!Ah, caray¡
De que se puede modificar el UEFI, si se puede, y eso lo demostraron en una conferencia sobre seguridad donde desde el mismo sistema operativo demostraron la modificacion del UEFI de las miniPC Gigabyte BRIX. De esta manera desde una descarga visitando algun sitio web peligroso o bien, desde un simple documento de word infectado se abre la posibilidad de hacer ultravulnerable el sistema, ya que se puede agregar codigo malicioso al mismo UEFI de la tarjeta madre, lo cual lo hace indetectable para los sistemas de seguridad actuales; o almenos muy-muy dificil de detectar.
En su demostracion lo unico que modificaron fue el sistema de inicio del UEFI, pero con esto nos expone como un cracker podria agregar cualquier cosa y 'zombizar' nuestra PC, eso de minimo.
Por el momento esto solo se puede hacer en algunos modelos de la mini PC BRIX ded gigabyte debido a unos xploits existentes por codigo no deficiente y del cual ya estan trabajando para evitarlos.
https://www.bleepingcomputer.com/news/s ... ransomwareGigabyte Firmware Flaws Allow the Installation of UEFI RansomwareBy Catalin Cimpanu
Yesterday, at the BlackHat Asia 2017 security conference, researchers from cyber-security firm Cylance disclosed two vulnerabilities in the firmware of Gigabyte BRIX small computing devices, which allow an attacker to write malicious content to the UEFI firmware.
During their presentation, researchers installed a proof-of-concept UEFI ransomware, preventing the BRIX devices from booting, but researchers say the same flaws can be used to plant rootkits that allow attackers to persist malware for years.
Gigabyte preparing to release firmware updates
Cylance researchers said they've identified these flaws at the start of the year, and have worked with Gigabyte, American Megatrends Inc. (AMI), and CERT/CC to fix the flaws in time.
Affected Gigabyte devices include GB-BSi7H-6500 (firmware version vF6), and GB-BXi7-5775 (firmware version vF2).
Gigabyte is expected to release firmware vF7 for GB-BSi7H-6500 devices in the upcoming days. The GB-BXi7-5775 line is not being produced anymore and has reached EOL (End Of Life), so Gigabyte won't be releasing a new firmware for this series.
Vulnerabilities allow hackers to tamper UEFI firmware files
The two vulnerabilities discovered by Cylance researchers are CVE-2017-3197 and CVE-2017-3198. The first is a failure on Gigabyte's part to implement write protection for its UEFI firmware.
The second vulnerability is another lapse on Gigabyte's side, who forgot to implement a system that cryptographically signs UEFI firmware files. The second flaw also covers Gigabyte's insecure firmware update process, which doesn't check the validity of downloaded files using a checksum and uses HTTP instead of HTTPS. CERT/CC has issued an official Vulnerability Bote (VU#507496) for both flaws.
An attacker can exploit both flaws to execute code in the System Management Mode (SMM) and plant malicious code in the firmware itself. Cylance experts detail a possible attack as follows:
The attacker gains user-mode execution through an application vulnerability such as a browser exploit or a malicious Word document with an embedded script. From there, the attacker elevates his privileges by exploiting the kernel or a kernel module such as Capcom.sys to execute code in ring 0. A vulnerable SMI handler allows the attacker to execute code in SMM mode (ring -2) where he finally can bypass any write protection mechanisms and install a backdoor into the system's firmware. Write-protection mechanisms exist to prevent attackers from modifying the firmware; however, the affected systems do not enable them.
Gigabyte BRIX are small computers, similar to Intel NUCs, that can be used to replace bulky desktop towers. They are powerful devices and are very popular with businesses, due to their price, small size, and portability.
