Security researchers report that rootkits for Unified Extensible Firmware Interface (UEFI) are not rare and difficult to detect.
Kaspersky researchers they identified his profile cosmic beach, a sophisticated UEFI rootkit that the company detected and acquired through its antivirus software.
The security company reports:
“The most striking aspect of this discovery is that this UEFI rootkit appears to have been in use since late 2016 – long before the exploits began to be publicly described. attacks in UEFI”.
The researchers warn that "the multiple rootkits discovered so far demonstrate a blind spot in the security industry that needs to be addressed immediately."
A rootkit is a malware that runs in the deepest areas of the operating system that it infects.
They take advantage of this strategic position to hide their presence from the operating system itself.
A bootkit, however, is malware that infects a machine's boot process in order to remain in the system. The successor to the legacy BIOS, UEFI is a technical standard that defines how computer components can participate in booting an operating system.
It is the "latest" technology, as it was introduced around 2006. Today, almost all devices support UEFI for the boot process.
So when we say that something takes place at the UEFI level, it means that it happens when the computer boots, before the operating system is even loaded.
Kaspersky says:
“Therefore, a rootkit may or may not be a bootkit, depending on where it is installed on the victim's computer. A bootkit may or may not be a rootkit as long as it infects a component used to boot the system. But considering how low-level they usually are, bootkits are usually rootkits.”
“And firmware is one of the things that can be infected by bootkits, but there are others. CosmicStrand happens to be all of these things at once: It has the hidden capabilities of a rootkit and infects the boot process via malicious informationof its code image of the firmware of the motherboards”.
