techspot UEFI bootkit can defeat Secure Boot protection

[UltraMega]

Quote

 new report by ESET analyst Martin Smolár now confirms one of the most outstanding and dangerous capabilities of the malware: BlackLotus is the first "in-the-wild" UEFI bootkit to compromise a system even when the Secure Boot feature is correctly enabled. Smolár says it's a malicious kit that can run on fully updated UEFI systems.

BlackLotus UEFI bootkit can defeat Secure Boot protection

WWW.TECHSPOT.COM

---

BlackLotus is a potent threat against modern firmware-based computer security. This UEFI bootkit provides...

 

 

[neurotix]

Great. Jesus. They just keep finding more and more exploits since around 2017. I used to run a rootkit scanner, I think it might have been from Trend Micro. Perhaps I need to run it and check for any crap like this.

[schuck6566]

4 hours ago, neurotix said:

Great. Jesus. They just keep finding more and more exploits since around 2017. I used to run a rootkit scanner, I think it might have been from Trend Micro. Perhaps I need to run it and check for any crap like this.

If on Windows, for a starter,

Help protect my PC with Microsoft Defender Offline - Microsoft Support

SUPPORT.MICROSOFT.COM

---

Learn how to use Microsoft Defender Offline to help remove malicious software and other potential threats.

or Malwarebytes Free version has a Rootkit option box in the manual scan

[Kaz]

Good.  I know I'm in the minority here, but TPM is not good for the industry.

 

I can understanding encrypting a drive and saving the key to a bios.  I can understand using manufacture keys to prevent unsigned bios updates.  What I can't fathom is why Microsoft has final say on what's "trusted" and should be able to run on a computer.  If they are worried about booting outside OS systems that can compromise a system, they should lock down the boot loader and bios under a user password.

 

Windows 10 passwords can be bypassed with a simple windows 10 bootable USB, the same USB you may NEED to restore a corrupt system or reinstall the OS.  A rubber ducky can grab a lot of information without even logging into a system.  If microsoft was worried about security, they could do a lot more to fix their systems than try to control the industry.  TPM was always a power grab by microsoft, once people realize it doesn't actually provide security, they might move on to something else. 

[schuck6566]

9 hours ago, Kaz said:

Good.  I know I'm in the minority here, but TPM is not good for the industry.

 

I can understanding encrypting a drive and saving the key to a bios.  I can understand using manufacture keys to prevent unsigned bios updates.  What I can't fathom is why Microsoft has final say on what's "trusted" and should be able to run on a computer.  If they are worried about booting outside OS systems that can compromise a system, they should lock down the boot loader and bios under a user password.

 

Windows 10 passwords can be bypassed with a simple windows 10 bootable USB, the same USB you may NEED to restore a corrupt system or reinstall the OS.  A rubber ducky can grab a lot of information without even logging into a system.  If microsoft was worried about security, they could do a lot more to fix their systems than try to control the industry.  TPM was always a power grab by microsoft, once people realize it doesn't actually provide security, they might move on to something else. 

Agree,but for a different reason, if there's an issue with a bios update or other bios/Hardware issue that causes you to have to clear the CMOS you loose the tpm key and when trying to turn tpm back on you loose any info that was previously encrypted. The Encrypted data IS available with tpm turned off, so what's the point? If someone can access "secure" data simply by turning off tpm in the bios, how secure is it really?

[maddangerous]

On 05/03/2023 at 01:41, Kaz said:

Good.  I know I'm in the minority here, but TPM is not good for the industry.

 

I can understanding encrypting a drive and saving the key to a bios.  I can understand using manufacture keys to prevent unsigned bios updates.  What I can't fathom is why Microsoft has final say on what's "trusted" and should be able to run on a computer.  If they are worried about booting outside OS systems that can compromise a system, they should lock down the boot loader and bios under a user password.

 

Windows 10 passwords can be bypassed with a simple windows 10 bootable USB, the same USB you may NEED to restore a corrupt system or reinstall the OS.  A rubber ducky can grab a lot of information without even logging into a system.  If microsoft was worried about security, they could do a lot more to fix their systems than try to control the industry.  TPM was always a power grab by microsoft, once people realize it doesn't actually provide security, they might move on to something else. 

 

Agree, except both of those items are generally outside the control of an operating system, in the sense of getting them configured so that the user can actually enter their own password. They're up to the user to configure. If there was an implementation of something akin to bitlocker, where admins can enable a password required to boot and the user can make their own, except apply it to the bios & bootloader, that'd be sweet.

 

Can W10 passwords still be removed that way? I thought that wasn't a thing anymore.

 

23 hours ago, schuck6566 said:

Agree,but for a different reason, if there's an issue with a bios update or other bios/Hardware issue that causes you to have to clear the CMOS you loose the tpm key and when trying to turn tpm back on you loose any info that was previously encrypted. The Encrypted data IS available with tpm turned off, so what's the point? If someone can access "secure" data simply by turning off tpm in the bios, how secure is it really?

 

Is this where hardware security keys (the removeable ones) enter the chat? Or do those just apply to logging into the computer?

If one could configure a hardware key to be required for POST or bootloader access...

[Kaz]

12 hours ago, maddangerous said:

Can W10 passwords still be removed that way? I thought that wasn't a thing anymore.

It's more of a workaround....  Insert bootable windows USB, press shift + F10 at Windows Setup to open cmd prompt.  Then create a backup of windows accessibility, copy cmd exe and rename it to windows accessibility.  Boot into windows normally, click accessibility which now opens cmd prompt, then enable admin account.  Note, enabling admin does not work from the bootable cmd prompt, only from the native windows cmd prompt.  After removing a user's password the admin account should be disabled and accessibility restored.  Unless they remove the ability to reach command prompt with shift +F10 I don't see that going away anytime soon. 

 

I haven't tried it on windows 11, but I suspect it would work.  Bitlocker or other drive encryption may complicate the task.  I'm not sure how bitlocker works in regards to windows restoration attempts, since the media would have to be decrypted for windows to fix corrupted files.  I've been avoiding bitlocker so I don't have experience with it.

[neurotix]

5 hours ago, maddangerous said:

 

Agree, except both of those items are generally outside the control of an operating system, in the sense of getting them configured so that the user can actually enter their own password. They're up to the user to configure. If there was an implementation of something akin to bitlocker, where admins can enable a password required to boot and the user can make their own, except apply it to the bios & bootloader, that'd be sweet.

 

Can W10 passwords still be removed that way? I thought that wasn't a thing anymore.

 

 

Is this where hardware security keys (the removeable ones) enter the chat? Or do those just apply to logging into the computer?

If one could configure a hardware key to be required for POST or bootloader access...

 

Linux can do what you're talking about. I have my system set up so it requires a password to start an OS fron GRUB2. The password is additionally encrypted using AES-256 encryption, so the password to boot cannot be viewed in RAM by anyone trying to boot an OS on my system.

 

I love Linux.

[maddangerous]

15 minutes ago, Kaz said:

It's more of a workaround....  Insert bootable windows USB, press shift + F10 at Windows Setup to open cmd prompt.  Then create a backup of windows accessibility, copy cmd exe and rename it to windows accessibility.  Boot into windows normally, click accessibility which now opens cmd prompt, then enable admin account.  Note, enabling admin does not work from the bootable cmd prompt, only from the native windows cmd prompt.  After removing a user's password the admin account should be disabled and accessibility restored.  Unless they remove the ability to reach command prompt with shift +F10 I don't see that going away anytime soon. 

 

I haven't tried it on windows 11, but I suspect it would work.  Bitlocker or other drive encryption may complicate the task.  I'm not sure how bitlocker works in regards to windows restoration attempts, since the media would have to be decrypted for windows to fix corrupted files.  I've been avoiding bitlocker so I don't have experience with it.

 

I wasn't aware, thanks for sharing.

Why avoid bitlocker? I don't think it requires tpm at this time. unsure though. I'm more familiar with it on the business side of things.

 

5 minutes ago, neurotix said:

 

Linux can do what you're talking about. I have my system set up so it requires a password to start an OS fron GRUB2. The password is additionally encrypted using AES-256 encryption, so the password to boot cannot be viewed in RAM by anyone trying to boot an OS on my system.

 

I love Linux.

 

Yeah, I have seen that from GRUB2. I haven't moved to that (I daily *nix on my laptop. When I have one).

 

Linux FTW!

[neurotix]

https://help.ubuntu.com/community/Grub2/Passwords

 

That page had been around forever, but will tell you everything about configuring and encrypting GRUB2 passwords on boot. I don't on my rig (I just set an encrypted admin password that works with both Win10 and Linux to boot them) but if you want you can even have separate passwords per boot entry, so Windows requires one and Linux requires a different one.

[Kaz]

2 hours ago, maddangerous said:

Why avoid bitlocker? I don't think it requires tpm at this time. unsure though. I'm more familiar with it on the business side of things.

For the same reason I don't password my bios.  Physical access > all.  I used to reset bios passwords for my school when people messed with them.  They never bothered with bios passwords because they just cloned hard drives for all computer setups.  Teachers generally only have hardware issues.

 

Bitlocker makes sense if you want to use a USB key.  It also makes sense if you're worried about employees stealing hard drive data, though in reality that data shouldn't be stored on their hard drives, but on a server they don't have physical access to.

 

Personally, I'm weary of calling anything encrypted when I just handed the keys to someone else.  Bitlocker isn't going to help against online threats, because the machine is already running.  TPM unlock is an invitation to steal the entire computer instead of just the drive.  I've had candy vending machines stolen from me.  The audacity of people and the ability for stuff to walk away is not lost on me.

 

Probably the best use case for bitlocker is on a laptop with a USB key.  I'd rather trade that USB key for a password.  I know passwords are weaker against brute force, but the dictionary size for brute force attacks  > 8 characters is exponentially large.  The likely hood of me running into someone with the knowledge, skill, and resources (server) to break a good long password is fairly low.  They still need physical access to the device.   I'm just not that important.  If I did have sensitive information that I really cared about, I wouldn't want it decrypted upon boot.

 

I don't use LastPass either.  I know security guys everywhere have been touting it's great use, but ever since it's inception, I've felt it's just a single point of weakness that presents a target.  LastPass got hacked.  It's a tribute to their security team that it has taken this long for it to happen. 

[schuck6566]

11 hours ago, maddangerous said:

 

Agree, except both of those items are generally outside the control of an operating system, in the sense of getting them configured so that the user can actually enter their own password. They're up to the user to configure. If there was an implementation of something akin to bitlocker, where admins can enable a password required to boot and the user can make their own, except apply it to the bios & bootloader, that'd be sweet.

 

Can W10 passwords still be removed that way? I thought that wasn't a thing anymore.

 

 

Is this where hardware security keys (the removeable ones) enter the chat? Or do those just apply to logging into the computer?

If one could configure a hardware key to be required for POST or bootloader access...

I can only speak as to what actually happened to me. I was using TPM via the encryption abilities of my Ryzen 2700x (so as to make my comp Win 11 compatible even though I hadn't switched yet) Had a bios issue and while tracking it down I did the old school clearing of the CMOS as 1 of my ways to find the problem. When I finally got back up and a semi current bios installed,when I tried switching TPM back on it told me it was unable to because the key didn't match the 1 on the drive. Doing it anyway caused my boot drive to disappear. Turn TPM back off and Boot drive was back.  I wonder if I would have had to do a clean install of windows if I'd upgraded the cpu?