Hacker News Reader

Comment by haswell | Hacker News Reader

> The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today?

I always marvel at the ingenuity and technical complexity of these kinds of attacks, but this is also something that makes me lose sleep at night.

I can’t help but wonder just how utterly compromised we all are, and won’t know it until many years down the line.

View on HN

Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.

Any systemd-using Linux distro will also automount /efi as writable only by root (assuming the mount was generated by GPT auto generator, not by a specific fstab entry), so it's not that either.

Normal home users are administrators, they have to go through the pop-up to run things with escalated privileges but that, according to Microsoft, is not a security boundary.

If we're considering Administrator / root access as trivially available, then any exploit becomes trivial itself. Even on a BIOS machine root can overwrite the MBR / kernel / initramfs to contain an exploit.

Sorry, the argument is:

> Windows doesn’t allow you to do that by default unless you’re an admin.

The refutation is that by default users are an admin. So no, they’re not protected against persistent threats like UEFI malware.

Yes, and thus I made the comment that I made.

Sure, from your computers OS. Its not like javascript loaded from the web can write to your UEFI unless you use an insecure browser.

Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.

I think the point of the original comment was that it's extremely feasible for attackers this sophisticated to have access to browser 0 day which would allow fs access, "insecure" browser or not

Zero day exploit =/= people automagically get infected.

One would have to first craft the shellcode insertion into the exploit, which is not exactly trivial, then hope that enough users visit a particular website to get infection (which is a negative feedback loop as the more users visit a website, the more likely it is to get scanned and reported as containing malware), then drop a crafted executable to presumably steal something that is worth money, which is a whole separate problem.

Possible? Definitely. So is you getting held up, your car stolen, and chopped up for parts, with no available recourse. Both are rather unlikely.

I’ve personally found multiple 0days in Chrome, and I doubt anyone (including myself) would consider it an insecure browser.

Here it start from a modified motherboard firmware, stored on a chip on the board, NOT a normal partition. Harder to infect at first, but way more persistent, surviving even disks changes.

Unless the mobo has that Intel KVM thing built into the hardware and they access that. Very low level remote access this way.

Shameless self-plug here.

I wrote about the potential for this problem in 2014 for my graduate thesis.

https://search.proquest.com/openview/cd06aab6e06951ba6cdc064...

Edit: to the parent, I shared many of the same concerns back then, too. I tried to speak to those anxieties in my final product.

Yeah, I assume that either everything is infected and backdoored and there's no way to detect it until it's too late, or almost nothing is infected because doing so would be the cross platform compatibility nightmare of all nightmares.

I don't know which one it is.

Definitely the first. Beacons have better cross-platform support than most Microsoft products.

Microsoft sets an extrememly low bar as they only want one platform, theirs.

> I can’t help but wonder just how utterly compromised we all are, and won’t know it until many years down the line.

It's not hard to imagine.

USB-C 3.0+ cables all need chips inside them for negotiating USB-PD, among other things.

Imagine what could be done with an infected USB-C cable. Yes, of course, keyloggers are possible (that's been done plenty in the past with regular old USB-A 2.0), but think about one of USB-C's common applications: docking stations.

If you hooked up your laptop to a docking station with a malicious USB-C cable and you had ethernet, an external monitor, and a keyboard plugged into the dock, you would basically be giving an attacker a VNC session. It could scoop up everything you type, everything on your screen, and communicate via a connection that is entirely transparent to the OS.

At that point, your only hope is a firewall flagging the connection, otherwise you'll be completely oblivious to the ongoing surveillance. And it could compromise a network connection to insert a malicious payload into a file you're downloading, just to make the surveillance persistent when you're not plugged in.

If you care about security, consider using Qubes OS. It will be extremely hard to infect your UEFI from a VM.

You know what'll help? Pluton. The future of computing is a signed code path from power on to end-user application code with multiple layers of sandboxing in between. With so many hostile actors, from script kiddies to government agencies out there, "general purpose computing" (which, from a security standpoint, is just arbitrary code execution) just isn't viable anymore. We need provable attestation that no layer of the software stack has been tampered with.

As long as we control each layer this sounds great. What are you thinking, some sort of physical switches on the computer that turns on and off access to the layers from software so you can control them individually? That's the tricky part, how to switch those layers on and off so you can work with them in a non-software controlled way.

yes that is a problem, even bigger is that pluton is intended to make this as close to impossible as is possible.

pluton is about burying TPM and keys in the processor package rather than as a separate host on the bus. this could be defeated by using microsurgical technique to reveal the die and alter the connections, an extreme effort requireing an extreme motivation.

So you will have backdoored SW but you will not be able to replace it because it is "secure".

“With so many hostile actors”

Like Microsoft? And like government actors compelling Microsoft via things like NSL’s?

This has been echoed in physical security for as long as it’s been around.

Look at “bump keys” for example. Those who have the knowledge walk right through security barriers like they aren’t there and meanwhile security companies make optimistic claims of safety just to sell more locks.

Reply on news.ycombinator.com