Persistent BIOS Infection

•Transferir como ODP, PDF•

2 gostaram•992 visualizações

guest042636

Tecnologia

“ The early bird catches the worm ” CORE SECURITY TECHNOLOGIES © 200 9 Anibal L. Sacco (Ssr Exploit writer) Alfredo A. Ortega (Ssr Exploit writer) Persistent BIOS Infection

Introduction ,[object Object],[object Object]

A little bit of history: Commonly used persistency methods: ,[object Object]

Kernel mode backdoor How can this be done more effectively?

Mais conteúdo relacionado

Mais procurados

TUGAS MEMBUAT PRESENTASI TENTANG SPEC KOMPUTER DAN SMARTPHONE

dede abdulah

Spec00315

guesta6dbd5

VMware’s Nathan Small who works as a Staff Engineer at Global Support Services has put together a great presentation about Advanced Root Cause Analysis. The presentation was designed to give you more insight into how a VMware Technical Support Engineer reviews logs, gathers data and performs in-depth analysis. Nathan is hoping to show you the skills they’re using every day to help determine the root cause for an issue in your environment. With this core knowledge, you will become more self-sufficient within your own environment and be able to diagnose an issue as it occurs rather than after the damage has been done.

Advanced Root Cause Analysis

Eric Sloof

Analisis_avanzado_vmware

virtualizacionTV

Highload осень 2012 лекция 2

Technopark

Tr15 1332

teknikito

Changes

Yhorledy Cardenas

Exor epc 0036_Spec Sheet

Motherboard

Ict - Motherboard

La2 Motherboard

SCADA StrangeLove 2: We already know

qqlan

Network Docs

Sify Technologies

Aditech innodisk-flash disk technology

Vilas Fulsundar

EMC Data Storage Systems

webmaster-ibremarketing

P4i45 gv r5

rodanteg

Hardware Management Module

Aero Plane

Mais procurados (17)

TUGAS MEMBUAT PRESENTASI TENTANG SPEC KOMPUTER DAN SMARTPHONE

Spec00315

Advanced Root Cause Analysis

Analisis_avanzado_vmware

Highload осень 2012 лекция 2

Tr15 1332

Changes

Exor epc 0036_Spec Sheet

Motherboard

Ict - Motherboard

La2 Motherboard

SCADA StrangeLove 2: We already know

Network Docs

Aditech innodisk-flash disk technology

EMC Data Storage Systems

P4i45 gv r5

Hardware Management Module

Semelhante a Persistent BIOS Infection

Windows Debugging with WinDbg

Arno Huetter

Bootkit threats have always been a powerful weapon in the hands of cybercriminals, allowing them to establish persistent and stealthy presence in their victims' systems. The most recent notable spike in bootkit infections was associated with attacks on 64-bit versions of the Microsoft Windows platform, which restrict the loading of unsigned kernel-mode drivers. However, these bootkits aren't effective against UEFI-based platforms. So, are UEFI-based machines immune against bootkit threats (or would they be)? The aim of this presentation is to show how bootkit threats have evolved over time and what we should expect in the near future. Firstly, we will summarize what we've learned about the bootkits seen in the wild targeting the Microsoft Windows platform: from TDL4 and Rovnix (which was used by the Carberp banking trojan) up to Gapz (which employs one of the stealthiest bootkit infection techniques seen so far). We will review their infection approaches and the methods they have employed to evade detection and removal from the system. Secondly, we will look at the security of the increasingly popular UEFI platform from the point of view of the bootkit author, as UEFI is becoming a target of choice for researchers in offensive security, and proof-of-concept bootkits targeting Windows 8 OS using UEFI have already been released. We will focus on various attack vectors against UEFI and discuss available tools and what measures should be taken to mitigate against them.

Bootkits: past, present & future

Alex Matrosov

Troubleshooting Linux Kernel Modules And Device Drivers

Satpal Parmar

Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1

Jagadisha Maiya

2020-ntn-vsphere_performance_principles_bondzio.pdf

PhmNgcTr3

BIOS, Linux and Firmware Test Suite in-between

Alex Hung

The Eclipse Edje project, initiated by MicroEJ, defines a standard high-level Java API for accessing hardware features delivered by 32-bit microcontrollers for using serial links, general purpose inputs/outputs, or digital/analog converters. MCUs are small, low-cost, low-power processors designed to run software in resource-constrained environments: low memory (typically KB), flash (typically MB) and frequency (typically MHz). MCUs are provided by silicon vendors along with evaluation kits and are typically the ideal vectors for large scale deployments of low-power and cost-effective IoT, embedded or wearable devices. Edje aims at unifying and easing the programming of apps for MCUs with the largely adopted Java language.

Eclipse Edje: A Java API for Microcontrollers

MicroEJ

BMCArmor: A Hardware Protection Scheme for Bare-metal Clouds

Shinagawa Laboratory, The University of Tokyo

Alex Matrosov, Cylance This presentation is meant to serve as an alarum for hardware vendors; BIOS-level security researchers and defenders; and sophisticated stakeholders who want to know the current state of UEFI exposure and threats. The situation is serious but, with the right tools and knowledge, we can prevail. Hardware vendors such as Intel have introduced new protection technologies like Intel Boot Guard (since Haswell) and BIOS Guard (since Skylake). Boot Guard protects Secure Boot's "Root of Trust" from firmware-based attacks by verifying that a trusted UEFI firmware is booting the platform. When BIOS Guard is active, only guarded modules can modify SPI flash memory; this can protect from persistent implants. Both technologies run on a separate CPU known as the "Authenticated Code Module" (ACM), which isolates them from attackers and also protects from race condition attacks. Those "Guard" technologies are sometimes referred to as UEFI rootkit killers. Not many details are publicly available regarding these technologies. In this presentation, I will discuss particular implementations on hardware with the most recent Intel CPUs such as Skylake and Kaby Lake. Most of the information has been extracted from UEFI firmware modules by reverse engineering. This DXE and PEI modules cooperated with ACM-code for enabling, configuration and initialization. This talk will also cover some weaknesses of those guards. Where are the BIOS guardians failing? How difficult is it to bypass these protections and install a persistent rootkit from the operating system?

BlueHat v17 || Betraying the BIOS: Where the Guardians of the BIOS are Failing

BlueHat Security Conference

Dx diag

Ronnie Lingafelter

operating and configuring cisco a cisco IOS device

scooby_doo

Developing a Windows CE OAL.ppt

KundanSingh887495

Information Gathering 2

Aero Plane

44CON London 2015 - Jtagsploitation: 5 wires, 5 ways to root

44CON

Cisco network equipment has always been an attractive attack target due to its prevalence and the key role that it plays in network structure and security. This equipment is based on a wide variety of OS (firmware) architectures, types, and versions, so it is much harder to develop a universal shellcode. Publicly available Cisco IOS shellcodes are tailored to specific equipment, have narrow functionality, and are not exactly useful for penetration testing. This talk is the presentation of a research initiated by our research center to create a shellcode which is as easily portable between different IOS firmwares as possible and which provides a lot of pentesting features because it can dynamically change the shellcode destination at the stage of post-exploitation. We will also consider the possibility of creating a worm which could spread across the infrastructure, from firewall to router, from router to switch, etc.

Cisco IOS shellcode: All-in-one

DefconRussia

bios.docx

SUBIRKUMARPANDA1

Bootkits: Past, Present & Future - Virus Bulletin

ESET

Linux kernel debugging(PDF format)

yang firo

Linux kernel debugging(ODP format)

yang firo

SiliconFailsafeForIoT_Doin

Jonny Doin

Semelhante a Persistent BIOS Infection (20)

Windows Debugging with WinDbg

Bootkits: past, present & future

Troubleshooting Linux Kernel Modules And Device Drivers

Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1

2020-ntn-vsphere_performance_principles_bondzio.pdf

BIOS, Linux and Firmware Test Suite in-between

Eclipse Edje: A Java API for Microcontrollers

BMCArmor: A Hardware Protection Scheme for Bare-metal Clouds

BlueHat v17 || Betraying the BIOS: Where the Guardians of the BIOS are Failing

Dx diag

operating and configuring cisco a cisco IOS device

Developing a Windows CE OAL.ppt

Information Gathering 2

44CON London 2015 - Jtagsploitation: 5 wires, 5 ways to root

Cisco IOS shellcode: All-in-one

bios.docx

Bootkits: Past, Present & Future - Virus Bulletin

Linux kernel debugging(PDF format)

Linux kernel debugging(ODP format)

SiliconFailsafeForIoT_Doin

Último

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

Zilliz

Keynote 2: APIs in 2030: The Risk of Technological Sleepwalk Paolo Malinverno, Growth Advisor - The Business of Technology Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

apidays

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

💥 You’re lucky! We’ve found two different (lead) developers that are willing to share their valuable lessons learned about using UiPath Document Understanding! Based on recent implementations in appealing use cases at Partou and SPIE. Don’t expect fancy videos or slide decks, but real and practical experiences that will help you with your own implementations. 📕 Topics that will be addressed: • Training the ML-model by humans: do or don't? • Rule-based versus AI extractors • Tips for finding use cases • How to start 👨‍🏫👨‍💻 Speakers: o Dion Morskieft, RPA Product Owner @Partou o Jack Klein-Schiphorst, Automation Developer @Tacstone Technology

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam

UiPathCommunity

Accelerating FinTech Innovation: Unleashing API Economy and GenAI Vasa Krishnan, Chief Technology Officer - FinResults Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...

apidays

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

MadyBayot

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

Join our latest Connector Corner webinar to discover how UiPath Integration Service revolutionizes API-centric automation in a 'Quote to Cash' process—and how that automation empowers businesses to accelerate revenue generation. A comprehensive demo will explore connecting systems, GenAI, and people, through powerful pre-built connectors designed to speed process cycle times. Speakers: James Dickson, Senior Software Engineer Charlie Greenberg, Host, Product Marketing Manager

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

DianaGray10

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

Understanding the FAA Part 107 License ..

Christopher Logan Kennedy

DBX First Quarter 2024 Investor Presentation

Dropbox

The microservices honeymoon is over. When starting a new project or revamping a legacy monolith, teams started looking for alternatives to microservices. The Modular Monolith, or 'Modulith', is an architecture that reaps the benefits of (vertical) functional decoupling without the high costs associated with separate deployments. This talk will delve into the advantages and challenges of this progressive architecture, beginning with exploring the concept of a 'module', its internal structure, public API, and inter-module communication patterns. Supported by spring-modulith, the talk provides practical guidance on addressing the main challenges of a Modultith Architecture: finding and guarding module boundaries, data decoupling, and integration module-testing. You should not miss this talk if you are a software architect or tech lead seeking practical, scalable solutions. About the author With two decades of experience, Victor is a Java Champion working as a trainer for top companies in Europe. Five thousands developers in 120 companies attended his workshops, so he gets to debate every week the challenges that various projects struggle with. In return, Victor summarizes key points from these workshops in conference talks and online meetups for the European Software Crafters, the world’s largest developer community around architecture, refactoring, and testing. Discover how Victor can help you on victorrentea.ro : company training catalog, consultancy and YouTube playlists.

Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024

Victor Rentea

Whatsapp Number Escorts Call girls 8617370543 Available 24x7 Mcleodganj Call Girls Service Offer Genuine VIP Model Escorts Call Girls in Your Budget. Mcleodganj Call Girls Service Provide Real Call Girls Number. Make Your Sexual Pleasure Memorable with Our Mcleodganj Call Girls at Affordable Price. Top VIP Escorts Call Girls, High Profile Independent Escorts Call Girls, Housewife Women Escorts Call Girl, College Girls Escorts Call Girls, Russian Escorts Call girls Service in Your Budget.

Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Deepika Singh

[BuildWithAI] Introduction to Gemini.pdf

Sandro Moreira

Architecting Cloud Native Applications

WSO2

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the deployment of external web forms using Jotform for Bonterra Impact Management. This solution can be customized to your organization’s needs and deployed to support the common use cases below: - Intake and consent - Assessments - Surveys - Applications - Program registration Interested in deploying web form automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Jeffrey Haguewood

Elevate Developer Efficiency & build GenAI Application with Amazon Q

Bhuvaneswari Subramani

Persistent BIOS Infection

1. “ The early bird catches the worm ” CORE SECURITY TECHNOLOGIES © 200 9 Anibal L. Sacco (Ssr Exploit writer) Alfredo A. Ortega (Ssr Exploit writer) Persistent BIOS Infection

3. A bit of history

4. A better choice

5. What is the BIOS

6. BIOS Structure

7. How it works

8. Update/flashing process

9. A Simple way to patch BIOS

10. Where to patch

11. What can be done

12. Shellcodes

13. Virtual machine demo

14. Real hardware demo

15.

16. Rootkit(ish) behavior

17. OS independant

18.

19. Kernel mode backdoor How can this be done more effectively?

20.

21. Stealth behavior

22. Generally forgotten by almost all Antiviruses

23. OS Independant (Runs outside the OS context)‏

24.

25. Boot firmware

26. Hardware initialization (RAM, North Bridge, etc.)

27. Size: 256 Kb and bigger

28. C ommonly stored on EEPROM or flash memory

29.

30. Each module has an 8 bit checksum

31.

32.

33. +------------------------------------------------------------------------------+ | Class.Instance (Name) Packed ---> Expanded Compression Offset | +------------------------------------------------------------------------------+ B.03 ( BIOSCODE) 06DAF (28079) => 093F0 ( 37872) LZINT ( 74%) 446DFh B.02 ( BIOSCODE) 05B87 (23431) => 087A4 ( 34724) LZINT ( 67%) 4B4A9h B.01 ( BIOSCODE) 05A36 (23094) => 080E0 ( 32992) LZINT ( 69%) 5104Bh C.00 ( UPDATE) 03010 (12304) => 03010 ( 12304) NONE (100%) 5CFDFh X.01 ( ROMEXEC) 01110 (04368) => 01110 ( 4368) NONE (100%) 6000Ah T.00 ( TEMPLATE) 02476 (09334) => 055E0 ( 21984) LZINT ( 42%) 63D78h S.00 ( STRINGS) 020AC (08364) => 047EA ( 18410) LZINT ( 45%) 66209h E.00 ( SETUP) 03AE6 (15078) => 09058 ( 36952) LZINT ( 40%) 682D0h M.00 ( MISER) 03095 (12437) => 046D0 ( 18128) LZINT ( 68%) 6BDD1h L.01 ( LOGO) 01A23 (06691) => 246B2 (149170) LZINT ( 4%) 6EE81h L.00 ( LOGO) 00500 (01280) => 03752 ( 14162) LZINT ( 9%) 708BFh X.00 ( ROMEXEC) 06A6C (27244) => 06A6C ( 27244) NONE (100%) 70DDAh B.00 ( BIOSCODE) 001DD (00477) => 0D740 ( 55104) LZINT ( 0%) 77862h *.00 ( TCPA_*) 00004 (00004) => 00004 ( 004) NONE (100%) 77A5Ah D.00 ( DISPLAY) 00AF1 (02801) => 00FE0 ( 4064) LZINT ( 68%) 77A79h G.00 ( DECOMPCODE) 006D6 (01750) => 006D6 ( 1750) NONE (100%) 78585h A.01 ( ACPI) 0005B (00091) => 00074 ( 116) LZINT ( 78%) 78C76h A.00 ( ACPI) 012FE (04862) => 0437C ( 17276) LZINT ( 28%) 78CECh B.00 ( BIOSCODE) 00BD0 (03024) => 00BD0 ( 3024) NONE (100%) 7D6AAh

34.

35. The Bootblock POST (Power On Self Test) initialization routine is executed.

36. Decompression routine is called and every module is executed.

37. Initializes PCI ROMs.

38. Loads bootloader from hard-disk and executes it.

39. BIOS Memory Map

40.

41. Vendors provide perodic updates to add new features and fix bugs. They also provides it's own tools to flash from DOS, windows, and even from ActiveX!

42. BIOS update procedure depends on South-Bridge and chip used.

43. CoreBOOT project provides a generic BIOS flashing tool: flashrom, that supports most motherboard/chip combination.

44.

45. Any modification leads to an unbootable system.

46.

47.

48. 2) Patch and compensate

49. 3) Re-flash

50.

51. INT 0x19: Exected before booting

52.

53. Located easily by pattern matching Almost never change Called multiple times during boot

54.

55. Memory Manager (PMM)‏

56. network access (PXE, Julien Vanegue technique)‏

57.

58. 2) Code injection on windows binaries

59.

60. We use BIOS services for everything

61. Easy to debug: BIOS execution enviroment can be emulated running the code as a COM file over DOS

62.

63. 3) Runs

64. Hook schema

65.

66.

67.

68. Extensively used BIOS

69. Using the VGA ROM signature as ready-signal.

70. No debug allowed here, all was done by Reverse-Engineering and later, Int 10h (Not even printf!)

71. Injector tool is a 100-line python script!

72.

73. PCI device placement (Modems, VGA, Ethernet and RAID controllers)‏

74. The ultimate BIOS rootkit...

75. Thank you for your attention!

Persistent BIOS Infection

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (17)

Semelhante a Persistent BIOS Infection

Semelhante a Persistent BIOS Infection (20)

Último

Último (20)

Persistent BIOS Infection