Weakness in Microsoft WPBT Impacting All Windows-based Devices Since Windows 8

guest · Sep 23, 2021

A New Bug in Microsoft Windows Could Let Hackers Easily Install a Rootkit
September 23, 2021
https://thehackernews.com/2021/09/a-new-bug-in-microsoft-windows-could.html

Security researchers have disclosed an unpatched weakness in Microsoft Windows Platform Binary Table (WPBT) affecting all Windows-based devices since Windows 8 that could be potentially exploited to install a rootkit and compromise the integrity of devices.

"These flaws make every Windows system vulnerable to easily-crafted attacks that install fraudulent vendor-specific tables," researchers from Eclypsium said in a report published on Monday.
"These tables can be exploited by attackers with direct physical access, with remote access, or through manufacturer supply chains. More importantly, these motherboard-level flaws can obviate initiatives like Secured-core because of the ubiquitous usage of ACPI [Advanced Configuration and Power Interface] and WPBT."
Click to expand...

WPBT, introduced with Windows 8 in 2012, is a feature that enables "boot firmware to provide Windows with a platform binary that the operating system can execute."

The main objective of WPBT is to allow critical features such as anti-theft software to persist even in scenarios where the operating system has been modified, formatted, or reinstalled.
Click to expand...

The vulnerability uncovered by the enterprise firmware security company is rooted in the fact that the WPBT mechanism can accept a signed binary with a revoked or an expired certificate to completely bypass the integrity check, thus permitting an attacker to sign a malicious binary with an already available expired certificate and run arbitrary code with kernel privileges when the device boots up.

"This weakness can be potentially exploited via multiple vectors (e.g., physical access, remote, and supply chain) and by multiple techniques (e.g., malicious bootloader, DMA, etc)," the researchers said.
Click to expand...

Eclypsium: Everyone Gets a Rootkit

Eclypsium Researchers Identify Weakness in Microsoft WPBT Impacting All Windows-based Devices Since Windows 8
By compromising the firmware update process, we were able to load our own implant DXE driver which controls various boot-related functions. Since UEFI ACPI protocols allow drivers to modify ACPI tables, we were able to add a new WPBT table of our choosing. The WPBT table specifies the actual location of the system binary that Windows will execute. As a result, we were able to use our “malicious” driver to create a WPBT table pointing to the payload of our choosing.

However, this officially should NOT have worked, as WPBT requires any binaries to be properly signed. Microsoft’s WPBT code-signing policy states: [...]
However, our testing revealed that this check will pass even if the code signing certificate has been explicitly revoked. To highlight this, we signed our malicious code using a Hacking Team code signing certificate that was revoked in 2015.
Click to expand...

Log in or Sign up

Weakness in Microsoft WPBT Impacting All Windows-based Devices Since Windows 8

guest Guest

Log in or Sign up

Weakness in Microsoft WPBT Impacting All Windows-based Devices Since Windows 8

guest Guest

Useful Searches