Windows 8 isn’t officially out yet and security researchers are already finding holes. One vulnerability can allow an attacker to infect the operating system with rootkit-style malware.
Following an analysis of the Unified Extensible Firmware Interface (UEFI), a successor to the legacy BIOS firmware interface, that Microsoft began fully supporting with 64-bit versions of Windows 7, Italian security consultants ITSEC discovered the security hole.
ITSEC found the UEFI platform now that Microsoft ported old BIOS and MBR’s boot loader to the new UEFI technology in Windows 8. Andrea Allievi, a senior security researcher at ITSEC, was able to use the research to create the first ever UEFI bootkit designed to hit Windows 8. The proof-of-concept malware is able to defeat Windows 8’s Kernel Patch Protection and Driver Signature Enforcement policy.
The UEFI boot loader developed by Allievi overwrites the legitimate Windows 8 UEFI bootloader, bypassing security defenses in the process.
“Our bootloader hooked the UEFI disk I/O routines and it intercepted the loading of the Windows 8 kernel, thus our bootkit tampered the kernel by disabling the security features used by Windows to prevent the loading of unsigned drivers,” said Marco Giuliani, a director of ITSEC.
The bootkit developed by ITSEC is comparable to forms of older MBR (Master Boot Record) rootkits that overwrite system files of older version of Windows. Bootkits capable of taking over Windows 8 machines have been around since last November but these earlier proof-of-concept attacks didn’t circumvent UEFI, unlike the latest research.
Previously boot loaders and rootkits had to come together in assembly language. But UEFI creates a means to develop system loaders much more straightforwardly using the easier C programming language, making thing easier for both legitimate developers and VXers.
“Our research attempts to show the industry that the new UEFI platform is still as insecure as the old BIOS technology, it’s still vulnerable to the old attacks if the SecureBoot technology is not turned on by default,” Giuliani said. “Writing a bootkit couldn’t be an easier task for virus writers with the UEFI framework available, much easier than before when they needed to code in pure assembly.
Giuliani also said, although it’s desirable from a security perspective, enabling SecureBoot by default effectively limits user choice.