0

I dumped my firmware on my Macbook with Darwin Dumper and uploaded the .rom file to Virus Total and it showed a huge amount of bad PE32 images (File detail tab), all of which seem to be detected by Cylance/Trapmine/Cybereason as Unsafe/suspicious.low.ml.score/malicious.random 6 char-long string respectively.

The weirdest thing is that 3 days ago a file with identical findings was uploaded there. Same Macbook model, ROM, EFI version, ROM Bios files names and warnings.

Can someone explain to me what do these findings even mean? Should I never trust this computer again? I'm also really worried about the identical file a few days ago, aren't firmware dumps unique for each system? Or same model machines have same firmware dumps i.e. all MB Air Mid-2012 will have the same dump?

Improve this question
0

1 Answer 1

Reset to default
2

... aren't firmware dumps unique for each system?

System firmware is the software specific to the hardware - with the same hardware you can expect the same firmware and even with different hardware same firmware might be used since hardware is often similar or only part of the firmware is used with the installed hardware. This is not much different from other software, i.e. MS Office is the same binary for thousands of systems.

it showed a huge amount of bad PE32 images

PE32 are perfectly normal on UEFI. From https://wiki.osdev.org/UEFI:

UEFI executables are regular PE32 / PE32+ (Windows x32 / x64) images, with a specific subsystem. Every UEFI application is basically a windows EXE (or DLL) without symbol tables.

As for these images being bad:

all of which seem to be detected by Cylance/Trapmine/Cybereason as Unsafe/suspicious.low.ml.score/malicious.random 6 char-long string respectively.

These seem to be only heuristics applied here, not pattern of known malware. With heuristics you usually get a high false positive rate (detecting something which is not malicious as malicious) if you also want to get a high true positive rate (don't miss any potential malicious things). My guess is that these are simply false positives given that only a few engines find this.

Improve this answer
8
  • Yeah the fact that the images were identified as malicious was what made me worried, so I guess the results just demonstrate potential security holes in specific PE32 images. I looked at some infected .BIN files submitted to a VT blog post presenting the firmware scan feature. Most seem to have had injected additional Win exes apart from standard PEs, which were identified as some known UEFI rootkit e.g. Application.Win32.CompuTrace.B
    – ffdd992
    Dec 1, 2018 at 17:36
  • @ffdd992: antivirus does not look for security holes - it does look either for known signatures or tries to find pattern (in binary, in code, in behavior) which are similar to known malware or kind of unusual/suspicious.
    – Steffen Ullrich
    Dec 1, 2018 at 18:09
  • Is there anything else I can do to verify the firmware integrity? I've read about Intel's Chipsec but I'm not sure if it's going to find anything useful/other than VT did. I hope these are really just false positives but I'm concerned at the same time, not much about a three-letter agency spying on me, but let's say about an advanced script-kiddie taking over my system. Would most firmware dumps "pass" all VT scans or are they prone to false positives too?
    – ffdd992
    Dec 1, 2018 at 19:19
  • @ffdd992: macOS High Sierra Automatically Performs Security Check on EFI Firmware Each Week.
    – Steffen Ullrich
    Dec 1, 2018 at 19:43
  • I'm aware of this feature but how effective would it be were the system been already compromised? I ran Windows 7 at a time and didn't upgrade to Mojave until recently since I was using Yosemite. (I know, bad idea.) Sorry for being paranoid, just want to be as certain as possible that I haven't screwed up my system.
    – ffdd992
    Dec 1, 2018 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .