Toward the end of last year, a Chinese company detected the first rootkit ever that targeted computers’ BIOS in order to be able to reinfect computers over and over again, even after replacing the hard drive.
This BIOS rootkit, called Mebromi (or MyBios), targeted only the users who had Award BIOS on their computers.
Still, as it came bundled with a MBR toolkit, a kernel mode rootkit, a PE file infector and a Trojan downloader, users who didn’t use those motherboards and that BIOS still fell victim to an infection.
Now, McAfee found a second BIOS rootkit – dubbed Niwa!mem. Initially a rootkit that infected the Master Boot Record (MBR), its latest variant became a “BIOSkit”.
“The malware overwrites the original MBR in sector 0 and writes the file to be dropped (the downloader) in hidden sectors. The DLL copies itself to the Recycle folder and deletes itself. The downloader is dropped and executed every time the system is started,” researchers said.
“All the components dropped will be present in the DLL, including the utility cbrom.exe from the BIOS manufacturer, which the malware uses to flash the BIOS.”
Award BIOS is still the target, and while there are some changes in the code of the malware, quite a few strings are practically identical, making the researchers speculate the same group developed Mebromi and Niwa!mem.
“We have now seen two BIOSkit malware in the wild within a couple of months. When the first Bioskit was identified, we did not know how soon we would see another. Now it appears we should expect to see more in near future,” said the researchers, who added cleaning BIOS infections will be a challenge for security vendors.