BOOTKITS: PAST, PRESENT & FUTURE

[Nytro]

Eugene Rodionov

ESET, Canada

Alexander Matrosov

Intel, USA

David Harley

ESET North America, UK

Email rodionov@eset.com; alexander.matrosov@

intel.com; david.harley.ic@eset.com

ABSTRACT

Bootkit threats have always been a powerful weapon in the

hands of cybercriminals, allowing them to establish a persistent

and stealthy presence in their victims’ systems. The most recent

notable spike in bootkit infections was associated with attacks on

64-bit versions of the Microsoft Windows platform, which

restrict the loading of unsigned kernel-mode drivers. However,

these bootkits are not effective against UEFI-based platforms.

So, are UEFI-based machines immune against bootkit threats (or

would they be)?

The aim of this presentation is to show how bootkit threats have

evolved over time and what we should expect in the near future.

First, we will summarize what we have learned about the

bootkits seen in the wild targeting the Microsoft Windows

platform: from TDL4 and Rovnix (the one used by the Carberp

banking trojan) up to Gapz (which employs one of the stealthiest

bootkit infection techniques seen so far). We will review their

infection approaches and the methods they have employed to

evade detection and removal from the system.

Secondly, we will look at the security of the increasingly

popular UEFI platform from the point of view of the bootkit

author as UEFI becomes a target of choice for researchers in

offensive security. Proof-of-concept bootkits targeting

Windows 8 using UEFI have already been released. We will

focus on various attack vectors against UEFI and discuss

available tools and what measures should be taken to mitigate

against them.

Download: https://www.virusbtn.com/pdf/conference/vb2014/VB2014-RodionovMatrosovHarley.pdf