8 ms·

Hacking Team Uses UEFI BiOS Rootkit to Keep RCS 9 Agent in Target Systems

112 points by apaprocki 11y ago

pgib 11y ago
https://dl.dropboxusercontent.com/u/31250/gifs/buster-panicked.gif https://dl.dropboxusercontent.com/u/31250/gifs/buster-panick...
paulmd 11y ago
Hey guys that BadBios is totally impossible, agreed? What a scrub, UEFI viruses are impossible. lol psychotic break amirite I caught a message on the Windows install rebooot about "Intel AMT activated" during a clean reformat - but in BIOS it shows deactivated on reboot. Kaspersky/Malwarebytes/CCleaner shows clean on every scan for system files - I'm seriously wondering whether I need to dump this machine hardware and all. The cause for the reformat in the first place was a potential virus infection, maybe a rootkit. I didn't want to let it back on my network after I scanned a cryptolocker variant in my temp folder.
- scintill76 11y ago
  It sounds like you're saying this lends some weight to the BadBIOS theory. No, the main unbelievable feature attributed to BadBIOS is the ability to jump airgaps via ultrasonic communication, which is not mentioned in this article.
  - paulmd 11y ago
    When you've got a BIOS-level rootkit, what's unbelievable about a hardware-level transmission mechanism? If an OS can load device drivers, why not an exploit toolkit? Again, the problem with the BadBios story (?) from a security-level perspective was that it came from the head of a top-level security consultant - so it's hard to know if it's true or not, because if he was chasing at system ghosts, they were 100% feasible system ghosts, with Proof Of Concepts delivered (eg reception of ultrasonic transmission via laptop speakers [1]). At this point I do believe they were ghosts, but if you want to analyze them - posting about an actively-administered rootkit installation on your LAN on the internet was a mistake, because once detected the attackers would pull back. And the more we learn about state-level cyberattacks, the more that potential attack rings true. It's just a question of tradeoff - do you really think that at least one party who could mount an A-grade cyberattack would do so against one of the people most likely to detect and analyze it, versus the chance to see what exists in his systems? When you get down to it, once infected you cannot trust so basic a system as a hard drive, and the NSA has attacked that firmware [2]. See: Reflections on Trusting Trust. [3] And that's about 90% of Dragos' sins right there - not trusting systems (or even components) that were exposed to unknown exploits translates as "paranoia" to the average user. [1] http://www.jocm.us/index.php?m=content&c=index&a=show&catid=124&id=600 http://www.jocm.us/index.php?m=content&c=index&a=show&catid=... [2] http://www.wired.com/2015/02/nsa-firmware-hacking/0 http://www.wired.com/2015/02/nsa-firmware-hacking/0 [3] https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
    - pgeorgi 11y ago
      The claim of BadBIOS was that it was supposed to infect new devices through the audio channel. While Hanspach et al demonstrate the data transmission vector, it's no infection vector. For that, you'd need to be able to exploit the HD Audio codec (or whatever chip gets to interpret the signal) - and there are dozens of models by different vendors out there. That's a very different claim.
      - acdha 11y ago
        Coverage at the time only mentioned the audio claims as a side channel for systems which were already infected: http://blog.erratasec.com/2013/10/badbios-features-explained.html http://blog.erratasec.com/2013/10/badbios-features-explained... “Dragos believes that two infected computers can communicate with each other over the audio port in frequencies above human hearing, thus allowing an "air gapped" computer to still communicate over the Internet.” http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/ http://arstechnica.com/security/2013/10/meet-badbios-the-mys... “Ruiu said he arrived at the theory about badBIOS's high-frequency networking capability after observing encrypted data packets being sent to and from an infected laptop that had no obvious network connection with—but was in close proximity to—another badBIOS-infected computer.” EDIT: just to be clear, I think this was some sort of mental breakdown but as Rob Graham noted none of what was described was obviously impossible – it would just have had to be executed at a higher level than we've seen before, even with something like Stuxnet, with e.g. exploits & persistent rootkits for huge ranges of hardware.
        pgeorgi 11y ago
        From your second link: "We had an air-gapped computer that just had its [firmware] BIOS reflashed, a fresh disk drive installed, and zero data on it, installed from a Windows system CD," Ruiu said. "At one point, we were editing some of the components and our registry editor got disabled. It was like: wait a minute, how can that happen? How can the machine react and attack the software that we're using to attack it? This is an air-gapped machine and all of a sudden the search function in the registry editor stopped working when we were using it to search for their keys." There are four claims in here: - firmware is fresh - OS is fresh - system is air-gapped - infection happened The next two paragraphs introduce the network-over-audio theory, which requires an already-infected system (although with no causal link). This could also be HDD firmware infection or similar, or maybe their flashing attempt was unsuccessful (when done internally, not with an external flasher, that would be reasonable). Still, articles like this are probably the reason for people (myself included) remembering a claim that infection happened through audio channels.
  - kpcyrd 11y ago
    Like this? https://github.com/Katee/quietnet https://github.com/Katee/quietnet
    - deleted 11y ago
      [deleted]
    - scintill76 11y ago
      Sure, looks cool. But if you're trying to convince anyone that BadBIOS can work as claimed, I won't be impressed until I see one system running quietnet install quietnet onto another system with a standard fresh install of Windows, Mac OS X, BSD, or Linux; using only ultrasonic communication.
      - acdha 11y ago
        Did Dragos ever claim that BadBIOS used sound as an infection mechanism rather than a side-channel for communications between systems which were already infected? If memory serves, nothing he claimed was something that hasn't been demonstrated to be possible – only that the combination would have had to be better executed than anything we've ever seen before and, of course, the evidence never materialized. That fits with the current consensus that it was the product of some sort of mental issue – it's the superset of everything a security researcher might know to be theoretically possible.
        scintill76 11y ago
        I agree with your later comment, that it's unclear whether ultrasonic infection was actually claimed. For purposes of this thread, which started by trying to refute the position, "BadBios is totally impossible" -- the "impossible" claim the mainstream is probably referring to is infection purely by ultrasonic transmission. There's no need to prove that ultrasonic communication is plausible, or that rootkits can be installed in BIOS, EFI, harddrive controller, etc. It is impressive to see such exotic attacks actually being used, though.
- alfiedotwtf 11y ago
  Just curious, is there any reason why you may be considered an interesting target to the NSA and friends?
  - UserRights 11y ago
    Maybe he is against war? Against cancer? Against GMO? Maybe he is just reading the wrong websites? maybe he is writing critical comments on HN?
  - paulmd 11y ago
    No, I'm more suspicious of generic botnet/ransomware stuff. Which probably isn't anything that sophisticated. That was yesterday. Having slept on it, I think the most likely cause is that I happened on a key combination that tries to poll status or activate AMT during POST/early boot (eg maybe something for service techs to load/auto-configure AMT off PXE or USB or something). An auto-loader for AMT wouldn't thrill me either, of course. Finding a cryptolocker installer in my Temp folder just has me running paranoid, I've never seen that particular message appear before, and it was gone before I could really get a good look. Managed to dig up this paper on some of the potential black-hat applications of AMT [1]. Happened on another interesting one on Intel SGX [2]. It's certainly a net positive to have virtualization/sandboxing, secure enclaves, etc in our systems - but it always bugs me that they paradoxically create the potential for rootkits that are impossible to pry out once they're situated. The idea of a platform-neutral technology that could serve as a vector for malware is a particularly disturbing one to me. Developing viruses for each individual BIOS implementation is something of a barrier to large-scale contagion of such malware, but there's probably a much smaller number of (eg) AMT or SGX versions with significant code overlap. [1] http://me.bios.io/images/0/0f/Csk_lacon12_intel_amt.pdf http://me.bios.io/images/0/0f/Csk_lacon12_intel_amt.pdf [2] http://theinvisiblethings.blogspot.com/2013/09/thoughts-on-intels-upcoming-software.html http://theinvisiblethings.blogspot.com/2013/09/thoughts-on-i...
  - na85 11y ago
    Perhaps he uses cryptography or has visited China. That's all it takes.
defective 11y ago
Luckily, this at least requires physical access.
- higherpurpose 11y ago
  Perfect for TAO.
TerryADavis 11y ago
nigger probably an atheist.
acd 11y ago
This is what I thought when viewing my latest computer that came with an UEFI bios. That the UEFI BIOS is to large and too complex and has way to many functions to be a BIOS device, hence a perfect place to put advanced malware. It's like an operating system before the operating system, has its own FAT32 system partition where you can store stuff. Also after a few years your manufacturer will stop shipping uefi BIOS updates for your computer due to their interest in selling new computers and then there will be a lurking security whole laying around.
- throwaway7767 11y ago
  All of this is equally possible on plain old BIOS. One way that's been done in the past is to write a small hook into the SMM handler. Don't even need to drop any malware into windows, once you're in SMM mode you are running completely outside the view of the OS, with full access to everything in memory.
- RexRollman 11y ago
  UEFI is simply over-engineered.
  - wyldfire 11y ago
    And yet traditional BIOSes reuse features, implementation and design from the dawn of personal computing. They strike me as an unreliable black art. Bootstrapping computers is "hard" and there's a huge disincentive to breaking compatibility with operating systems' installation/bootstrapping. I'm not sure if EFI/UEFI are ideal, but it strikes me as a net win.
    - RexRollman 11y ago
      Without a doubt, the classic BIOS needed improvement, but we didn't need this. The situation reminds me of IPv6, which is also grossly over-engineered.
- JustSomeNobody 11y ago
  What ever happened to the 'B' in BIOS?
z3t4 11y ago
All it takes to install a (BIOS) rootkit is root access ... In windows this means answering Yes on the question "Do you want to allow the following program to make changes to your computer". Remember to flash the BIOS if you've been hacked!
- throwaway7767 11y ago
  If your system firmware has already been compromised, you cannot trust that reflashing it will bring it back to a good state. Flashing relies on assistance from the existing system firmware on modern machines. You would have to open the machine, desolder the flash chips and re-write them in a flash programmer to get a clean slate. Or, if your adversary is very high-level, just throw the machine away, since you'll never be able to find all the places one could hide persistent malware in hardware. Once you lose physical control of a machine, it's game over if you are concerned about hardware/firmware attacks.
  - raverbashing 11y ago
    No need to desolder, several ones are removable Some motherboards even have a backup one
    - snuxoll 11y ago
      > Some motherboards even have a backup one Are they detached and non-writable while the primary ROM is active? I have consistently used Gigabyte boards for a decade because of the extra features that come with them, Backup BIOS being a key one — in the old days I would have to flip a jumper on the board to make the system boot from the backup, today the secondary ROM gets automatically enabled if the primary one fails to load. I wouldn't trust the secondary flash ROM on my motherboard to protect me from APT, it's only purpose is to recover from a failed flash.
      - raverbashing 11y ago
        Yeah, I'm not sure if they're read only without a jumper or software writeable without any protection
gesman 11y ago
UEFI BIOS - Road to hell that was paved with good intentions
- Someone1234 11y ago
  Why exactly? A lot of people's issues with uEFI seem to stem from Secure Boot (and the lack of additional CAs contained within). And while I grant that Secure Boot is problematic, uEFI is actually taking us away from black box firmware that was BIOS. In many ways this type of stuff has always been possible, the only difference is the skill threshold has been lowered. So I guess the question is do you believe in the phase: "Ignorance is bliss?" Because that's what you're asking for, back to BIOS where these things are still readily do-able, just requires more technical skill and time.
- the_why_of_y 11y ago
  I'm confused, what's a "UEFI BIOS"? Does that mean UEFI firmware with the "Compatibility Support Module" enabled?
- rbanffy 11y ago
  About the intentions it was paved with, we have to ask to whom they were good. I'm fairly certain that our well being was not a high priority.
bediger4000 11y ago
This is the most interesting Hacking Team revelation yet. First, a production UEFI bootkit! Yahoo! That's a milestone. Second, fiddling with Bitcoin wallets. Between the bootkit and the Bitcoin fiddling, Hacking Team is just a small step away from a Zeus Botnet. That is, HT is hanging ten on the precipice of crime, it looks like. Third, this line from HT CEO David Vincenzetti: a modification of the actual Bitcoiin [sic], something different, fully traceable and supported by clearing houses and the global financial system as a whole might have a future. If truly Vincenzetti's viewpoint, that line demonstrates a slide to authoritarianism. According to accounts, Vincenzetti was an early privacy advocate. A cypherpunk wouldn't be able to speak the phrase "fully traceable" except as an insult. Are we seeing the result of money corrupting, or are authoritarian world views the inevitable result of working in the defense industrial complex?
- UserRights 11y ago
  brain washing works very well, just look at this: http://defcon.ws/ http://defcon.ws/
  - NullCharacter 11y ago
    You do realize that's a joke, right? It's not real. Directly from the source: 
    - UserRights 11y ago
      I did not know that this is an open source website. How did you hack this informations?
      - graedus 11y ago
        view source
      - NullCharacter 11y ago
        facepalm
userbinator 11y ago
Look up Computrace; it's very similar in operation but is installed by default in most BIOS' as a theft-prevention measure. Admins managing servers can also opt to buy a server with physical BIOS write-protection, wherein the user will need to put a jumper or turn on a dip switch in order to update the BIOS. Motherboards with hardware write-protected BIOSes were common around the turn of the century, when flash EEPROMs started replacing EPROMs for BIOS storage. Too bad the amount of tiny extra BOM cost and what seems to be increasingly buggier BIOSes that require frequent updates has made them mostly disappear... I wonder how much the "it can always be updated later" mentality prevalent today has lead to a higher defect rate in code - it seems to me that if it's harder to change something once it's released, there is more incentive to get it right the first time. I can't remember there being any significant bugs with BIOS in the early machines I used (386/486 era) and those basically never needed to be updated; although PCs have gotten considerably more complex since, especially with things like UEFI, perhaps not all of that complexity is warranted and it wouldn't have manifested itself if BIOS' had remained difficult-to-modify?
fdb 11y ago
Silly question perhaps, but does this apply to Macs as well?

112 points by apaprocki 11y ago

pgib 11y ago

https://dl.dropboxusercontent.com/u/31250/gifs/buster-panicked.gif https://dl.dropboxusercontent.com/u/31250/gifs/buster-panick...

paulmd 11y ago

Hey guys that BadBios is totally impossible, agreed? What a scrub, UEFI viruses are impossible. lol psychotic break amirite I caught a message on the Windows install rebooot about "Intel AMT activated" during a clean reformat - but in BIOS it shows deactivated on reboot. Kaspersky/Malwarebytes/CCleaner shows clean on every scan for system files - I'm seriously wondering whether I need to dump this machine hardware and all. The cause for the reformat in the first place was a potential virus infection, maybe a rootkit. I didn't want to let it back on my network after I scanned a cryptolocker variant in my temp folder.

scintill76 11y ago
It sounds like you're saying this lends some weight to the BadBIOS theory. No, the main unbelievable feature attributed to BadBIOS is the ability to jump airgaps via ultrasonic communication, which is not mentioned in this article.
- paulmd 11y ago
  When you've got a BIOS-level rootkit, what's unbelievable about a hardware-level transmission mechanism? If an OS can load device drivers, why not an exploit toolkit? Again, the problem with the BadBios story (?) from a security-level perspective was that it came from the head of a top-level security consultant - so it's hard to know if it's true or not, because if he was chasing at system ghosts, they were 100% feasible system ghosts, with Proof Of Concepts delivered (eg reception of ultrasonic transmission via laptop speakers [1]). At this point I do believe they were ghosts, but if you want to analyze them - posting about an actively-administered rootkit installation on your LAN on the internet was a mistake, because once detected the attackers would pull back. And the more we learn about state-level cyberattacks, the more that potential attack rings true. It's just a question of tradeoff - do you really think that at least one party who could mount an A-grade cyberattack would do so against one of the people most likely to detect and analyze it, versus the chance to see what exists in his systems? When you get down to it, once infected you cannot trust so basic a system as a hard drive, and the NSA has attacked that firmware [2]. See: Reflections on Trusting Trust. [3] And that's about 90% of Dragos' sins right there - not trusting systems (or even components) that were exposed to unknown exploits translates as "paranoia" to the average user. [1] http://www.jocm.us/index.php?m=content&c=index&a=show&catid=124&id=600 http://www.jocm.us/index.php?m=content&c=index&a=show&catid=... [2] http://www.wired.com/2015/02/nsa-firmware-hacking/0 http://www.wired.com/2015/02/nsa-firmware-hacking/0 [3] https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
  - pgeorgi 11y ago
    The claim of BadBIOS was that it was supposed to infect new devices through the audio channel. While Hanspach et al demonstrate the data transmission vector, it's no infection vector. For that, you'd need to be able to exploit the HD Audio codec (or whatever chip gets to interpret the signal) - and there are dozens of models by different vendors out there. That's a very different claim.
    - acdha 11y ago
      Coverage at the time only mentioned the audio claims as a side channel for systems which were already infected: http://blog.erratasec.com/2013/10/badbios-features-explained.html http://blog.erratasec.com/2013/10/badbios-features-explained... “Dragos believes that two infected computers can communicate with each other over the audio port in frequencies above human hearing, thus allowing an "air gapped" computer to still communicate over the Internet.” http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/ http://arstechnica.com/security/2013/10/meet-badbios-the-mys... “Ruiu said he arrived at the theory about badBIOS's high-frequency networking capability after observing encrypted data packets being sent to and from an infected laptop that had no obvious network connection with—but was in close proximity to—another badBIOS-infected computer.” EDIT: just to be clear, I think this was some sort of mental breakdown but as Rob Graham noted none of what was described was obviously impossible – it would just have had to be executed at a higher level than we've seen before, even with something like Stuxnet, with e.g. exploits & persistent rootkits for huge ranges of hardware.
      - pgeorgi 11y ago
        From your second link: "We had an air-gapped computer that just had its [firmware] BIOS reflashed, a fresh disk drive installed, and zero data on it, installed from a Windows system CD," Ruiu said. "At one point, we were editing some of the components and our registry editor got disabled. It was like: wait a minute, how can that happen? How can the machine react and attack the software that we're using to attack it? This is an air-gapped machine and all of a sudden the search function in the registry editor stopped working when we were using it to search for their keys." There are four claims in here: - firmware is fresh - OS is fresh - system is air-gapped - infection happened The next two paragraphs introduce the network-over-audio theory, which requires an already-infected system (although with no causal link). This could also be HDD firmware infection or similar, or maybe their flashing attempt was unsuccessful (when done internally, not with an external flasher, that would be reasonable). Still, articles like this are probably the reason for people (myself included) remembering a claim that infection happened through audio channels.
- kpcyrd 11y ago
  Like this? https://github.com/Katee/quietnet https://github.com/Katee/quietnet
  - deleted 11y ago
    [deleted]
  - scintill76 11y ago
    Sure, looks cool. But if you're trying to convince anyone that BadBIOS can work as claimed, I won't be impressed until I see one system running quietnet install quietnet onto another system with a standard fresh install of Windows, Mac OS X, BSD, or Linux; using only ultrasonic communication.
    - acdha 11y ago
      Did Dragos ever claim that BadBIOS used sound as an infection mechanism rather than a side-channel for communications between systems which were already infected? If memory serves, nothing he claimed was something that hasn't been demonstrated to be possible – only that the combination would have had to be better executed than anything we've ever seen before and, of course, the evidence never materialized. That fits with the current consensus that it was the product of some sort of mental issue – it's the superset of everything a security researcher might know to be theoretically possible.
      - scintill76 11y ago
        I agree with your later comment, that it's unclear whether ultrasonic infection was actually claimed. For purposes of this thread, which started by trying to refute the position, "BadBios is totally impossible" -- the "impossible" claim the mainstream is probably referring to is infection purely by ultrasonic transmission. There's no need to prove that ultrasonic communication is plausible, or that rootkits can be installed in BIOS, EFI, harddrive controller, etc. It is impressive to see such exotic attacks actually being used, though.
alfiedotwtf 11y ago
Just curious, is there any reason why you may be considered an interesting target to the NSA and friends?
- UserRights 11y ago
  Maybe he is against war? Against cancer? Against GMO? Maybe he is just reading the wrong websites? maybe he is writing critical comments on HN?
- paulmd 11y ago
  No, I'm more suspicious of generic botnet/ransomware stuff. Which probably isn't anything that sophisticated. That was yesterday. Having slept on it, I think the most likely cause is that I happened on a key combination that tries to poll status or activate AMT during POST/early boot (eg maybe something for service techs to load/auto-configure AMT off PXE or USB or something). An auto-loader for AMT wouldn't thrill me either, of course. Finding a cryptolocker installer in my Temp folder just has me running paranoid, I've never seen that particular message appear before, and it was gone before I could really get a good look. Managed to dig up this paper on some of the potential black-hat applications of AMT [1]. Happened on another interesting one on Intel SGX [2]. It's certainly a net positive to have virtualization/sandboxing, secure enclaves, etc in our systems - but it always bugs me that they paradoxically create the potential for rootkits that are impossible to pry out once they're situated. The idea of a platform-neutral technology that could serve as a vector for malware is a particularly disturbing one to me. Developing viruses for each individual BIOS implementation is something of a barrier to large-scale contagion of such malware, but there's probably a much smaller number of (eg) AMT or SGX versions with significant code overlap. [1] http://me.bios.io/images/0/0f/Csk_lacon12_intel_amt.pdf http://me.bios.io/images/0/0f/Csk_lacon12_intel_amt.pdf [2] http://theinvisiblethings.blogspot.com/2013/09/thoughts-on-intels-upcoming-software.html http://theinvisiblethings.blogspot.com/2013/09/thoughts-on-i...
- na85 11y ago
  Perhaps he uses cryptography or has visited China. That's all it takes.

defective 11y ago

Luckily, this at least requires physical access.

higherpurpose 11y ago
Perfect for TAO.

TerryADavis 11y ago

nigger probably an atheist.

acd 11y ago

This is what I thought when viewing my latest computer that came with an UEFI bios. That the UEFI BIOS is to large and too complex and has way to many functions to be a BIOS device, hence a perfect place to put advanced malware. It's like an operating system before the operating system, has its own FAT32 system partition where you can store stuff. Also after a few years your manufacturer will stop shipping uefi BIOS updates for your computer due to their interest in selling new computers and then there will be a lurking security whole laying around.

throwaway7767 11y ago
All of this is equally possible on plain old BIOS. One way that's been done in the past is to write a small hook into the SMM handler. Don't even need to drop any malware into windows, once you're in SMM mode you are running completely outside the view of the OS, with full access to everything in memory.
RexRollman 11y ago
UEFI is simply over-engineered.
- wyldfire 11y ago
  And yet traditional BIOSes reuse features, implementation and design from the dawn of personal computing. They strike me as an unreliable black art. Bootstrapping computers is "hard" and there's a huge disincentive to breaking compatibility with operating systems' installation/bootstrapping. I'm not sure if EFI/UEFI are ideal, but it strikes me as a net win.
  - RexRollman 11y ago
    Without a doubt, the classic BIOS needed improvement, but we didn't need this. The situation reminds me of IPv6, which is also grossly over-engineered.
JustSomeNobody 11y ago
What ever happened to the 'B' in BIOS?

z3t4 11y ago

All it takes to install a (BIOS) rootkit is root access ... In windows this means answering Yes on the question "Do you want to allow the following program to make changes to your computer". Remember to flash the BIOS if you've been hacked!

throwaway7767 11y ago
If your system firmware has already been compromised, you cannot trust that reflashing it will bring it back to a good state. Flashing relies on assistance from the existing system firmware on modern machines. You would have to open the machine, desolder the flash chips and re-write them in a flash programmer to get a clean slate. Or, if your adversary is very high-level, just throw the machine away, since you'll never be able to find all the places one could hide persistent malware in hardware. Once you lose physical control of a machine, it's game over if you are concerned about hardware/firmware attacks.
- raverbashing 11y ago
  No need to desolder, several ones are removable Some motherboards even have a backup one
  - snuxoll 11y ago
    > Some motherboards even have a backup one Are they detached and non-writable while the primary ROM is active? I have consistently used Gigabyte boards for a decade because of the extra features that come with them, Backup BIOS being a key one — in the old days I would have to flip a jumper on the board to make the system boot from the backup, today the secondary ROM gets automatically enabled if the primary one fails to load. I wouldn't trust the secondary flash ROM on my motherboard to protect me from APT, it's only purpose is to recover from a failed flash.
    - raverbashing 11y ago
      Yeah, I'm not sure if they're read only without a jumper or software writeable without any protection

gesman 11y ago

UEFI BIOS - Road to hell that was paved with good intentions

Someone1234 11y ago
Why exactly? A lot of people's issues with uEFI seem to stem from Secure Boot (and the lack of additional CAs contained within). And while I grant that Secure Boot is problematic, uEFI is actually taking us away from black box firmware that was BIOS. In many ways this type of stuff has always been possible, the only difference is the skill threshold has been lowered. So I guess the question is do you believe in the phase: "Ignorance is bliss?" Because that's what you're asking for, back to BIOS where these things are still readily do-able, just requires more technical skill and time.
the_why_of_y 11y ago
I'm confused, what's a "UEFI BIOS"? Does that mean UEFI firmware with the "Compatibility Support Module" enabled?
rbanffy 11y ago
About the intentions it was paved with, we have to ask to whom they were good. I'm fairly certain that our well being was not a high priority.

bediger4000 11y ago

This is the most interesting Hacking Team revelation yet. First, a production UEFI bootkit! Yahoo! That's a milestone. Second, fiddling with Bitcoin wallets. Between the bootkit and the Bitcoin fiddling, Hacking Team is just a small step away from a Zeus Botnet. That is, HT is hanging ten on the precipice of crime, it looks like. Third, this line from HT CEO David Vincenzetti: a modification of the actual Bitcoiin [sic], something different, fully traceable and supported by clearing houses and the global financial system as a whole might have a future. If truly Vincenzetti's viewpoint, that line demonstrates a slide to authoritarianism. According to accounts, Vincenzetti was an early privacy advocate. A cypherpunk wouldn't be able to speak the phrase "fully traceable" except as an insult. Are we seeing the result of money corrupting, or are authoritarian world views the inevitable result of working in the defense industrial complex?

UserRights 11y ago
brain washing works very well, just look at this: http://defcon.ws/ http://defcon.ws/
- NullCharacter 11y ago
  You do realize that's a joke, right? It's not real. Directly from the source: 
  - UserRights 11y ago
    I did not know that this is an open source website. How did you hack this informations?
    - graedus 11y ago
      view source
    - NullCharacter 11y ago
      facepalm

userbinator 11y ago

Look up Computrace; it's very similar in operation but is installed by default in most BIOS' as a theft-prevention measure. Admins managing servers can also opt to buy a server with physical BIOS write-protection, wherein the user will need to put a jumper or turn on a dip switch in order to update the BIOS. Motherboards with hardware write-protected BIOSes were common around the turn of the century, when flash EEPROMs started replacing EPROMs for BIOS storage. Too bad the amount of tiny extra BOM cost and what seems to be increasingly buggier BIOSes that require frequent updates has made them mostly disappear... I wonder how much the "it can always be updated later" mentality prevalent today has lead to a higher defect rate in code - it seems to me that if it's harder to change something once it's released, there is more incentive to get it right the first time. I can't remember there being any significant bugs with BIOS in the early machines I used (386/486 era) and those basically never needed to be updated; although PCs have gotten considerably more complex since, especially with things like UEFI, perhaps not all of that complexity is warranted and it wouldn't have manifested itself if BIOS' had remained difficult-to-modify?

fdb 11y ago

Silly question perhaps, but does this apply to Macs as well?