Security researchers report that rootkits for Unified Extensible Firmware Interface (UEFI) are not rare and difficult to detect.
Kaspersky researchers they identified the profile of CosmicStrand, a sophisticated UEFI rootkit that the company detected and acquired through its antivirus software.
The security company reports:
"The most striking aspect of this discovery is that this UEFI rootkit appears to have been in use since late 2016 – long before UEFI attacks began to be publicly described."
The researchers warn that "the multiple rootkits discovered so far demonstrate a blind spot in the security industry that needs to be addressed immediately."
Rootkit is one malware running in the deepest areas of the operating system they infect.
They take advantage of this strategic position to hide their presence from the operating system itself.
A bootkit, ωστόσο είναι το κακόβουλο λογισμικό που μολύνει τη διαδικασία εκκίνησης ενός μηχανήματος προκειμένου να παραμείνει στο σύστημα. Ο διάδοχος του παλαιού τύπου BIOS, το UEFI είναι ένα τεχνικό πρότυπο που καθορίζει τον τρόπο με τον οποίο τα data of computer can participate in booting an operating system.
It is the "latest" technology, as it was introduced around 2006. Today, almost all devices support UEFI for the boot process.
So when we say that something takes place at the UEFI level, it means that it happens when the computer boots, before the operating system is even loaded.
Kaspersky says:
“Therefore, a rootkit may or may not be a bootkit, depending on where it is installed on the victim's computer. A bootkit may or may not be a rootkit as long as it infects a component used to boot the system. But considering how low-level they usually are, bootkits are usually rootkits.”
“And firmware is one of the things that can be infected by bootkits, but there are others. CosmicStrand happens to be all of these things at once: It has the hidden capabilities of a rootkit and infects the boot process by maliciously patching the firmware image of motherboards.”
