An analysis of leaked chats from the notorious Conti ransomware group earlier this year has revealed that the syndicate has been working on a set of firmware attack techniques that could offer a path to accessing privileged code on compromised devices.
“Control over firmware gives attackers virtually unmatched powers both to directly cause damage and to enable other long-term strategic goals,” firmware and hardware security firm Eclypsium said in a report shared with The Hacker News.
“Such level of access would allow an adversary to cause irreparable damage to a system or to establish ongoing persistence that is virtually invisible to the operating system.”
Specifically, this includes attacks aimed at embedded microcontrollers such as the Intel Management Engine (ME), a privileged component that’s part of the company’s processor chipsets and which can completely bypass the operating system.
It’s worth noting that the reason for this evolving focus is not because there are new security vulnerabilities in Intel chipsets, but rather it banks on the possibility that “organizations do not update their chipset firmware with the same regularity that they do their software or even the UEFI/BIOS system firmware.”
The conversations among the Conti members, which leaked after the group pledged its support to Russia in the latter’s invasion of Ukraine, have shed light on the syndicate’s attempts to mine for vulnerabilities related to ME firmware and BIOS write protection.
This entailed finding undocumented commands and vulnerabilities in the ME interface, achieving code execution in the ME to access and rewrite the SPI flash memory, and dropping System Management Mode (SMM)-level implants, which could be leveraged to even modify the kernel.
The research ultimately manifested in the form of a proof-of-concept (PoC) code in June 2021 that can gain SMM code execution by gaining control over the ME after obtaining initial access to the host by means of traditional vectors like phishing, malware, or a supply chain compromise, the leaked chats show.
The research ultimately manifested in the form of a proof-of-concept (PoC) code in June 2021 that can gain SMM code execution by gaining control over the ME after obtaining initial access to the host by means of traditional vectors like phishing, malware, or a supply chain compromise, the leaked chats show.
Read more: https://bit.ly/3xe1dux
You can also read this: Black Hat Asia: Firmware Supply-Chain Woes Plague Device Security