Malware Buried Deep Down the SPI Flash: Sednit's First UEFI Rootkit Found in the Wild
summary
Claimed Sednit (Fancy Bear/APT28) implants a UEFI rootkit in SPI flash and it is the first such sample found live; attackers use an unsigned kernel driver (the RWEverything driver) and tools named rewriter to dump, patch and reflash firmware. The rootkit installs a SEC.exe DXE driver, bundles a hacked Hacking Team NTFS driver, drops an RPCNet backdoor, and temporarily flips Autochk registry entries to hide installation. It succeeds only on older or misconfigured platforms (exploits the Speed Racer race condition), and targets few Balkan military and diplomatic organizations.
AI-written summary · about
chapters (17)
- 0:00Introduction to UEFI Rootkit
- 0:28Analyzing the Sednit Group
- 4:41The LoJack Anti-Theft Software
- 5:50LoJack Architecture and History
- 8:03Vulnerabilities in LoJack
- 10:42Sednit Campaign Targets
- 14:07The Discovery of Tools
- 17:23Firmware Patching Techniques
- 18:40Dumping and Writing Firmware
- 21:09UEFI Fundamentals
- 23:43Modifying UEFI Firmware Volumes
- 27:37Exploiting Write Protection
- 30:56Firmware Flashing Process
- 34:05Rootkit Analysis and Demo
- 36:47Rootkit Workflow and Persistence
- 39:22Live Demonstration of Infection
- 45:20Prevention and Remediation
related talks
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
01h 13mIs there an EFI monster inside your apple?
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
49mHorse Pill: A New Type of Linux Rootkit
27mBreaking the Chain of Trust
28mBOOTKITTY: Multi-OS Trust Chain compromise from Bootkit to Rootkit
44m The Nation State Actor Ate My Homework!