Jump to content

Hacking Team Uses UEFI BIOS Rootkit

jos
By jos
in Tech News
 Share
Posted
Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running.
 
They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops).  However, the code can very likely work on AMI BIOS as well.
 
The intruder gets access to the target computer, reboots into UEFI shell, dumps the BIOS, installs the BIOS rootkit, reflashes the BIOS, and then reboots the target system.
 
We’ve found that Hacking Team developed a help tool for the users of their BIOS rootkit, and even provided support for when the BIOS image is incompatible:

 

 
 
The hacking team was just terrible.. 
 

 

Vote For your Favorite Windows Here

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaand we're all done for.

 

gravestone-clipart-tombstone-clipart-R_I

4690K // 212 EVO // Z97-PRO // Vengeance 16GB // GTX 770 GTX 970 // MX100 128GB // Toshiba 1TB // Air 540 // HX650

Logitech G502 RGB // Corsair K65 RGB (MX Red)

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Damn that is bad. Reminds me  of BadBios and that one FireWire firmware hack.

"Great minds discuss ideas; average minds discuss events; small minds discuss people."

Main rig:

i7-4790 - 24GB RAM - GTX 970 - Samsung 840 240GB Evo - 2x 2TB Seagate. - 4 monitors - G710+ - G600 - Zalman Z9U3

Other devices

Oneplus One 64GB Sandstone

Surface Pro 3 - i7 - 256Gb

Surface RT

Server:

SuperMicro something - Xeon e3 1220 V2 - 12GB RAM - 16TB of Seagates 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I thought BIOS firmwares were too sensitive to changes in code and size for this kind of stuff to be so easily done?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Well if your Tony Stark this isn't an issue.

Nvidia is to Dr Dre Beets as AMD is to KFC.

One makes you broke, the other you can get more of and have a midnight snack from the fridge when hungry again. Once you go Nvidia, you go broked, turn into an Elitist, or get the incorrect amount of VRAM.


- WCCFTECH

 I was only 9 years old. I loved Fifflaren so much, I had all the NiP merchandise and matches pirated. I prayed to Fifflaren every night before bed. Thanking him for the life I have been given. Fifflaren is love I say. Fifflaren is life. My dad hears and calls me a fuckhead. I knew he was just jelly of my passion for Fifflaren. I called him a Sw@yer. He hits me and sends me to go to sleep. I'm crying now, and my face hurts. I lay in bed and it's really cold. A warmth is moving towards me. I feel someone touching me. I feel someone touching me. It's Fifflaren. I am so happy. He whispers in my ear; "this is my pyjama". He grabs me with his powerful Swedish hands and puts me on my hands and knees. I'm ready. I spread my ass cheeks for Fifflaren. He penetrates my butt-hole. It hurts so much but I do it for Fifflaren. I can feel my butt tearing as my eyes start to water. I push against his force. I want to please Fifflaren. He roars a viking roar as he fills my butt with his love. My dad walks in. Fifflaren looks straight into his eyes and says; "He is a ninja now". Fifflaren is love, Fifflaren is life 
Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Damn that is bad. Reminds me of BadBios and that one FireWire firmware hack.

I still have FireWire on my PC and I bought it around the time USB 3.0 became a thing, WHAT AM I SUPOSED TO DO WITH THIS SHIT IT JUST TAKES UP SPACE ON MY CASE :/

I spent $2500 on building my PC and all i do with it is play no games atm & watch anime at 1080p(finally) watch YT and write essays...  nothing, it just sits there collecting dust...

Builds:

The Toaster Project! Northern Bee!

 

The original LAN PC build log! (Old, dead and replaced by The Toaster Project & 5.0)

Spoiler

"Here is some advice that might have gotten lost somewhere along the way in your life. 

 

#1. Treat others as you would like to be treated.

#2. It's best to keep your mouth shut; and appear to be stupid, rather than open it and remove all doubt.

#3. There is nothing "wrong" with being wrong. Learning from a mistake can be more valuable than not making one in the first place.

 

Follow these simple rules in life, and I promise you, things magically get easier. " - MageTank 31-10-2016

 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

UEFI has always been a bad idea from the start, it didnt fix many of the issues legacy bios had and added larger surface area for security issues many opposed it .

it should have been coreboot

If your grave doesn't say "rest in peace" on it You are automatically drafted into the skeleton war.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

UEFI has always been a bad idea from the start, it didnt fix many of the issues legacy bios had and added larger surface area for security issues many opposed it .

it should have been coreboot

a read a few articles about that when it was first coming around, i thought the main thing they wanted to fix with a UEFI was security and while they are at it make add a GUI because text based scared the new comers

cpu: intel i5 4670k @ 4.5ghz Ram: G skill ares 2x4gb 2166mhz cl10 Gpu: GTX 680 liquid cooled cpu cooler: Raijintek ereboss Mobo: gigabyte z87x ud5h psu: cm gx650 bronze Case: Zalman Z9 plus


Listen if you care.

Cpu: intel i7 4770k @ 4.2ghz Ram: G skill  ripjaws 2x4gb Gpu: nvidia gtx 970 cpu cooler: akasa venom voodoo Mobo: G1.Sniper Z6 Psu: XFX proseries 650w Case: Zalman H1

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

How does this bode for something like intercepted PC's or motherboards in the factory or in transit? How quickly could you infect computers headed for sensitive use cases?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

How does this bode for something like intercepted PC's or motherboards in the factory or in transit? How quickly could you infect computers headed for sensitive use cases?

 

 

Lets say you work for Company X and you need new routers for your network for a system upgrade. You email/call the manufacturer and make a purchase of 5 enterprise routers. Company B packages the equipment and ships it out to you. Somewhere along the line the routers are intercepted and they are infected with the tainted firmware, repackaged and put back on a truck. You get the package and install them into the core of your network. Now the attacker has access to your network and you'll never know, never be able to kick them off the network without replacing tainted equipment that you don't know is there. This type of attack could happen in one day, maybe it delays the shipping, maybe not. It wouldn't take long though. 

 

Now keep in mind for a second that this has already happened. 

 

http://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Secure boot and Secure Flash (some boards put them together) needs to be disabled for it to work.
Make sure Secure boot/flash is enabled, as suggested in the article, and you are good.

 

The only way to by-pass this is the UEFI maker or motherboard manufacture is careless and leaks out the digital signature needed to update the UEFI. Or the hackers where able to get it, and sign their own thing.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Couldn't you just use Intel Flash ToolKit to erase the bios and rewrite it while in Windows? Not flash, erase and rewrite

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Secure boot and Secure Flash (some boards put them together) needs to be disabled for it to work.

Make sure Secure boot/flash is enabled, as suggested in the article, and you are good.

The only way to by-pass this is the UEFI maker or motherboard manufacture is careless and leaks out the digital signature needed to update the UEFI. Or the hackers where able to get it, and sign their own thing.

Home users have secure boot on by default now... For new pcs anyway and all uefi attacks I've seen require local access...

Everything you need to know about AMD cpus in one simple post. † Christian Member †

Wii u, ps3(2 usb fat),ps4

Iphone 6 64gb and surface RT

Hp DL380 G5 with one E5345 and bunch of hot swappable hdds in raid 5 from when i got it. intend to run xen server on it

Apple Power Macintosh G5 2.0 DP (PCI-X) with notebook hdd i had lying around 4GB of ram

TOSHIBA Satellite P850 with Core i7-3610QM,8gb of ram,default 750hdd has dual screens via a external display as main and laptop display as second running windows 10

MacBookPro11,3:I7-4870HQ, 512gb ssd,16gb of memory

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

And that's why soldered on Bios chips are dumb :D

Case: NZXT Phantom PSU: EVGA G2 650w Motherboard: Asus Z97-Pro (Wifi-AC) CPU: 4690K @4.2ghz/1.2V Cooler: Noctua NH-D15 Ram: Kingston HyperX FURY 16GB 1866mhz GPU: Gigabyte G1 GTX970 Storage: (2x) WD Caviar Blue 1TB, Crucial MX100 256GB SSD, Samsung 840 SSD Wifi: TP Link WDN4800

 

Donkeys are love, Donkeys are life.                    "No answer means no problem!" - Luke 2015

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Terrible. I knew it this will happen eventually. But still wow, this is bad.

| Ryzen 7 7800X3D | AM5 B650 Aorus Elite AX | G.Skill Trident Z5 Neo RGB DDR5 32GB 6000MHz C30 | Sapphire PULSE Radeon RX 7900 XTX | Samsung 990 PRO 1TB with heatsink | Arctic Liquid Freezer II 360 | Seasonic Focus GX-850 | Lian Li Lanccool III | Mousepad: Skypad 3.0 XL / Zowie GTF-X | Mouse: Zowie S1-C | Keyboard: Ducky One 3 TKL (Cherry MX-Speed-Silver) | Beyerdynamic MMX 300 (2nd Gen) | Acer XV272U | OS: Windows 11 |

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I would say the scariest thing would be buying uefi PC rootkitting the uefi... Then stealing people info using it.

Everything you need to know about AMD cpus in one simple post. † Christian Member †

Wii u, ps3(2 usb fat),ps4

Iphone 6 64gb and surface RT

Hp DL380 G5 with one E5345 and bunch of hot swappable hdds in raid 5 from when i got it. intend to run xen server on it

Apple Power Macintosh G5 2.0 DP (PCI-X) with notebook hdd i had lying around 4GB of ram

TOSHIBA Satellite P850 with Core i7-3610QM,8gb of ram,default 750hdd has dual screens via a external display as main and laptop display as second running windows 10

MacBookPro11,3:I7-4870HQ, 512gb ssd,16gb of memory

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Lets say you work for Company X and you need new routers for your network for a system upgrade. You email/call the manufacturer and make a purchase of 5 enterprise routers. Company B packages the equipment and ships it out to you. Somewhere along the line the routers are intercepted and they are infected with the tainted firmware, repackaged and put back on a truck. You get the package and install them into the core of your network. Now the attacker has access to your network and you'll never know, never be able to kick them off the network without replacing tainted equipment that you don't know is there. This type of attack could happen in one day, maybe it delays the shipping, maybe not. It wouldn't take long though. 

 

Now keep in mind for a second that this has already happened. 

 

http://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden

 

I'm not sure why, but as easy as you made that sound and how its happened before makes me queasy.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I'm not scared.

Mobo: Z97 MSI Gaming 7 / CPU: i5-4690k@4.5GHz 1.23v / GPU: EVGA GTX 1070 / RAM: 8GB DDR3 1600MHz@CL9 1.5v / PSU: Corsair CX500M / Case: NZXT 410 / Monitor: 1080p IPS Acer R240HY bidx

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Use UEFI they said. It's secure they said.

It is. If you turn on UEFI SecureFlash. Its not if you leave it disabled. Your fault if you do lol

System Specs:

CPU: Ryzen 7 5800X

GPU: Radeon RX 7900 XT 

RAM: 32GB 3600MHz

HDD: 1TB Sabrent NVMe -  WD 1TB Black - WD 2TB Green -  WD 4TB Blue

MB: Gigabyte  B550 Gaming X- RGB Disabled

PSU: Corsair RM850x 80 Plus Gold

Case: BeQuiet! Silent Base 801 Black

Cooler: Noctua NH-DH15

 

 

 

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Tech News

×