implants – Noise https://noise.getoto.net The collective thoughts of the interwebz Wed, 27 Jul 2022 14:20:44 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.2 New UFEI Rootkit https://noise.getoto.net/2022/07/28/new-ufei-rootkit/ Thu, 28 Jul 2022 11:16:52 +0000 https://www.schneier.com/?p=65704 Kaspersky is reporting on a new UFEI rootkit that survives reinstalling the operating system and replacing the hard drive. From an article:

The firmware compromises the UEFI, the low-level and highly opaque chain of firmware required to boot up nearly every modern computer. As the software that bridges a PC’s device firmware with its operating system, the UEFI—short for Unified Extensible Firmware Interface—is an OS in its own right. It’s located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch the code. Because it’s the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. ...

]]> Injecting a Backdoor into SolarWinds Orion https://noise.getoto.net/2021/01/19/injecting-a-backdoor-into-solarwinds-orion/ Tue, 19 Jan 2021 12:16:36 +0000 https://www.schneier.com/?p=61768 Crowdstrike is reporting on a sophisticated piece of malware that was able to inject malware into the SolarWinds build process:

Key Points

  • SUNSPOT is StellarParticle’s malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product.
  • SUNSPOT monitors running processes for those involved in compilation of the Orion product and replaces one of the source files to include the SUNBURST backdoor code.
  • Several safeguards were added to SUNSPOT to avoid the Orion builds from failing, potentially alerting developers to the adversary’s presence...
]]>