New vicious UEFI bootkit vuln found for Windows 8

New vicious UEFI bootkit vuln found for Windows 8.

-- Tom

 

Fun stuff.

 

Imagine that

Now maybe everyone will quit bragging about the uncrackable Windows 7 & 8

 

"The UEFI platform will soon become the new field of war between malware writers and the security industry unless SecureBoot is used to ensure that only digitally signed UEFI bootloaders can be executed at the system bootup." (from the above El Reg link)
If UEFI replaces the BIOS and MBR, couldn't I have some low-tech $0.001 UEFI ultra-super-supreme-secure jumpers. The same ones that allowed me to yawn when regarding BIOS malware?

Anyone with UEFI/hardware knowledge who can point out/offer some links why that's a stupid perception on my part? Or perhaps not?

 

I think the issue here is that UEFI is more complex than BIOS and you can write in C, which is a hell of a lot easier than ASM. The combination just makes it a bit easier to target.

Overall SecureBoot is going to prevent a lot more malware than it allows in my opinion.

@Baserk,

There's no jumper to replace the MBR. You'd need some kinda LiveCD. If malware has control over your bootloader you may not be able to get on one, I don't know.

 

Firstly, this has already been posted in the "Norton scaring Windows 8 users" thread.

Secondly, this is complete and utter sensational garbage, quite simply because secure boot was DISABLED. Having secure boot DISABLED means you might as well run a system with BIOS. The whole sensationalist part about targeting Windows 8 is complete nonsense, if Windows 8 OEMs want their PCs to be certified (which they will) they will HAVE to ship with Secure Boot turned ON.

Thirdly, what's with the "lagging behind OS X"? What does UEFI have to do with the OS? Not only that, but they specifically mention in their own article:

I don't see any mention of a vulnerability or exploit being used in the original article.

 

The problem I see is faked certificates. FYI it costs $75 to get a sedcureboot certificate from MS. I can see malware authors exploiting this system due to the fact it's certificate based. Fake one or impersonate one and you own the system and you can load your rootkit.

Look what happened with Realteak and stuxnet, faked signed driver and BOOM infected.