An invisible UEFI rootkit has been circulating since 2016

Security researchers report that rootkits for Unified Extensible Firmware Interface (UEFI) are not rare and difficult to detect.

Kaspersky researchers they identified το προφίλ του CosmicStrand, ενός εξελιγμένου UEFI rootkit που η εταιρεία εντόπισε και απέκτησε μέσω του λογισμικού προστασίας από ιούς.


The security company reports:

"The most striking aspect of this discovery is that this UEFI rootkit appears to have been in use since late 2016 – long before UEFI attacks began to be publicly described."

The researchers warn that "the multiple rootkits discovered so far demonstrate a blind spot in the security industry that needs to be addressed immediately."

A rootkit is a malware that runs in the deepest areas of the operating system that it infects.

They take advantage of this strategic position to hide their presence from the operating system itself.

A bootkit, however, is malware that infects a machine's boot process in order to remain in the system. The successor to the legacy BIOS, UEFI is a technical standard that defines how computer components can participate in booting an operating system.

It is the "latest" technology, as it was introduced around 2006. Today, almost all devices support UEFI for the boot process.

So when we say that something takes place at the UEFI level, it means that it happens when the computer boots, before the operating system is even loaded.

Kaspersky says:

“Therefore, a rootkit may or may not be a bootkit, depending on where it is installed on the victim's computer. A bootkit may or may not be a rootkit as long as it infects a component used to boot the system. But considering how low-level they usually are, bootkits are usually rootkits.”

“And firmware is one of the things that can be infected by bootkits, but there are others. CosmicStrand happens to be all of these things at once: It has the hidden capabilities of a rootkit and infects the boot process by maliciously patching the firmware image of motherboards.” The Best Technology Site in Greece
Follow us on Google News

CosmicStrand,UEFI rootkit,iguru,security,uefi,rootkit

Written by giorgos

George still wonders what he's doing here ...

Leave a reply

Your email address is not published. Τα υποχρεωτικά πεδία σημειώνονται με *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).