First Sednit UEFI Rootkit Unveiled Jean-Ian Boutin | Senior Malware - - PowerPoint PPT Presentation

▶
first sednit uefi rootkit unveiled
SMART_READER_LITE
LIVE PREVIEW

First Sednit UEFI Rootkit Unveiled Jean-Ian Boutin | Senior Malware - - PowerPoint PPT Presentation

May 24, 2023 32 likes •913 views

First Sednit UEFI Rootkit Unveiled Jean-Ian Boutin | Senior Malware Researcher Frdric Vachon | Malware Researcher Frdric Vachon Malware Researcher @Freddrickk_ Agenda What is Sednit LoJack and Past research Compromised

slide-1
SLIDE 1

First Sednit UEFI Rootkit Unveiled

Jean-Ian Boutin | Senior Malware Researcher Frédéric Vachon | Malware Researcher

slide-2
SLIDE 2

Frédéric Vachon

Malware Researcher @Freddrickk_

slide-3
SLIDE 3

Agenda

  • What is Sednit
  • LoJack and Past research
  • Compromised LoJack agents
  • UEFI Rootkit and related tools
slide-4
SLIDE 4

Sednit

(AKA Fancy Bear/APT28/STRONTIUM/etc)

  • Espionage group active since the early 2000s
  • Very visible in the past few years as allegedly

behind these notorious hacks

slide-5
SLIDE 5

Sednit

(AKA Fancy Bear/APT28/STRONTIUM/etc)

  • Espionage group active since the early 2000s
  • Very visible in the past few years as allegedly

behind these notorious hacks

  • Democratic National Committee (DNC)
slide-6
SLIDE 6

Sednit

(AKA Fancy Bear/APT28/STRONTIUM/etc)

  • Espionage group active since the early 2000s
  • Very visible in the past few years as allegedly

behind these notorious hacks

  • Democratic National Committee (DNC)
  • World Anti-Doping Agency (WADA)
slide-7
SLIDE 7

Sednit

(AKA Fancy Bear/APT28/STRONTIUM/etc)

  • Espionage group active since the early 2000s
  • Very visible in the past few years as allegedly

behind these notorious hacks

  • Democratic National Committee (DNC)
  • World Anti-Doping Agency (WADA)
  • TV5 Monde
  • etc
slide-8
SLIDE 8

Sednit

(AKA Fancy Bear/APT28/STRONTIUM/etc)

  • Espionage group active since the early 2000s
  • Very visible in the past few years as allegedly

behind these notorious hacks

  • Democratic National Committee (DNC)
  • World Anti-Doping Agency (WADA)
  • TV5 Monde
  • etc
slide-9
SLIDE 9

Sednit

(AKA Fancy Bear/APT28/STRONTIUM/etc)

  • Espionage group active since the early 2000s
  • Very visible in the past few years as allegedly

behind these notorious hacks

  • Democratic National Committee (DNC)
  • World Anti-Doping Agency (WADA)
  • TV5 Monde
  • etc
slide-10
SLIDE 10

Example of phishing email

slide-11
SLIDE 11

Computrace/LoJack

slide-12
SLIDE 12

Absolute Software

slide-13
SLIDE 13

Past Research

slide-14
SLIDE 14

Black Hat USA 2009

  • Exposed design vulnerabilities in agent
slide-15
SLIDE 15

LoJack Architecture back then

slide-16
SLIDE 16

Configuration file vulnerability

slide-17
SLIDE 17

Configuration file vulnerability

slide-18
SLIDE 18

Configuration file vulnerability

slide-19
SLIDE 19

Digging in

slide-20
SLIDE 20

LoJax - Cat is out of the bag

  • Found modified small agent
  • Links old Sednit domains to Lojax domains
slide-21
SLIDE 21

Where is the attack?

slide-22
SLIDE 22

Where is the attack?

slide-23
SLIDE 23

Changed only configuration file?

  • Almost, and used only one agent version to do

so…

slide-24
SLIDE 24

Changed only configuration file?

  • Almost, and used only one agent version to do

so…

  • Bulk detection now possible – time to dive in
slide-25
SLIDE 25

The Balkans, Central and Eastern Europe victims

  • Few organizations hit
  • Military and diplomatic organizations
  • Presence of several Sednit tools in the
  • rganization
slide-26
SLIDE 26

Analyst ramblings

slide-27
SLIDE 27

autochk.exe mechanism?

slide-28
SLIDE 28

autochk.exe mechanism?

slide-29
SLIDE 29

autochk.exe vs. autoche.exe

slide-30
SLIDE 30

autochk.exe vs. autoche.exe

slide-31
SLIDE 31

autochk.exe vs. autoche.exe

slide-32
SLIDE 32

RWEverything

  • Found on some organizations with LoJax

compromise

  • info_efi.exe
slide-33
SLIDE 33

RWEverything

  • Uefi read tool
slide-34
SLIDE 34

RWEverything

  • Legitimate software

using legitimate kernel driver

  • Not the first time it is

reused for other purposes

slide-35
SLIDE 35

Did they get there?

slide-36
SLIDE 36

Down the rings we go

slide-37
SLIDE 37

ReWriter_read.exe

  • Tool to dump SPI flash memory content found

alongside LoJax sample

IOCTL code Description 0x22280c Writes to memory mapped I/O space 0x222808 Reads from memory mapped I/O space 0x222840 Reads a dword from given PCI Configuration Register 0x222834 Writes a byte to given PCI Configuration Register

slide-38
SLIDE 38

ReWriter_read.exe

  • Contains *lots* of debug strings
  • Consists of the following operations
  • Log information on BIOS_CNTL register
  • Locate BIOS region base address
  • Read UEFI firmware content and dump it to a file
slide-39
SLIDE 39

ReWriter_binary.exe

  • Contains *lots* of debug strings
  • Uses RWEverything’s driver
  • Consists of the following operations
  • Add the rootkit to the firmware
  • Write it back to the SPI flash memory
slide-40
SLIDE 40

Patching the UEFI firmware

slide-41
SLIDE 41

Unified Extensible Firmware Interface (UEFI)

  • Replacement for the legacy BIOS
  • New standard for firmware development
  • Provides a set of services to UEFI applications
  • Boot services
  • Runtime services
  • No more MBR/VBR
slide-42
SLIDE 42

Driver Execution Environment (DXE) Drivers

  • PE/COFF images
  • Abstract the hardware
  • Produce UEFI standard interface
  • Register new services (protocols)
  • Loaded during the DXE phase of the Platform

initialization

  • Loaded by the DXE dispatcher (DXE Core)
slide-43
SLIDE 43

UEFI firmware layout

  • Located in the BIOS region of the SPI flash memory
  • Contains multiple volumes
  • Volumes contain files identified by GUIDs
  • File contain sections
  • One of these sections is the actual UEFI image
  • It’s more complex than that but it suffices for our purpose
slide-44
SLIDE 44

SPI flash memory layout

slide-45
SLIDE 45

SPI flash memory layout

slide-46
SLIDE 46

SPI flash memory layout

slide-47
SLIDE 47

SPI flash memory layout

slide-48
SLIDE 48

BIOS region layout

slide-49
SLIDE 49

BIOS region layout

slide-50
SLIDE 50

BIOS region layout

slide-51
SLIDE 51

BIOS region layout

slide-52
SLIDE 52

Parsing the firmware volumes

  • Parses all the firmware volumes of the UEFI firmware
  • Looks for 4 specific files
  • Ip4Dxe (8f92960f-2880-4659-b857-915a8901bdc8)
  • NtfsDxe (768bedfd-7b4b-4c9f-b2ff-6377e3387243)
  • SmiFlash (bc327dbd-b982-4f55-9f79-056ad7e987c5)
  • DXE Core
slide-53
SLIDE 53

Ip4Dxe and DXE Core

  • Used to find the firmware volume to install the rootkit
  • All DXE drivers are usually in the same volume
  • DXE Core may be in a different volume
  • The chosen volume will be the one with enough free

space available

slide-54
SLIDE 54

NtfsDxe and SmiFlash

  • NtfsDxe the AMI NTFS driver
  • Will be removed if found
  • SmiFlash metadata are not used
  • SmiFlash is a known-vulnerable DXE driver
slide-55
SLIDE 55

Adding the rootkit

  • Creates a FFS file header (EFI_FFS_FILE_HEADER)
  • Append the Rootkit file
  • Write it at the end of the DXE drivers volume or the

DXE Core volume

  • Checks if there’s enough free space available
slide-56
SLIDE 56

Write the compromised firmware to the SPI Flash memory

slide-57
SLIDE 57

BIOS Write Protection Mechanisms

  • Platform exposes write protection mechanisms
  • Need to be properly configured by the firmware
  • We’ll only cover relevant protections to our research
  • Won’t cover Protected Range Registers
  • Exposed via the BIOS Control Register (BIOS_CNTL)
slide-58
SLIDE 58

BIOS Write Protection Mechanisms

  • To write to the BIOS region BIOS Write Enable

(BIOSWE) must be set to 1

  • BIOS Lock Enable (BLE) allows to lock BIOSWE to 0
slide-59
SLIDE 59

BIOS Write Protection Mechanisms

  • To write to the BIOS region BIOS Write Enable

(BIOSWE) must be set to 1

  • BIOS Lock Enable (BLE) allows to lock BIOSWE to 0
slide-60
SLIDE 60

BIOS Write Protection Mechanisms

  • The implementation of BLE is vulnerable
  • When BIOSWE is set to 1, its value change in

BIOS_CNTL

  • A System Management Interrupt (SMI) is triggered
  • The SMI handler sets BIOSWE back to 0
  • The SMI handler must be implemented by the firmware
slide-61
SLIDE 61

BIOS Write Protection Mechanisms

  • What if we write to the SPI flash memory before the

SMI handler sets BIOSWE to 0?

  • Race condition vulnerability (Speed racer)
  • A thread continuously set BIOSWE to 1
  • Another thread tries to write data
  • Works on multicore processors and single core

processors with hyper-threading enabled

slide-62
SLIDE 62

BIOS Write Protection Mechanisms

  • Platform Controller Hub family of Intel chipsets

introduces a fix for this issue

  • The firmware must set this bit
slide-63
SLIDE 63

BIOS Write Protection Mechanisms

  • Platform Controller Hub family of Intel chipsets

introduces a fix for this issue

  • The firmware must set this bit
slide-64
SLIDE 64

ReWriter_Binary.exe

  • ReWriter_Binary.exe checks these settings
  • Checks if the platform is properly configured
  • Implements the exploit for the race condition
slide-65
SLIDE 65

Writing process decision tree

slide-66
SLIDE 66

Writing process decision tree

slide-67
SLIDE 67

Writing process decision tree

slide-68
SLIDE 68

Writing process decision tree

slide-69
SLIDE 69

Let’s take a step back

  • Software implementation to flash firmware

remotely

  • Hacking Team’s UEFI rootkit needed physical access
  • We extracted the UEFI rootkit
  • Looked at ESET’s UEFI scanner telemetry
  • And…
slide-70
SLIDE 70

Let’s take a step back

  • Found the UEFI rootkit in the SPI flash memory
  • f a victim’s machine
  • First publicly known UEFI rootkit to be used in a

cyber-attack

slide-71
SLIDE 71

UEFI Rootkit

slide-72
SLIDE 72

UEFI Rootkit

  • DXE Driver loaded by the DXE Dispatcher
  • File Name
  • SecDxe
  • File GUID
  • 682894B5-6B70-4EBA-9E90-A607E5676297
slide-73
SLIDE 73

UEFI Rootkit Workflow

slide-74
SLIDE 74

UEFI Rootkit Workflow

slide-75
SLIDE 75

UEFI Rootkit Workflow

slide-76
SLIDE 76

UEFI Rootkit: SecDxe

  • Notify function
  • Installs NTFS driver
  • Drops autoche.exe and rpcnetp.exe
  • Patch a value in the Windows Registry
slide-77
SLIDE 77

UEFI Rootkit: NTFS driver

  • NTFS driver needed to get file-based access to

Windows’ partition

  • Hacking Team’s NTFS driver from HT’s leak
  • NtfsDxe project from vector-edk
slide-78
SLIDE 78

UEFI Rootkit: Dropping files

slide-79
SLIDE 79

UEFI Rootkit: Dropping files

slide-80
SLIDE 80

UEFI Rootkit: Dropping files

slide-81
SLIDE 81

UEFI Rootkit: Patching Windows Registry Value

  • Modifies Windows Registry via

%WINDIR%\System32\config\SYSTEM

  • Changes “autocheck autochk *” to “autocheck

autoche *”

  • HKLM\SYSTEM\CurrentControlSet\Control\

Session Manager\BootExecute

slide-82
SLIDE 82

UEFI Rootkit Workflow

slide-83
SLIDE 83

Prevention and Remediation

slide-84
SLIDE 84

Prevention

  • Keep your UEFI firmware up-to-date
  • Enable Secure Boot
  • Hardware Root of Trust (ex. Intel BootGuard)
  • Hope that your firmware configures security

mechanisms properly :-(

  • Firmware security assessments can be done with

CHIPSEC

slide-85
SLIDE 85

Remediation

  • You need to reflash your UEFI firmware
  • If it’s not an option for you then…
slide-86
SLIDE 86

Remediation

  • You need to reflash your UEFI firmware
  • If it’s not an option for you then…
slide-87
SLIDE 87

Conclusion

  • UEFI rootkits are real-word threats
  • Firmware must be built with security in mind
  • Share knowledge about how to prevent and

mitigate UEFI-based threats

slide-88
SLIDE 88

Thanks!

Questions?

White paper available at welivesecurity.com @jiboutin @Freddrickk_