Vulnerabilities / Threats

9/27/2018
06:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russia's Sednit Deploys First Firmware-Level Rootkit in the Wild

The advanced persistent threat group's LoJax can install malware capable of surviving both OS reinstallation and hard disk replacement.

Advanced persistent threat (APT) group Sednit has deployed a rootkit capable of modifying a computer's Unified Extensible Firmware Interface (UEFI) to install malware that can survive both an OS reinstallation and hard disk replacement.

Security vendor ESET recently discovered the malware — dubbed LoJax — installed on a system as part of a broader Sednit APT campaign and described it this week as the first UEFI rootkit ever discovered in the wild. The discovery shows that UEFI rootkit attacks — long perceived as a theoretical threat — are a reality, says Alexis Dorais-Joncas, security intelligence team lead at ESET.

"Organizations should review the Secure Boot configuration on their hardware and make sure they are configured properly to prevent unauthorized access to the firmware memory," Dorais-Joncas says. They also need to think about controls for detecting malware at the UEFI/BIOS level, he says.

UEFI is a specification for the interface between a computer's firmware and its operating system. The interface contains information for booting the operating system and for running pre-boot applications. Anyone able to tamper with the interface can make firmware changes that completely compromise the integrity of the system.

In recent years, chipmakers, hardware vendors, OS makers, and others have introduced measures that make it very hard for anyone to make such changes. One example is Secure Boot, a mechanism that ensures only securely signed firmware and software can be booted up and run on a system.

Secure Boot is supported on nearly every modern computer and, when enabled, can make it very hard for someone to make unauthorized changes at the firmware level. Such controls are the reason why security researchers have considered UEFI rootkits as something that typically government and government-backed entities are likely capable of developing and successfully using.

The discovery of LoJax shows that capabilities around UEFI rootkits are developing. "We certainly should expect rootkits of this type to evolve," says Ang Cui, CEO of Red Balloon Security. "We shouldn't be surprised to see more UEFI rootkits in the wild going forward, which could potentially incorporate more advanced capabilities like signature verification bypass."

Stealthy and Persistent
ESET says it discovered LoJax on a system belonging to an organization that the Sednit group is targeting as part of a broad campaign against government entities in the Balkans and also in Central and Eastern Europe. Sednit, aka APT28, Sofacy, and Fancy Bear, is a notorious Russian threat actor, perhaps best known in recent times for its attack on the Democratic National Committee in 2016. The group's success in deploying the rootkit should serve as a warning to those it its crosshairs about the group's growing sophistication.

According to ESET, its analysis shows that the Sednit group used a kernel driver bundled with a legitimate and freely available utility called RWEverything to install the UEFI rootkit. The driver can be used to access a computer's UEFI/BIOS settings and gather information on almost all low-level settings on it.

Sednit bundled RWEverything's functionality into two custom tools. One of the tools was for reading the contents of the flash memory where the UEFI is located and saving the image to a file. The second was a patching tool to add the rootkit to the firmware image and write it back to flash memory, thereby installing it on the system, ESET said.

This module can drop and execute malware on disk during the boot process, making the malware hard to remove even with an OS reinstall and a hard disk replacement, ESET said.

"The infection mechanism was to write the entire UEFI firmware memory with unsigned code," Dorais-Joncas says. However, the same technique — flashing the UEFI firmware — would not work on a modern system with Secure Boot properly enabled, he says.

The only reason it did in this case was because the victim system was likely misconfigured or was running an older Intel chipset. "In this attack, either the firmware did not properly configure the BIOS write protection mechanisms or the victim's machine had a chipset older than the Platform Controller Hub," Dorais-Joncas says.

However, it is a mistake to underestimate the threat all the same. Researchers have previously found several vulnerabilities that bypass UEFI protections and gain write access, so there is no guarantee the same thing can't happen again, he notes.

"We should not assume that Secure Boot will be a magic-bullet solution against UEFI rootkits going forward," Cui says. If not properly locked down, attackers can take advantage of new features that hardware manufacturers have begun implementing, like UEFI, CPU Management Engine, and One Time Protect, in flash to launch devastating attacks.

UEFI, for instance, is a particularly good place for a rootkit to live because it is easier for it to stay persistent and stealthy, Cui says. "On top of that, it can also change the system and modify the OS before the OS loads, giving it lots of ways to change the rules on modern hardware and OS security."

Related Content:

 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20029
PUBLISHED: 2018-12-10
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read.
CVE-2018-1279
PUBLISHED: 2018-12-10
Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on ...
CVE-2018-15800
PUBLISHED: 2018-12-10
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.
CVE-2018-15805
PUBLISHED: 2018-12-10
Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an attacker to read arbitrary files or cause a denial of service (resource consumption).
CVE-2018-16635
PUBLISHED: 2018-12-10
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.