As the title says, can BIOS/UEFI malware pretend that secure boot is enabled? And if so, is there any point to enabling secure boot on a device that came with it disabled (or that you previously disabled), considering that the BIOS/UEFI might already be infected?
2 Answers
Yes it's possible for malware to pretend that Secure Boot is enabled if the malware is able to modify the firmware settings to indicate that Secure Boot is active. This would usually happen by installing a malicious version of the Secure Boot keys. This would make it more difficult for users to detect compromised system, as the firmware will continue to report that Secure Boot is enabled and functioning properly. But like stated before, it wouldn't have downsides it to enable nevertheless and maybe it could prevent further malware installation (depending on the functionality of the malware). A firmware update or rollback in an authenticated way could maybe solve the problem. Some examples of malware with alike functionality would be:
"Stoned Bootkit" (bootkit malware that infects the Master Boot Record (MBR) of a hard drive. This malware is able to hide its presence in the firmware by modifying the boot process and it can survive firmware updates.)
"LoJax" for UEFI firmware, discovered 2018 by ESET (used by the APT28 group). LoJax malware is able to persist even after the operating system is re-installed and it can survive disk formatting.
"Firmware.Satori"targets UEFI firmware of IoT devices, It is able to survive firmware updates and it can also spread through the network.
"BadBIOS" is able to jump airgaps, meaning that it can spread through the air via high-frequency signals, and it can also spread through USB devices and other removable media.
-
Secure boot is more than a bit. How does those methods trick the TPM into returning correct measurements?– vidarloCommented Jan 21, 2023 at 10:03
-
"BadBIOS" is technically possible to implement. (Source.) However, Forest, who currently has 65,583 reputation, writes that the alleged current implementation of BadBIOS is nothing but a hoax. (Source.) Roger Grimes agrees. (Source.) Someone definitely could implement it in the future, but it's never been proven that they've done such a thing yet. Commented Feb 24, 2023 at 11:50
-
@unforgettableidSupportsMonica What is technically possible to implement, would be implemented sooner or later. And if there is already an implementation, it's not publicly known. The fact is: if I have a stream of data which is processed, it doesn't matter if it comes via copper cable or in some other way. If it's processed by my Device with a vulnerability on the input device itself or on some other point in the processing of the data stream, it can affect the device. But you are right that this all is statistically not very likely, but you have to admit: possible.– 127 001Commented Mar 8, 2023 at 3:51
-
@vidarlo Using one of the Secure Boot vulnerabilities like CVE-2022-21894. Blacklotus uses this one. One implementation method could be the well known 'bring your own driver' attack. Attack details in example of Blacklotus: bleepingcomputer.com/news/security/… The implementation details of TPM itself can be found here: media.defense.gov/2020/Sep/15/2002497594/-1/-1/0/…– 127 001Commented Mar 8, 2023 at 4:05
As the title says, can BIOS/UEFI malware pretend that secure boot is enabled?
There has been research showing methods to bypass operational SecureBoot and install rootkits in loaded OSes on certain vulnerable platforms while the user and their OS believes secure boot is enabled. It could certainly be possible with less stringent assumptions (attacker with control over bios).
And if so, is there any point to enabling secure boot on a device that came with it disabled (or that you previously disabled), considering that the BIOS/UEFI might already be infected?
Infected or not, it should be enabled. If it is not infected, it may prevent further infections. If one must operate an infected machine it may be useless to enable secure boot but it's already infected so there is no downside to enabling it. There is only upside as long as one remains suspicious of suspicious hardware.
-
I accepted the other answer but just wanted to say thanks for answering as well, as I unfortunately don't have enough reputation to upvote yet Commented Jan 24, 2023 at 10:26
-