5 ms·
This rootkit is designed for a major brand of hard disk and can infect the firmware from within the operating system (no physical access required), it's also co
by shawnee_ 11y ago
This rootkit is designed for a major brand of hard disk and can infect the firmware from within the operating system (no physical access required), it's also completely undetectable to software running on the host computer.
Skeptical about this -- especially the claim that it's "completely undetectable". One of the projects[1] we've worked on for 01.org now ships with UEFI SCT[2], which was designed to address this very issue.
Flash LUV to a USB and run the suites.. the tests will write to a folder on the USB, both "raw" and "parsed" results, so you can essentially have a log[3] of any issues.
[1] https://github.com/01org/luv-yocto
[2] http://firmware.intel.com/blog/linux-uefi-validation-project-incorporate-uefi-sct
[3] https://01.org/linux-uefi-validation
- aout 11y agoWell, run the tests against the hack and we'll see :)
- mrb 11y agoWell the bootkit is undetectable to the compromised OS, but not to another OS booted safely from another boot device (such as a USB stick). As the author explains in his slides, only the first read of the MBR will return the bootkit. Subsequent reads will return the legit MBR. So a compromised OS attempting to check its own MBR will see legit data. But an OS booted from another boot device can read the MBR one time and can immediately see the MBR contains non-standard code (eg. not the standard Windows or Grub boot loader) and can conclude it is compromised.