05/08/2013
Bypass SecureBoot / UEFI
Bootkit, rootkit, ring3 ring0
Information security specialists say that the new security mechanism of Windows 8 Secure Boot can be avoided, though not 100%, but only on some computers that manufacturers use "special" technology extension UEFI (Unified Extensible Firmware Interface).
Independent researchers Andrew Furtak, Alexander Bazhanyuk and Yuri Buligin at Black Hat USA conference demonstrated two attacks that bypass Secure Boot, to install on your computer UEFI-bootkit, which is located in the boot sector of a disk and actually puts an end to the concept of Secure Boot.
Recall that Secure Boot is a technology that uses a previously developed UEFI specification and enables to place the boot sector of the computer codes, and only programs with a special digital certificate publisher, ie viruses out there way, in theory, is closed.
However, according to the researchers, their exploits puts this statement into question, and the matter is not in the Secure Boot itself, but in how it uses UEFI technology, some equipment manufacturers.
First, the exploit works as a result of the fact that some manufacturers do not properly protect the boot sector, allowing the attacker to modify the code responsible to translate Secure Boot to the active state, says working in the McAfee Yuri Buligin.
Exploit modifies the key platforms - root key, located at the heart of all the security checks Secure Boot, but to accomplish this code should be executed in the kernel mode of the operating system (the highest privilege level).
This somewhat limits the attack, as the potential hacker must first figure out how to get such a low-level access to the victim machine. Experts have shown an example of the exploit notebook Asus VivoBook Q200E, but according to them, some desktop motherboards also exposed the problem.
The second exploit runs in user mode, that is, the attacker need only the very right to execute code in the system as such. Typically, such access is and Java, and Flash, and Microsoft Office and many others.
Experts do not disclose the technical features of the second exploit and did not name the affected vendors, because they said the problem "is very common." Bulygin said that the problem they had notified vendors almost a year ago, but it was closed a few.
In Microsoft said that in the course of the problem and are working with our partners on this issue. "Despite the mistakes, we generally agree that Secure Boot - is a good technology and a step forward. To install the bootkit attacking you first need to find a vulnerability that avoided Secure Boot, and then, if they are dealing with old platforms, they do not interfere "- says Buligin.
