LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

guest · Sep 27, 2018

LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
September 27, 2018
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/

Some UEFI rootkits have been presented as proofs of concept; some are known to be at the disposal of (at least some) governmental agencies. However, no UEFI rootkit has ever been detected in the wild – until we discovered a campaign by the Sednit APT group that successfully deployed a malicious UEFI module on a victim’s system.

First, it shows that UEFI rootkits are a real threat, and not merely an attractive conference topic.

Three different types of tool were found alongside LoJax userland agents. [...] The purpose of the second tool was to save an image of the system firmware to a file [...] The third tool’s purpose was to add a malicious UEFI module to the firmware image and write it back to the SPI flash memory, effectively installing the UEFI rootkit on the system.

Sednit’s UEFI rootkit is not properly signed, so the first security mechanism that could have blocked such an attack is Secure Boot.
Click to expand...

Research Paper (PDF): https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf

Rico · Sep 27, 2018

I believe it was Eset who outed Fancy Bear

itman · Sep 27, 2018

Note that Win 10 secure boot option will prevent this malware:

On systems that were targeted by the LoJax campaign, we found various tools that are able to access and patch UEFI/BIOS settings. All used a kernel driver, RwDrv.sys, to access the UEFI/BIOS settings. This kernel driver is bundled with RWEverything, a free utility available on the web that can be used to read information on almost all of a computer’s low-level settings, including PCI Express, Memory, PCI Option ROMs, etc. As this kernel driver belongs to legitimate software, it is signed with a valid code-signing certificate.
Click to expand...

The driver noted is not Microsoft driver code signed.

Also based on the increased number of postings on the Eset forum in regards to CompuTrace detections, Eset cannot differentiate between a legit factory install and a malicious version. Many laptops have CompuTrace installed by the manufacturers for theft tracking purposes.

FanJ · Sep 28, 2018

Statement, in German, by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik; BSI):
Stellungnahme des BSI zur Schadsoftware "LoJax"
https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/LoJax-Schadsoftware_28092018.html

Um LoJax überhaupt installieren zu können, muss ein Täter jedoch bereits die Kontrolle über den Computer übernommen haben, etwa durch Ausnutzung bekannter Schwachstellen im Betriebssystem.
Click to expand...

PS: sorry, it is in German; I couldn't find at the moment an English version at the BSI site.

TonyW · Sep 28, 2018

FanJ said: ↑

PS: sorry, it is in German; I couldn't find at the moment an English version at the BSI site.
Click to expand...

According to a search, the English translation of the quoted text appears to be:

To be able to install LoJax at all, however, an offender must already have taken control of the computer, for example by exploiting known vulnerabilities in the operating system.

FanJ · Sep 28, 2018

TonyW said: ↑

According to a search, the English translation of the quoted text appears to be:

To be able to install LoJax at all, however, an offender must already have taken control of the computer, for example by exploiting known vulnerabilities in the operating system.
Click to expand...

Yes, I think that that is it.

itman · Sep 28, 2018

To be able to install LoJax at all, however, an offender must already have taken control of the computer, for example by exploiting known vulnerabilities in the operating system
Click to expand...

This is not 100% accurate. For example, its components could be bundled in a software installer you downloaded which would allow the driver to be installed w/o issue.

FanJ · Oct 2, 2018

Most likely not needed to post now anymore some more links but I do it anyway:
https://www.theregister.co.uk/2018/09/28/uefi_rootkit_apt28/
https://arstechnica.com/information...aptop-security-software-hijacked-by-russians/

---

And the thread at the Eset forum:
https://forum.eset.com/topic/16998-uefi-rootkit-lojax/

From there a quote by Peter Randziak of Eset:

ESET is able to detect it in the system and in the UEFI update file as well.
The cleaning is not possible as it resides in the UEFI.
Click to expand...

guest · Nov 16, 2018

Cybaze ZLab- Yoroi team spotted a new variant of the APT28 Lojax rootkit
November 16, 2018
https://securityaffairs.co/wordpress/78085/malware/apt28-lojax-variant.html

A new variant of the infamous APT28 Lojax (aka Double-Agent) has been discovered by the Cybaze ZLab – Yoroi team. It is the latest version of the well-known rootkit Double-Agent, previously analyzed by ESET researchers.

The behavior of the Lojax sample seems to be similar to the previous versions and exploits the legitimate “Absolute Lojack” software to grant its persistence on the infected system.
[...] we have discovered a new C2 address, unknown to the community and to the threat intelligence platforms until now.
Mitigation
Despite the presence of the UEFI “Secure Boot”, this malware could execute itself because it replaces only the “rpcnetp.exe” component. Anyhow, the MalwareLab researchers advise to keep enabled the UEFI Secure Boot and keep always updated the Operative System and the anti-malware solution.

YARA Rules and additional technical details are available on the Yoroi blog.
Click to expand...

ronjor · Jan 16, 2019

LoJax, the unkillable rootkit, continues to operate 8 months after its discovery

Dan Goodin - 1/16/2019
Control servers for Fancy Bear's UEFI-burrowing malware still responding to pings.
Click to expand...

Log in or Sign up

LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

guest Guest

Rico Registered Member

itman Registered Member

FanJ Updates Team

TonyW Registered Member

FanJ Updates Team

itman Registered Member

FanJ Updates Team

guest Guest

ronjor Global Moderator

Log in or Sign up

LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

guest Guest

Rico Registered Member

itman Registered Member

FanJ Updates Team

TonyW Registered Member

FanJ Updates Team

itman Registered Member

FanJ Updates Team

guest Guest

ronjor Global Moderator

Useful Searches