Hacking Team's Malware Uses a UEFI Rootkit

htbios1.png

Technical support provided by Hacking Team

Surveillance software maker Hacking Team has provided its government customers with the ability to infect the low-level firmware found in laptops and other computers that they wanted to spy on.

The company developed a tool that can be used to modify a computer’s UEFI (Unified Extensible Firmware Interface) so that it silently reinstalls its surveillance tool even if the hard drive is wiped clean or replaced.

UEFI is a replacement for the traditional BIOS (Basic Input/output System) and is meant to standardize modern computer firmware through a reference specification. But there are multiple companies that develop UEFI firmware, and there can be significant differences between the implementations used by PC manufactures.

Hacking Team developed a method for infecting the UEFI firmware developed by Insyde Software, a Taiwanese company that counts Hewlett-Packard, Dell, Lenovo, Acer and Toshiba among its customers, according to security researchers from antivirus vendor Trend Micro.
“However, the code can very likely work on AMI BIOS as well,” the Trend Micro researchers said in a blog post. AMI BIOS refers to firmware developed by American Megatrends, a long-time BIOS market leader.

Trend Micro found details about the UEFI rootkit in the more than 400GB worth of files and emails that were leaked recently from Milan-based Hacking Team by a hacker. For the past week, security researchers and journalists have been sifting through the data uncovering malware source code, client lists, exploits for unpatched vulnerabilities and more information.
A Hacking Team slideshow presentation suggests that installing the UEFI rootkit requires physical access to the target computer, but remote installation can’t be ruled out, the Trend Micro researchers said.
Gaining temporary physical access to some computers wouldn’t be a big problem for government agencies, because many countries have laws that allow the inspection of laptops and other devices at their borders.

Hacking Team refers to its surveillance software as “the hacking suite for governmental interception” and claims to sell it only to government agencies. Even so, most antivirus vendors detect the highly intrusive software, which is known as Remote Control System (RCS) or Galileo, as malware.

To install the RCS UEFI rootkit, an attacker must reboot the system into the UEFI shell, extract the firmware, write the rootkit to the dumped image and then flash it back to the system, the Trend Micro researchers said. The rootkit itself has three modules: one for reading and writing to NTFS file systems; one for hooking the OS boot process; and one that checks if RCS is present on the system.

The rootkit checks for the existence of two software agents called scout.exe and soldier.exe every time the system is rebooted. If they don’t exist, it installs scout.exe at a predefined location inside the OS, the Trend Micro researchers said.
The possibility of installing rootkits into a computer’s BIOS, or UEFI, firmware has been demonstrated by multiple researchers at security conferences over the past several years. However, known cases of such rootkits being used in the wild are extremely rare.

A search through the email communications leaked from Hacking Team reveals that the company’s engineers have kept an eye out for every article and research paper on BIOS and UEFI hacking written since 2009. This includes blog posts on cracking BIOS passwords, papers on defeating signed BIOS enforcement and leaked documents about the US National Security Agency’s BIOS infecting capabilities.
The emails also show that the company’s research and development team was working on the “persistent UEFI infection” feature since at least mid-2014. 

In December, Hacking Team’s operations manager Daniele Milan asked a senior security engineer for clarifications on the feature in order to answer potential customer inquiries. The engineer responded that the feature was tested successfully on Dell Latitude 6320, Dell Precision T1600, Asus X550C and Asus F550C. It also worked on Toshiba Satellite C50 and the Acer Aspire E1-570, but with a higher risk of failure. In principle, the software works on all laptops, workstations and servers with 64-bit CPU architectures that support Windows 7 and Windows 8 Pro, the engineer said.

In a later email, he mentioned that the “chiavetta” also works on Dell servers. Chiavetta means key in Italian, but it’s also widely used to refer to USB thumb drives, giving a hint about how the UEFI rootkit can be deployed.

To prevent such infections, Trend Micro advises users to enable the UEFI SecureFlash option, to set up a BIOS/UEFI password and to update the firmware to its latest version so that it has the latest security patches. 

PCWorld

 

« Finland – Prolific Hacker Arrested & Sentenced
Delivered: America’s Drone Debut »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jumpsec

Jumpsec

Jumpsec provides penetration testing, security assessments, social engineering testing, cyber incident response, training and consultancy services.

Netteam

Netteam

Netteam designs, implements and services networking solutions for companies of all sizes.

Sentia

Sentia

Sentia is an IT and infrastructure firm, with focus on Outsourcing, IT operation and management, Hosting, Co-location, Network, and IT security.

Hornetsecurity

Hornetsecurity

Meet Hornetsecurity – Leading Cloud Email Security Provider. We protect global organizations so you can focus on what you do best.

Eco Recycling (Ecoreco)

Eco Recycling (Ecoreco)

Eco Recycling is India's first and leading professional E-waste Management Company that has set industry benchmarks with its innovative & environment friendly disposal practices.

ISA Security Compliance Institute (ISCI)

ISA Security Compliance Institute (ISCI)

ISCI, a not-for-profit automation controls industry consortium, manages the ISASecure™ conformance certification program for industrial automation and control systems.

Red Sky Alliance

Red Sky Alliance

Red Sky Alliance (Wapack Labs Corp) is a cyber threat intelligence firm that delivers proprietary intelligence data, analysis and in-depth strategic reporting.

Cranfield University

Cranfield University

Cranfield Defence and Security are at the forefront of their fields, offering capabilities ranging from cyber security and digital warfare to robotics, forensic sciences and simulation and analytics.

Rootshell Security

Rootshell Security

Rootshell Security is transforming vulnerability management with its vendor-agnostic Prism Platform and industry-leading offensive security assessments.

Schillings

Schillings

Shillings defends your rights to privacy, reuptation and security. We fight passionately against breaches of your privacy, attacks on your reputation and threats to your security.

Jericho Security

Jericho Security

Jericho Security is on a mission to defend the world from the new threats of generative AI cyber attacks.

Veza Technologies

Veza Technologies

Veza is the authorization platform for data. Built for hybrid, multi-cloud environments, Veza enables organizations to manage and control who can and should take what action on what data.

Sev1Tech

Sev1Tech

Sev1Tech is a leading provider of IT modernization, cloud, cybersecurity, engineering, fielding, training, and program support services.

Aardwolf Security

Aardwolf Security

Aardwolf Security specialise in penetration testing to the highest standards set out by OWASP. We ensure complete client satisfaction and aftercare.

Anzen Technology Systems

Anzen Technology Systems

Anzen create software solutions which allows organisations to utilize the public cloud for sensitive or classified information, whilst increasing data security and retaining data sovereignty.

WBM Technologies

WBM Technologies

WBM Technologies is a Western Canadian leader in the provision of outcomes-driven information technology solutions.