New Version of Stoned Bootkit Said to Bypass Windows 8 Secure Boot

[A Guy]

A security researcher who has in the past has created low-level rootkits capable of staying resident on an infected machine after reboots, said he has now accomplished the same feat on Windows 8, which hasn't even hit the shelves yet. Peter Kleissner said he has created a new version of his Stoned bootkit that defeats the pre-boot security checks included in the forthcoming OS and survives reboots.

Kleissner is known in the security community for his creation of the Stoned bootkit, a sophisticated form of rootkit that is designed to load from the master boot record and stay resident in memory throughout the boot process. The previous version of the bootkit was designed to work on Windows XP through Windows 7, but the new one that Kleissner has written also works on Windows 8. He said in a message on Twitter Thursday that Stoned Lite is a small footprint bootkit that can be loaded from either a USB stick or a CD.

He said he may also add some other functionality to the software in the near future.

Source

A Guy

 

[lehnerus2000]

I thought (that I read) that only affects BIOS booting and not UEFI booting.

 

[carwiz]

Everything begins at/from the BIOS. The BIOS hands over control to the first byte of the MBR/VBR. That can be an EFI, OS loader or whatever is put there.

 

[lehnerus2000]

Replacement

I'm reasonably sure that UEFI replaces the BIOS.

From Wikipedia:

"The Unified Extensible Firmware Interface (UEFI) is a specification that defines a software interface between an operating system and platform firmware. UEFI is a more secure replacement for the older BIOS firmware interface, present in all IBM PC-compatible personal computers, which is vulnerable to bootkit malware."

The Linux "guys" are all screaming that Windows 8 Secure Boot is actually to prevent the installation of Linux operating systems (not to prevent Rootkits).

 

[carwiz]

It's not a total "replacement". The UEFI is firmware and software that takes control of the hardware interrupts but it does NOT completely replace the BIOS. POST and SETUP are NOT part of UEFI.

Source (NOT Wiki)

 

[lehnerus2000]

It's a useless additonal point of failure then

It's not a total "replacement". The UEFI is firmware and software that takes control of the hardware interrupts but it does NOT completely replace the BIOS. POST and SETUP are NOT part of UEFI.

Source (NOT Wiki)

Interesting.
Thanks for that link.

So it is a completely useless disruption to the "established order of things".
Just another thing that can prevent a PC from functioning.

I only pointed at Wiki, because I read something on another blog and I wanted to see if it matched.

 

[carwiz]

Well, it's "said" to be safer but I don't see how. There's already malware that will emulate a UEFI interface. Nasty ones too. They just sit back and monitor EVERYTHING on your computer. Then "serve" it up.

 

[lehnerus2000]

Scam?

Well, it's "said" to be safer but I don't see how. There's already malware that will emulate a UEFI interface. Nasty ones too. They just sit back and monitor EVERYTHING on your computer. Then "serve" it up.

It seems to be just another layer that can be compromised.

Perhaps it's just money-making scam (for the suppliers).

Maybe the Linux "guys" are right after all.

 

[carwiz]

Don't know about scam. All the "biggies" have their hands in the spec and implementation is voluntary. I suppose it's advancing the PC technology as the BIOS runs on 16-bit addressing. UEFI can run 32 or 64 bit depending on the OS. The problem is that it's just a shell-based system. It calls other programs and that's what I think is the weak point. There's supposed to be a special secure partition for the software but that just hints of the same security problems as the MBR. If it can be written, it can be re-written.

 

[A Guy]

Good information, thanks for sharing

A Guy

 

[lehnerus2000]

Boot ROMs

...
The problem is that it's just a shell-based system. It calls other programs and that's what I think is the weak point. There's supposed to be a special secure partition for the software but that just hints of the same security problems as the MBR. If it can be written, it can be re-written.

Some special procedure should be required for updating.
I've never liked the way, it's possible to update the BIOS from inside your OS.

We may have to go back to Boot ROMs.

 

[Corazon]

Some special procedure should be required for updating.
I've never liked the way, it's possible to update the BIOS from inside your OS.

Couldn't agree more - I've always wondered why they never implemented something as simple as a hardware switch (mountable on the back of the PC case and wired to the motherboard) that locks the BIOS flash chip against any software modifications to it.

Really just a simple read-only switch you'd have to physically flip before updating the BIOS.

Since that's rarely ever necessary, why leave the BIOS so vulnerable all the time?

Why did they never do a simple thing like this? Floppy disks had read-only sliders, and even SD cards still do.

 

[seekermeister]

I realize that the article is not referring to Windows, but if it can be done for XBox, I would think that it could be done for a Windows machine also:

Xbox-Scene Tutorial: Adding Mod Chip Enable/Disable and BIOS Flash ROM Write Enable/Disable Switches To Your XBox

 

[lehnerus2000]

It's unbelievable

Some special procedure should be required for updating.
I've never liked the way, it's possible to update the BIOS from inside your OS.

Couldn't agree more - I've always wondered why they never implemented something as simple as a hardware switch (mountable on the back of the PC case and wired to the motherboard) that locks the BIOS flash chip against any software modifications to it.

Really just a simple read-only switch you'd have to physically flip before updating the BIOS.

Since that's rarely ever necessary, why leave the BIOS so vulnerable all the time?

My friend and I have often pondered that.

Why did they never do a simple thing like this? Floppy disks had read-only sliders, and even SD cards still do.

My friend and I can't believe that USB sticks don't have a "read-only" slider.

 

[legacy7955]

Some special procedure should be required for updating.
I've never liked the way, it's possible to update the BIOS from inside your OS.

Couldn't agree more - I've always wondered why they never implemented something as simple as a hardware switch (mountable on the back of the PC case and wired to the motherboard) that locks the BIOS flash chip against any software modifications to it.

Really just a simple read-only switch you'd have to physically flip before updating the BIOS.

Since that's rarely ever necessary, why leave the BIOS so vulnerable all the time?

Why did they never do a simple thing like this? Floppy disks had read-only sliders, and even SD cards still do.

Indeed, why is this not the case right now?