3 ms·
Uhm. . . http://www.slideshare.net/matrosov/modern-bootkit-trends-bypassing-kernelmode-signing-policy http://www.slideshare.net/matrosov/modern-bootkit-trends-b
by switch33 13y ago
Uhm. . . http://www.slideshare.net/matrosov/modern-bootkit-trends-bypassing-kernelmode-signing-policy http://www.slideshare.net/matrosov/modern-bootkit-trends-byp...
Considering how much research goes into these bootkits/rootkits lately, it is interesting. Kernelmode has some ideas on it(http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2998 http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2998) and are running a thread on it. This is a rather unique malware though if it even does the airgap communication as well.
- lawnchair_larry 13y agoBootkits have nothing to do with what is described by this article and badbios. They reside on the filesystem. The thread you linked to doesn't contain any findings, but it does contain an analysis of Dragos' UEFI showing it to be completely clean, with the code matching the original factory image.