Trickbot trojan found to now have the ability to modify a computer's UEFI

Tech Xplore ^ | 12/04/2020 | Bob Yirka

[BenLurkin]

A combined team of security experts from Advanced Intelligence and Eclypsium has announced that the Trickbot trojan malware now has the ability to modify a computer's Unified Extensible Firmware Interface—the interface between the firmware on a computer motherboard and the computer's operating system—in this case, Microsoft Windows.

Trickbot has been in the news of late due to its advanced capabilities. It has a modular design and is notable for its ability to gain administrative capabilities on infected computers. The entities behind the creation of the trojan are believed to be criminals in Russia and North Korea, and they have used it to target telecoms, health care firms, education institutions and even infrastructure operators (quite often in the form of ransomware).

When a computer boots up, the UEFI and firmware work together to bring up the operating system—if nefarious code has been embedded in the firmware, it can load its own software modules or even modify the operating system as it loads. Such modules would then go undetected by conventional antivirus software and would not be overcome, even if the hard drive were wiped clean or replaced altogether.

[MikelTackNailer]

This sounds as insidious as rootkits and harder to deal with. Perhaps the time has come for Windows users to consider “burner computers” like criminals dispose of cheap telephones...if they won’t move to a more secure operating system.

[daniel1212]

"When a computer boots up, the UEFI and firmware work together to bring up the operating system—if nefarious code has been embedded in the firmware, it can load its own software modules or even modify the operating system as it loads." "The entities behind the creation of the trojan are believed to be criminals in Russia and North Korea" https://techxplore.com/news/2020-12-trickbot-trojan-ability-uefi.html

[a fool in paradise]

Remote BIOS and FW update deliver was not a good change. Maybe corporate IT thinks it is but it isn’t.

[dayglored]

Trickbot malware... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

[Dalberg-Acton]

Microsoft Windows!

[wastedyears]

Such modules would then go undetected by conventional antivirus software and would not be overcome, even if the hard drive were wiped clean or replaced altogether.

So does it modify the ROM?

[rockrr]

Interesting point.

I did a search for more articles on Trickbot and Trickboot and noticed something in common with every one of them: they don’t identify the vulnerable OS by name. Instead they refer to “the OS” exclusively when describing how the malware operates.

We are left to assume that only Microsoft is affected but since this particular malware attacks the motherboard firmware first it is reasonable to conclude that any OS is potentially vulnerable (since the malware has access to modify the OS system files before the OS is booted).

I made this same comment to a couple of the articles and will post if they respond.

[M Kehoe]

Hi.

Trust voting by the internet they say.

Trust the DOJ and FBI they say.

Trust the media they say.

My trust rest in God, guts and guns.

5.56mm