Chinese hacker group spotted using a UEFI bootkit in the wild

[silversurfer]

Content source

https://www.zdnet.com/article/chinese-hacker-group-spotted-using-a-uefi-bootkit-in-the-wild/

A Chinese-speaking hacking group has been observed using a UEFI bootkit to download and install additional malware on targeted computers.

UEFI firmware it is a crucial component for every computer. This crucial firmware inside a flash memory bolted to the motherboard and controls all the computer's hardware components and helps boot the actual user-facing OS (such as Windows, Linux, macOS, etc.).

Attacks on UEFI firmware are the Holy Grail of every hacker group, as planting malicious code here allows it to survive OS reinstalls.

Nonetheless, despite these benefits, UEFI firmware attacks are rare because tampering with this component is particularly hard as attackers either need physical access to the device or they need to compromise targets via complex supply chain attacks where the UEFI firmware or tools that work with UEFI firmware are modified to insert malicious code.

In a talk at the SAS virtual security conference today, security researchers from Kaspersky said they detected the second known instance of a widespread attack leveraging malicious code implanted in the UEFI.

Read more: Chinese hacker group spotted using a UEFI bootkit in the wild | ZDNet

Full report by researchers from Kaspersky: MosaicRegressor: Lurking in the Shadows of UEFI

 

[Minimalist]

It looks like rootkit scanning in Kaspersky products was used to find it. So rootkit scanning probably should not be disabled as sometimes advised.
Related wiki article: https://www.kaspersky.com/enterpris...ducts/anti-rootkit-and-remediation-technology

 

[[correlate]]

WHEN A HACKING organization’s secret tools are stolen and dumped online for anyone to pick up and repurpose, the consequences can roil the globe. Now one new discovery shows how long those effects can persist. Five years after the notorious spy contractor Hacking Team had its code leaked online, a customized version of one of its stealthiest spyware samples has shown up in the hands of possibly Chinese-speaking hackers.

A China-Linked Group Repurposed Hacking Team’s Stealthy Spyware

The tool attacks a device’s UEFI firmware—which makes it especially hard to detect and destroy.

www.wired.com

 

[Andy Ful]

Read more: Chinese hacker group spotted using a UEFI bootkit in the wild | ZDNet

Full report by researchers from Kaspersky: MosaicRegressor: Lurking in the Shadows of UEFI

This malware requires physical access to the device. It is one of a few examples of UEFI malware used in the wild (another UEFI malware was used by the Fancy Bear Russian hacker group). Such malware is extremely rare in the wild. I think that similar malwares are is in the arsenal of many agencies (CIA for sure).

Edit.
Te UEFI malware can be implanted also by exploiting the UEFI update mechanism and other UEFI exploits.

Black Hat 2018: Update Mechanisms Allow Remote Attacks on UEFI Firmware

The glitch stems from a functionality intended to allow updates to the UEFI firmware.

threatpost.com

https://www.uefi.org/sites/default/files/resources/UEFI%20Firmware%20-%20Security%20Concerns%20and%20Best%20Practices.pdf

 

[silversurfer]

This malware requires physical access to the device. It is one of a few examples of UEFI malware used in the wild (another UEFI malware was used by the Fancy Bear Russian hacker group). Such malware is extremely rare in the wild. I think that similar malwares are is in the arsenal of many agencies (CIA for sure).

How do you know this malware is just "extremely rare in the wild" as experts said this UEFI bootkit is using in the wild, so nobody here knows all facts...

 

[Andy Ful]

How do you know this malware is just "extremely rare in the wild" as experts said this UEFI bootkit is using in the wild, so nobody here knows all facts...

The known examples are enumerated in the article.

A China-Linked Group Repurposed Hacking Team’s Stealthy Spyware

The tool attacks a device’s UEFI firmware—which makes it especially hard to detect and destroy.

www.wired.com

Furthermore (from the above article):
" But Kaspersky's new UEFI malware discovery is only the second ever obtained from a victim's machine, and in some sense it is the first purpose-built UEFI malware to be seen in use. "It's the first known proprietary custom UEFI backdoor that is not based on some well-known white-hat software, but was intended from the beginning to be a malicious one," says Kuznetsov. "

More info can be found in the Kaspersky article:

MosaicRegressor: Lurking in the Shadows of UEFI

We found a compromised UEFI firmware image that contained a malicious implant. To the best of our knowledge, this is the second known public case where malicious UEFI firmware in use by a threat actor was found in the wild.

securelist.com

 

[silversurfer]

The known examples are enumerated in the article.

A China-Linked Group Repurposed Hacking Team’s Stealthy Spyware

The tool attacks a device’s UEFI firmware—which makes it especially hard to detect and destroy.

www.wired.com

Furthermore (from the above article):
" But Kaspersky's new UEFI malware discovery is only the second ever obtained from a victim's machine, and in some sense it is the first purpose-built UEFI malware to be seen in use. "It's the first known proprietary custom UEFI backdoor that is not based on some well-known white-hat software, but was intended from the beginning to be a malicious one," says Kuznetsov. "

Well, there I couldn't find this info as that isn't the same link from the report by zdnet, probably the full report by Kaspersky has all info but that is much content to read... Thanks for point out this info!

 

[upnorth]

This malware requires physical access to the device. It is one of a few examples of UEFI malware used in the wild (another UEFI malware was used by the Fancy Bear Russian hacker group). Such malware is extremely rare in the wild. I think that similar malwares are is in the arsenal of many agencies (CIA for sure).

we were not able to determine the exact infection vector that allowed the attackers to overwrite the original UEFI firmware. Our detection logs show that the firmware itself was found to be malicious, but no suspicious events preceded it. Due to this, we can only speculate how the infection could have happened.

MosaicRegressor: Lurking in the Shadows of UEFI

We found a compromised UEFI firmware image that contained a malicious implant. To the best of our knowledge, this is the second known public case where malicious UEFI firmware in use by a threat actor was found in the wild.

securelist.com

Personal I'm not so sure how actual " rare in the wild " this is today, because several of the payload IOCs is super easy to find on sources like VT, Anyrun, Hybrid etc as they are also pretty old by now. 2017, 2018 etc. The only thing I couldn't find a test result for, is those 4 UEFI modules. Other then the report from Kaspersky themselves.

 

[Andy Ful]

MosaicRegressor: Lurking in the Shadows of UEFI

We found a compromised UEFI firmware image that contained a malicious implant. To the best of our knowledge, this is the second known public case where malicious UEFI firmware in use by a threat actor was found in the wild.

securelist.com

Personal I'm not so sure how actual " rare in the wild " this is today, because several of the payload IOCs is super easy to find on sources like VT, Anyrun, Hybrid etc as they are also pretty old by now. 2017, 2018 etc. The only thing I couldn't find a test result for, is those 4 UEFI modules. Other then the report from Kaspersky themselves.

There are several types of malware that can bypass UEFI secure boot. Most of them can use the exploit to run the payload, but do not change the UEFI firmware. The recent example can be "Boothole" grub2 UEFI secure boot lockdown bypass.
The extremely rare cases are related to the stealthy malware hid in the UEFI firmware.
Are you sure that the payloads that you found could change the UEFI firmware? If you want I can examine the IOCs.

Edit.
There are some reasons to believe the expert from Kaspersky:

1. It is hard to implement such malware on large scale attacks, because there are many different UEFI firmware.
2. Such malware is very useful for spying, so it would not be logical to waste it in other attacks. There are many less stealthy, easier, and cheaper methods to infect computers for profit.

 

[upnorth]

There are several types of malware that can bypass UEFI secure boot. Most of them can use the exploit to run the payload, but do not change the UEFI firmware. The recent example can be "Boothole" grub2 UEFI secure boot lockdown bypass.
The extremely rare cases are related to the stealthy malware hid in the UEFI firmware.
Are you sure that the payloads that you found could change the UEFI firmware? If you want I can examine the IOCs.

No, I'm not 100% sure. Please do, because it would be very interesting.

 

[Andy Ful]

No, I'm not 100% sure. Please do, because it would be very interesting.

Could you PM some links if you will encounter this kind of malware? I did not see such malware for a long time (but I did not seek).