Threat actor uses HP iLO rootkit (iLOBleed) to wipe servers

guest · Dec 29, 2021

December 29, 2021

An Iranian cyber-security firm said it discovered a first-of-its-kind rootkit that hides inside the firmware of HP iLO devices and which has been used in real-world attacks to wipe servers of Iranian organizations.

Named iLOBleed, the rootkit was discovered by Tehran-based security firm Amnpardaz and detailed in a report released on Tuesday.
According to the company, iLOBleed targets HP iLO (Integrated Lights-Out), a hardware device that can be added to servers or workstations as an add-on board.
Click to expand...

First iLOBleed attacks spotted in 2020
But Amnpardaz said that since 2020, it investigated several incidents where a mysterious threat actor compromised targets and hid inside iLO as a way to survive OS reinstalls and maintain persistence inside the victim’s network.

To avoid detection, researchers said the attacker disguised the iLOBleed rootkit as a module for the iLO firmware itself, and the attacker also crafted a fake update UI to show to system administrators when they tried to update the iLO firmware.

“The malware tries hard at simulating the upgrade process and goes to difficulties of displaying fake ‘upgraded’ versions in the web UI of the iLO and other places, but there is a catch: HP has changed the UI of the iLO considerably,” the Amnpardaz team said today.
Click to expand...

As Amnpardaz also pointed out in their report, the discovery of iLOBleed is a breakthrough and an achievement, primarily because there are very few security tools and products capable of detecting malware activity at iLO’s level—a component that operates deeper than the OS itself, let alone security products.
Click to expand...

Implant.ARM.iLOBleed.a

In this report, we analyze a rootkit discovered in-the-wild that hides inside the iLO, cannot be removed by firmware upgrades and can be hidden from the sight for a long time. This malware has been used by hackers for some time and we have been monitoring its performance. As far as we know, this is the first report of the discovery of real-world malware in iLO firmware in the world.

Since analyzing this malware requires some knowledge of the HP iLO firmware architecture, we’ll first give a general overview of the HP iLO architecture. Then, in the next section, we will analyze the discovered malware and its various modules. Finally, in the last section, we will discuss strategies and solutions for protecting iLO.
Click to expand...

Log in or Sign up

Threat actor uses HP iLO rootkit (iLOBleed) to wipe servers

guest Guest

Log in or Sign up

Threat actor uses HP iLO rootkit (iLOBleed) to wipe servers

guest Guest

Useful Searches