Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

9/27/2018
06:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russia's Sednit Deploys First Firmware-Level Rootkit in the Wild

The advanced persistent threat group's LoJax can install malware capable of surviving both OS reinstallation and hard disk replacement.

Advanced persistent threat (APT) group Sednit has deployed a rootkit capable of modifying a computer's Unified Extensible Firmware Interface (UEFI) to install malware that can survive both an OS reinstallation and hard disk replacement.

Security vendor ESET recently discovered the malware — dubbed LoJax — installed on a system as part of a broader Sednit APT campaign and described it this week as the first UEFI rootkit ever discovered in the wild. The discovery shows that UEFI rootkit attacks — long perceived as a theoretical threat — are a reality, says Alexis Dorais-Joncas, security intelligence team lead at ESET.

"Organizations should review the Secure Boot configuration on their hardware and make sure they are configured properly to prevent unauthorized access to the firmware memory," Dorais-Joncas says. They also need to think about controls for detecting malware at the UEFI/BIOS level, he says.

UEFI is a specification for the interface between a computer's firmware and its operating system. The interface contains information for booting the operating system and for running pre-boot applications. Anyone able to tamper with the interface can make firmware changes that completely compromise the integrity of the system.

In recent years, chipmakers, hardware vendors, OS makers, and others have introduced measures that make it very hard for anyone to make such changes. One example is Secure Boot, a mechanism that ensures only securely signed firmware and software can be booted up and run on a system.

Secure Boot is supported on nearly every modern computer and, when enabled, can make it very hard for someone to make unauthorized changes at the firmware level. Such controls are the reason why security researchers have considered UEFI rootkits as something that typically government and government-backed entities are likely capable of developing and successfully using.

The discovery of LoJax shows that capabilities around UEFI rootkits are developing. "We certainly should expect rootkits of this type to evolve," says Ang Cui, CEO of Red Balloon Security. "We shouldn't be surprised to see more UEFI rootkits in the wild going forward, which could potentially incorporate more advanced capabilities like signature verification bypass."

Stealthy and Persistent
ESET says it discovered LoJax on a system belonging to an organization that the Sednit group is targeting as part of a broad campaign against government entities in the Balkans and also in Central and Eastern Europe. Sednit, aka APT28, Sofacy, and Fancy Bear, is a notorious Russian threat actor, perhaps best known in recent times for its attack on the Democratic National Committee in 2016. The group's success in deploying the rootkit should serve as a warning to those it its crosshairs about the group's growing sophistication.

According to ESET, its analysis shows that the Sednit group used a kernel driver bundled with a legitimate and freely available utility called RWEverything to install the UEFI rootkit. The driver can be used to access a computer's UEFI/BIOS settings and gather information on almost all low-level settings on it.

Sednit bundled RWEverything's functionality into two custom tools. One of the tools was for reading the contents of the flash memory where the UEFI is located and saving the image to a file. The second was a patching tool to add the rootkit to the firmware image and write it back to flash memory, thereby installing it on the system, ESET said.

This module can drop and execute malware on disk during the boot process, making the malware hard to remove even with an OS reinstall and a hard disk replacement, ESET said.

"The infection mechanism was to write the entire UEFI firmware memory with unsigned code," Dorais-Joncas says. However, the same technique — flashing the UEFI firmware — would not work on a modern system with Secure Boot properly enabled, he says.

The only reason it did in this case was because the victim system was likely misconfigured or was running an older Intel chipset. "In this attack, either the firmware did not properly configure the BIOS write protection mechanisms or the victim's machine had a chipset older than the Platform Controller Hub," Dorais-Joncas says.

However, it is a mistake to underestimate the threat all the same. Researchers have previously found several vulnerabilities that bypass UEFI protections and gain write access, so there is no guarantee the same thing can't happen again, he notes.

"We should not assume that Secure Boot will be a magic-bullet solution against UEFI rootkits going forward," Cui says. If not properly locked down, attackers can take advantage of new features that hardware manufacturers have begun implementing, like UEFI, CPU Management Engine, and One Time Protect, in flash to launch devastating attacks.

UEFI, for instance, is a particularly good place for a rootkit to live because it is easier for it to stay persistent and stealthy, Cui says. "On top of that, it can also change the system and modify the OS before the OS loads, giving it lots of ways to change the rules on modern hardware and OS security."

Related Content:

 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Major Brazilian Bank Tests Homomorphic Encryption on Financial Data
Kelly Sheridan, Staff Editor, Dark Reading,  1/10/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft Patches Windows Vuln Discovered by the NSA
Kelly Sheridan, Staff Editor, Dark Reading,  1/14/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Post a Comment
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3683
PUBLISHED: 2020-01-17
The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and...
CVE-2019-3682
PUBLISHED: 2020-01-17
The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.
CVE-2019-17361
PUBLISHED: 2020-01-17
In SaltStack Salt through 2019.2.0, the salt-api NEST API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
CVE-2019-19142
PUBLISHED: 2020-01-17
Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.
CVE-2019-19801
PUBLISHED: 2020-01-17
In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an unprivileged but authenticated user is able to perform a backup of the Command Centre databases.