ESET discovers first LoJax UEFI rootkit malware by Sednit group

Hey Rootandboot,
From what I gather of your post, this has been around for some time? and is even worse than described? I wonder if you could help us out by breaking down the issues, one by one, describing how each can be identified, your method of recovery for each, etc. I know it would help me (and others) to understand what you're going through. I mean, at this point, it sounds like you throw everything out and start over...

Rootandboot said:

I made an account just give everyone a little heads up... I actually laughed out loud when i seen this article published... Because i have been battling... No, getting roflstomped for almost 6 months trying regain the nearly nrand new high end hardware that initially got hit with one of these uefi rootkit/bootkits.. Which i have come to suspect is a code implant in the spi memory that sits at the helm of a very complex and highly customizable malware framework... Think of a highly advanced veriation of the metasploit framework... With a root/boot kit implant on the target machine(s) providing a somewhat autonomous monitoring, control and configuration platform that with capabilitiy to manage and number of targets... Or victims rather, becuse le5s face it... This sort of attack vector in any but the must serious legal scenarios... Is nothing short of domestix terrorism... This aeticle about lojax makes it sound to me like the peace loving flowerchild sibling of this n8gh5mareware that has been wrecking my life for the past 6 months. Sure it flashes that poisoned code to 5he spi memory... But trust me that is just like the sweet and tender first kiss... Before the the malicious grudge f****ing starts... It does a lot of different things... Like flash out the rom on your Gpu then set up a virtual raid in the video memory, report bad bad hard disk clusters to the os effectively creating private unscanned hd space at will... It creates a virtual scsi bus and flashes the firmware on devices like cd/dvd roms and hard drives then uses supposedly generic MS dr8vers to route all your devices onto that bus.. Where it has complete control to inject malwarw3 in realtime should you try and boot up liv3 cds or whatever... It will poison any images you try t9 dl or burn, i have seen crazy crazy things while studying this ... Thing, and dont think for a second that it is not still under heavy developement aand being .. And i quote "field tested" directly from comments in multiple configuration files and logs... Its often referred to as thier "EXPERIMENT" ... It mqy very well be the group that is being credited, it could also very well not be.. There is no way to certain of anything at this point to be honest. The only thing for certain is that whatever this "project" is.... Its WELL funded and adequately staffed... Around the clock with frightenigly skilled mechanics. It usez bluetooth primarily for network connection... Right under your nose at first... And if 8t connects to your router... Ever device. Connected to it will get its firmware flashed and become an attack vector and asset. I have documented tons of files, config s ripts, instructional comments... Logs... And even a folder with 300+ poisoned firmware images at one point, for a wide variety of devices... Complete with instructions and pointers on the best methods to co.primise these devices for remote firmware flashing... At one point my rig was bei g configurwd via a repurposed version of puppet enterprise it automation software... Then a day or so later its mode of attack and comtrol was something else... So yeah, this is some next level shit.. And its unnerving when you realize you computer has been virtualized on your own hardware and someone else is in tje hypervisor seat... That you audio devices are recording.. and listwning for key words ... All. By persons unknown and without explanation. Anyways stay alert, look into hardware methods of trust certificate storage, and invest in a device that you can manually reflash things like the spi memory with. Lol. I have like 4 or 5 machines with full blown nightmareware infections... I am tr6ing to decide what to do at this point.
Sorry for the crazy sounding rant... But some bank in the balkins is NOT the first victim of this sort of thing.. I cqn say that with 100% certainty.

Sorry for shitty c9mposition h3re but this is quick rant via a phone... Hope it helps someone in someway, at some point.

Rootandboot said:

I made an account just give everyone a little heads up... <Snip>

Hi Rootandboot:

Since you posted from your phone, it made lots of spelling errors and everything's all run together, I thought I'd try to paragraph it and correct the spelling as best I could. My reasoning for doing this is that there are some here (myself included) who may not be able to understand with it all jumbled together. And there are others who will take one look and panic. At any rate, I haven't attempted to correct any grammar because that might change the meaning of what you've written. Here's what I've done; feel free to slap my typing fingers if I've offended ya . . .

I made an account just give everyone a little heads up ... I actually laughed out loud when I seen this article published ... Because I have been battling ... No, getting rofl stomped for almost 6 months trying regain the nearly brand new high end hardware that initially got hit with one of these UEFI rootkit/bootkits ... Which I have come to suspect is a code implant in the SPI memory that sits at the helm of a very complex and highly customizable malware framework ...

Think of a highly advanced variation of the metasploit framework... With a root/boot kit implant on the target machine(s) providing a somewhat autonomous monitoring, control and configuration platform that with capability to manage and number of targets ... Or victims rather, because le5s face it ... This sort of attack vector in any but the most serious legal scenarios ... Is nothing short of domestic terrorism... This article about Lojax makes it sound to me like the peace-loving flowerchild sibling of this nightmareware that has been wrecking my life for the past 6 months.

Sure, it flashes that poisoned code to the SPI memory... But trust me that is just like the sweet and tender first kiss... Before the malicious grudge [expletive] starts... It does a lot of different things... Like flash out the rom on your GPU then set up a virtual raid in the video memory, report bad, bad hard disk clusters to the OS effectively creating private unscanned HD space at will... It creates a virtual SCSI bus and flashes the firmware on devices like CD/DVD ROMs and hard drives then uses supposedly generic MS dr8vers to route all your devices onto that bus ...

Where it has complete control to inject malware in real time should you try and boot up live CDs or whatever... It will poison any images you try to DL or burn, I have seen crazy, crazy things while studying this ... Thing, and don’t think for a second that it is not still under heavy development and being ... And I quote "field tested" directly from comments in multiple configuration files and logs ... It’s often referred to as their "EXPERIMENT" ...

It may very well be the group that is being credited, it could also very well not be ... There is no way to certain of anything at this point to be honest. The only thing for certain is that whatever this "project" is ... It’s WELL funded and adequately staffed... Around the clock with frighteningly skilled mechanics. It uses Bluetooth primarily for network connection ... Right under your nose at first ...

And if it connects to your router ... Ever device. Connected to it will get its firmware flashed and become an attack vector and asset. I have documented tons of files, config scripts, instructional comments ... Logs ... And even a folder with 300+ poisoned firmware images at one point, for a wide variety of devices ... Complete with instructions and pointers on the best methods to compromise these devices for remote firmware flashing... At one point my rig was being configured via a repurposed version of puppet enterprise it automation software... Then a day or so later its mode of attack and control was something else... So yeah, this is some next level [expletive] …

And its unnerving when you realize your computer has been virtualized on your own hardware and someone else is in the hypervisor seat... That your audio devices are recording ... and listening for key words ... All. By persons unknown and without explanation.

Anyways stay alert, look into hardware methods of trust certificate storage, and invest in a device that you can manually reflash things like the SPI memory with. Lol. I have like 4 or 5 machines with full blown nightmareware infections ... I am trying to decide what to do at this point.

Sorry for the crazy sounding rant... But some bank in the Balkans is NOT the first victim of this sort of thing ... I can say that with 100% certainty.

Sorry for [expletive] composition here but this is quick rant via a phone... Hope it helps someone in some way, at some point.

Hey thank you very much, I most appreciate your time and effort. when i have some time i want sit down and type up a more informative post, covering more in terms its methods of attack, persistance and some of the counter measures that i witnessed while trying to librtate my hardware.

It will take a little time as some of it is so fantastic that it sounds like rmablings of rampant paranoia.. Which is by design, i have come to believe.

Thanks again,

RnB

Rootandboot said:

Hey thank you very much, I most appreciate your time and effort. when i have some time i want sit down and type up a more informative post, covering more in terms its methods of attack, persistance and some of the counter measures that i witnessed while trying to librtate my hardware.
It will take a little time as some of it is so fantastic that it sounds like rmablings of rampant paranoia.. Which is by design, i have come to believe.
Thanks again,
RnB

That would be great. Looking forward to it.