Hacking Team's malware uses UEFI rootkit to survive OS reinstalls

The feature allows the company's software to persist even if the hard disk drive if replaced

Victim of identity theft

Victim of identity theft

Surveillance software maker Hacking Team has provided its government customers with the ability to infect the low-level firmware found in laptops and other computers that they wanted to spy on.

The company developed a tool that can be used to modify a computer's UEFI (Unified Extensible Firmware Interface) so that it silently reinstalls its surveillance tool even if the hard drive is wiped clean or replaced.

UEFI is a replacement for the traditional BIOS (Basic Input/Output System) and is meant to standardize modern computer firmware through a reference specification. But there are multiple companies that develop UEFI firmware, and there can be significant differences between the implementations used by PC manufactures.

Hacking Team developed a method for infecting the UEFI firmware developed by Insyde Software, a Taiwanese company that counts Hewlett-Packard, Dell, Lenovo, Acer and Toshiba among its customers, according to security researchers from antivirus vendor Trend Micro.

"However, the code can very likely work on AMI BIOS as well," the Trend Micro researchers said in a blog post. AMI BIOS refers to firmware developed by American Megatrends, a long-time BIOS market leader.

Trend Micro found details about the UEFI rootkit in the more than 400GB worth of files and emails that were leaked recently from Milan-based Hacking Team by a hacker. For the past week, security researchers and journalists have been sifting through the data uncovering malware source code, client lists, exploits for unpatched vulnerabilities and more information.

A Hacking Team slideshow presentation suggests that installing the UEFI rootkit requires physical access to the target computer, but remote installation can't be ruled out, the Trend Micro researchers said.

Gaining temporary physical access to some computers wouldn't be a big problem for government agencies, because many countries have laws that allow the inspection of laptops and other devices at their borders.

Hacking Team refers to its surveillance software as "the hacking suite for governmental interception" and claims to sell it only to government agencies. Even so, most antivirus vendors detect the highly intrusive software, which is known as Remote Control System (RCS) or Galileo, as malware.

To install the RCS UEFI rootkit, an attacker must reboot the system into the UEFI shell, extract the firmware, write the rootkit to the dumped image and then flash it back to the system, the Trend Micro researchers said.

The rootkit itself has three modules: one for reading and writing to NTFS file systems; one for hooking the OS boot process; and one that checks if RCS is present on the system.

The rootkit checks for the existence of two software agents called scout.exe and soldier.exe every time the system is rebooted. If they don't exist, it installs scout.exe at a predefined location inside the OS, the Trend Micro researchers said.

The possibility of installing rootkits into a computer's BIOS or UEFI firmware has been demonstrated by multiple researchers at security conferences over the past several years. However, known cases of such rootkits being used in the wild are extremely rare.

A search through the email communications leaked from Hacking Team reveals that the company's engineers have kept an eye out for every article and research paper on BIOS and UEFI hacking written since 2009. This includes blog posts on cracking BIOS passwords, papers on defeating signed BIOS enforcement and leaked documents about the U.S. National Security Agency's BIOS infecting capabilities.

The emails also show that the company's research and development team was working on the "persistent UEFI infection" feature since at least mid-2014. On September 9, a customer from INTECH-Solutions, a German vendor of "technology and solutions for law enforcement and intelligence agencies" had already inquired about a list of computers for which the persistent infection feature worked.

"We are sorry, we have not a list of Computer Models where the persistent UEFI infection works well," a Hacking Team employee responded. "We tested the last series of Acer with UEFI boot. We are working to support other models like Asus but at the moment we can't provide you a date of that release."

In December, Hacking Team's operations manager Daniele Milan asked a senior security engineer for clarifications on the feature in order to answer potential customer inquiries.

The engineer responded that the feature was tested successfully on Dell Latitude 6320, Dell Precision T1600, Asus X550C and Asus F550C. It also worked on Toshiba Satellite C50 and the Acer Aspire E1-570, but with a higher risk of failure.

In principle, the software works on all laptops, workstations and servers with 64-bit CPU architectures that support Windows 7 and Windows 8 Pro, the engineer said.

In a later email, he mentioned that the "chiavetta" also works on Dell servers. Chiavetta means key in Italian, but it's also widely used to refer to USB thumb drives, giving a hint about how the UEFI rootkit can be deployed.

To prevent such infections, Trend Micro advises users to enable the UEFI SecureFlash option, to set up a BIOS/UEFI password and to update the firmware to its latest version so that it has the latest security patches. UEFI/BIOS updates are usually distributed by computer manufacturers through their support websites and some of them do fix issues identified by security researchers.

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusiontrend microsecurityspywaremalwareHacking Team

More about AcerDellGalileoLenovoNational Security AgencyPrecisionToshibaTrend Micro

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts