New type of attack discovered: First in-the-wild UEFI bootkit - irrevocable damage imminent

avr. 05, 2023

New type of attack discovered: First in-the-wild UEFI bootkit - irrevocable damage imminent

Prepare today for tomorrow's attacks.

After Trojans and ransomware targeting data theft and extortion, attackers have been developing new "permanent" methods to infiltrate malware for quite some time. As early as 2018, the first successful UEFI malware attacks (Lojax) became public knowledge. (UEFI stands for "Unified Extensible Firmware Interface" and describes the interface between the firmware, the operating system and the various modules of a computer).

Now attackers are going one step further: recently, the first publicly known UEFI bootkit that bypasses the platform's essential security feature - UEFI Secure Boot - has now been discovered "in-the-wild".

This can even run on current Windows 11 systems with UEFI Secure Boot enabled. Experts suspect that it is a bootkit called BlackLotus - a UEFI bootkit that has been sold in relevant hacker forums for around $5,000 since last fall. Still, an attack with a UEFI bootkit is quite costly, but experts estimate that this will soon change and the number of UEFI bootkit attacks, especially on lucrative targets, will increase rapidly.

UEFI bootkits - irrevocable damage

UEFI bootkits are very powerful threats as they have full control over the operating system boot process and thus are able to disable various operating system security mechanisms and distribute their own data in kernel or user mode in the early boot phases of the operating system. This allows them to operate very unobtrusively and with extensive privileges. For regular antivirus programs, this form of malware remains invisible. For the attackers themselves, on the other hand, the possibilities are endless: damaging the firmware, locking the computer, even taking over the entire system are easy. The special thing: Software updates and new installations remain ineffective - malware nested in the UEFI even survives a new installation or a hard disk swap. Once a piece of hardware has been infected, it remains lost, as there are no resources or methods available to remove the malware. Thus, this type of attack can quickly lead to high financial damage.

Security independent of the operating system

Only fully comprehensive security solutions offer users appropriate protection against this growing range of attack scenarios. Proactive solutions also help to be prepared today for the attacks of tomorrow. Especially in the environment of particularly high security requirements (classified data, critical infrastructures or similar), users should definitely pay attention to the necessary independence from the security architecture of the operating system. Solutions that act like a UEFI firewall through strong separation offer an additional security gain. In this way, malware is prevented from nesting in the computer's UEFI even if there are vulnerabilities and security holes in the operating system. The hardware is also protected in the future and remains available for trustworthy work.

IT security expert Rohde & Schwarz Cybersecurity offers appropriate protection with its secure workstation – approved by the German Federal Office for Information Security for securing classified data - with zero-trust technology R&S®Trusted Endpoint Suite. The suite consists of the VPN client R&S®Trusted VPN Client - approved by the German Federal Office for Information Security for securing classified data -, which functions independently of the operating system's security mechanisms, and the proven R&S®Trusted Disk full-disk encryption (approved by the German Federal Office for Information Security for securing classified data). R&S®Trusted VPN Client acts like a UEFI firewall and lets potential attacks from the Windows operating system on the hardware firmware go nowhere. Changes to the UEFI instance seen by the operating system are also eliminated after each reboot - making permanent malware nesting impossible. Thus, users are already protected against tomorrow's threats today.

Contact Us

Vous avez des questions ou besoin d'informations supplémentaires ? Remplissez simplement ce formulaire et nous vous recontacterons rapidement.

Marketing de permission

Je souhaite recevoir des informations de Rohde & Schwarz via

Je souhaite recevoir des informations marketing ou publicitaires (par exemple sur des offres spéciales et des remises promotionnelles) de la part de Rohde & Schwarz GmbH & Co. KG et des entités ou filiales de Rohde & Schwarz mentionnées dans le Imprint de ce site internet via courriel ou voie postale. D'autres détails sur l'utilisation des données personnelles et sur la procédure de rétractation sont fournies dans la Déclaration de confidentialité et L'autorisation Marketing.

Votre demande a bien été envoyée ! Nous vous contacterons dans les plus brefs délais.
An error has occurred, please try again later.