Let me try asking my question this way...
Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing high-value intellectual property from American companies. (The specific context doesn't really matter; the "scenario" is just to help me demonstrate what question I'm trying to ask.)
My team is preparing ... let's say, to target a set of known R & D executives at various U.S. companies with a spearfishing campaign. (Again, scenario specifics don't really matter.) My team has some pdf reader exploits read to go, and some Windows privilege escalation exploits to follow on and get whatever malware payload we decide to implant to kernel-level privileges.
(Another team is responsible for hacking the Mac users amongst our targets. :) )
Anyway, let's say I'm charged with putting together a malware payload that will work on all modern versions of Windows. Of course, I'll want to install a module that will covertly listen for commands and exfiltrate information via whatever routes I like. Probably I'll put a keylogger in there right away, too. Certainly a component that can load and install whatever other modules & tools I might decide to upload after initial penetration is complete and I want to get on with the business of seeing what's interesting inside the target's network and finding some juicy IP to steal. The usual stuff.
However, I also need to hide all that stuff from anti-malware software, system management software, manual inspection (using TaskManager, Sysinternals tools, etc.), possibly even a HIDS. I would also like my malware to, the maximum extent possible, persist. I'd really like it to survive, for example, installation of Windows updates & upgrades, attempts to remove the malware (if it should be detected), even the holy grail: a wipe & OS reinstall.
Now if we're talking about attacking a PC with traditional BIOS and running Windows 7 or earlier I have a ton of options. I can use any one of many rootkits to get my malware to load with the lowest levels of the Windows kernel, bypassing Windows's defenses and subverting the detection capabilities of security software before it even loads. I can use a bootkit to attack the Master Boot Record and load parts of my malware before the Windows bootloader even starts. If I'm working for a genuinely advanced Advanced Persistent Threat unit I may even have multiple BIOS implant options for stuff from multiple BIOS makers. Plenty of options.
However, I also need my malware to evade detection and persist on newer Windows PCs that have UEFI, and are running Windows 8.1 or Windows 10.
And this is where I hit a big problem. Because Windows 8.1 & 10 have a group of protections specifically designed to stop low-level malware from loading before the OS and anti-malware software does:
Windows 8.1 supports four features to help prevent rootkits and bootkits from loading during the startup process:
-Secure Boot. PCs with UEFI firmware and a Trusted Platform Module (TPM) can be configured to load only trusted operating system bootloaders.
-Trusted Boot. Windows checks the integrity of every component of the startup process before loading it.
-Early Launch Anti-Malware (ELAM). ELAM tests all drivers before they load and prevents unapproved drivers from loading.
-Measured Boot. The PC’s firmware logs the boot process, and Windows can send it to a trusted server that can objectively assess the PC’s health.
At the end of that TechNet post describing the protections and how they work Microsoft was not shy in boasting about them:
Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows 8.1, these features have the potential to eliminate kernel-level malware from your network. This is the most groundbreaking anti-malware solution that Windows has ever had: It’s leaps and bounds ahead of everything else. With Windows 8.1, you can truly trust the integrity of your operating system.
So, as a Bad Guy who still very much wants to get my malware implanted deep within a target's PC --ie. kernel-level, bootloader-level, or UEFI-level-- so it will evade detection and persist for as long as possible, what methods and approaches exist to do so on a system that is protected by Secure Boot/Trusted Boot/etc. ? In other words, what options does a bad guy have to get around those safeguards and get his malware components to still load early on in boot?
Bonus question: What are some key countermeasures that a defender might want to think about in terms of blocking those attacker methods to circumvent those boot protections?
I use Windows here because of its predominance in work/enterprise client environments and because it's the ecosystem I'm most familiar with professionally. I'm well aware that these protections now exist on many other platforms, however. Feel free to talk about these boot protections and attacker methods to bypass them more generally if you want.
For the sake of simplicity, let's assume my APT unit isn't quite as advanced as the folks at Ft. Meade or the security researchers who manage to hide malware in the firmware of non-UEFI system parts like networking cards, video cards, etc.
This question talks a bit about how secure the businesses processes are that Microsoft uses to validate the identity of a developer and non-maliciousness of a component before it will sign that component so it can load during boot. A very interesting question/answer, but not one that really gets at what I'm trying to get at.
"Informative" Microsoft chart: