at these underground hacker places to see what goes on and what to watch our for… I’m guessing it’s all dark web stuff though. Are any of these forums available on the clear net?
- cassianoleal 4y agoThe "dark web" is one download away [0]. [0] https://www.torproject.org/download/ https://www.torproject.org/download/
- justincredible 4y ago[dead]
- Eisenstein 4y ago> Are any of these forums available on the clear net? Yes. Can you read and understand Russian?
- MikePlacid 4y agoEveryone can - Google Translate is… uhm acceptable. So do not be shy, post the links.
- from 4y agoBased on the user rank in the BleepingComputer article's screenshot ("kilobyte") it looks forum.exploit.in. Anyone can buy a membership for ~$100 in BTC. I've read some of these places and honestly it's pretty boring. It's basically just a marketplace for software to steal money from people in first world countries (stealers, n-day exploits, crypters, AV scanning services, phishing services) and a bunch of supporting services like residential proxies, hacked RDPs, SSN lookups, and "drop" bank/crypto exchange accounts. There are others that are public: antichat, wwh-club, bhf. I'm not on it but I think the most "elite" forum is called Mazafaka and requires a substantial deposit and a recommendation from existing members. Exploit.in is more technical than most of these forums but a lot of these people are not really very technically skilled they just have a very good understanding of how anti fraud systems work and how to circumvent them.
- deleted 4y ago[deleted]
- rdtsc 4y ago> some of the BlackLotus installers we have analyzed do not proceed with bootkit installation if the compromised host uses one of the following locales: Romanian (Moldova), ro-MD, Russian (Moldova), ru-MD, Russian (Russia), ru-RU, Ukrainian (Ukraine) , uk-UA, Belarusian (Belarus), be-BY, Armenian (Armenia), hy-AM, Kazakh (Kazakhstan), kk-KZ I can guess why they might do that, but also wonder if it's an actual international group (nice to see countries working together so well! /sarcasm), or they threw in a few extra plausible ones to mask their origin. For example, if they just picked Moldova, that's relatively small country and would narrow down their location to one city exactly.
- paulpauper 4y agoCan this bypass something like ransomware. If the hard drive is encrypted by something like bitlocker, or if you forgot the decryption password.
- mjg59 4y agoNo, it's only able to disable Bitlocker because the initial deployment requires admin level access in Windows - stage one of infection is to disable Bitlocker from a running system that's already unlocked the drive.
- josephcsible 4y agoHow many more times does this kind of thing have to happen before people realize that "Secure" Boot isn't real security from anyone other than the computer's owner?
- askvictor 4y agoI don't disagree with you, but also wonder if, by raising the stakes considerably, 'secure boot' has prevented rafts of malware that could be created by anyone and their dog.
- josephcsible 4y agoIsn't the kind of malware that most script kiddies would want to make totally outside of Secure Boot's threat model?
- hulitu 4y agoMost malware does not mess with boot process because it requires higher skills.
- Avamander 4y agoPlus like, there's the possibility of Secure Boot that makes your infected machine not boot if you do it wrong.
- whatupmiked 4y agoThere is no evidence secure boot has prevented any malware.
- mjg59 4y agoThere are UEFI bootkits in the wild that are prevented by secure boot.
- whatupmiked 4y ago
- hardenedvault 4y agoCVE-2022-21894 PoC: Secure Boot Security Feature Bypass Vulnerability https://github.com/Wack0/CVE-2022-21894 https://github.com/Wack0/CVE-2022-21894 Bootkit samples https://github.com/hardenedvault/bootkit-samples https://github.com/hardenedvault/bootkit-samples The short-term solution for workaround is to protect the OS runtime. Otherwise you'd have to build the defense-in-depth at very infrastructure level from scratch with hardware, firmware and OS with attestation service not only based on the "confidential computing" but typically TCG's trusted computing.