Re: [linux_var] Rootkit per UEFI

To: linux_var - LUG di Varese e Provincia Mailing List <talking@ml.linuxvar.it>

Subject: Re: [linux_var] Rootkit per UEFI

From: Giovanni Orlandi <orlangio@gmail.com>

Date: Thu, 16 Jul 2015 10:22:22 +0200

Authentication-results: linuxvar.it; dkim=pass reason="2048-bit key; unprotected key" header.d=gmail.com header.i=@gmail.com header.b=YVJoO63S; dkim-adsp=pass; dkim-atps=neutral

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ml.linuxvar.it; s=mail; t=1437034962; bh=nt5lZGSZtFQwbzsEPsBJx9ffdErPO6kugfTjzTvGBaQ=; h=In-Reply-To:References:Date:From:To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: Reply-To; z=In-Reply-To:=20<CAPsbc0+kvHXVNtf1wgm-Lv+xsAbrb3WOUkr=3D6=3D-zz7Y5 SnLJNQ@mail.gmail.com>|References:=20<CAPsbc0+kvHXVNtf1wgm-Lv+xsAb rb3WOUkr=3D6=3D-zz7Y5SnLJNQ@mail.gmail.com>|Date:=20Thu,=2016=20Ju l=202015=2010:22:22=20+0200|From:=20Giovanni=20Orlandi=20<orlangio @gmail.com>|To:=20linux_var=20-=20LUG=20di=20Varese=20e=20Provinci a=20Mailing=20List=20<talking@ml.linuxvar.it>|Subject:=20Re:=20[li nux_var]=20Rootkit=20per=20UEFI|List-Id:=20linux_var=20-=20LUG=20d i=20Varese=20e=20Provincia=20Mailing=20List=0D=0A=20<talking.ml.li nuxvar.it>|List-Unsubscribe:=20<http://ml.linuxvar.it/cgi-bin/mail man/options/talking>,=0D=0A=20<mailto:talking-request@ml.linuxvar. it?subject=3Dunsubscribe>|List-Archive:=20<http://ml.linuxvar.it/p ipermail/talking/>|List-Post:=20<mailto:talking@ml.linuxvar.it>|Li st-Help:=20<mailto:talking-request@ml.linuxvar.it?subject=3Dhelp>| List-Subscribe:=20<http://ml.linuxvar.it/cgi-bin/mailman/listinfo/ talking>,=0D=0A=20<mailto:talking-request@ml.linuxvar.it?subject=3 Dsubscribe>|Reply-To:=20linux_var=20-=20LUG=20di=20Varese=20e=20Pr ovincia=20Mailing=20List=0D=0A=20<talking@ml.linuxvar.it>; b=aMt7JLQ0pyx+zG/NikYZ/7h9l4VhSQu2FAdRDbOnEJWwsV7q8KSTjKILBchdFgkx8 CSpuJ58xQjizfH/DIF0B6a0E1/Y1f3GBsb3n/r3zLKNl+aIe/JBm86nP0Hef0ZoUYa eAQFj82KKnepWlz2MWQr5jiPKQS+VWzCFKuZmy88=

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=+y+qTec7PfC36f7/izoUd/sTxZ225i/FEmvbZ3EdjOg=; b=YVJoO63SJS1/rxGw7/CZwsiUSyZ9jBzJf2Rb9RQqxRa/zeoL2BsOeeFsGO3weNllrT EU2q4PGpjLUGTT6mV45mpJSgTfCQqppXwwpEULNi80PMrAtjohge4VxKfYHcKfgRoT33 X1U65e7nHoG3yLsVsH1RK3w2n4KwmC9ieY4WSjMyXF2QGSdvNM97AV+O720RNdedG0MQ kQKqAm8tBMJU0+lH1GYjKBNE1OnEXFfsxUWi7CsSJ630j7zGhlPZ77/gOBvpVeNikMjx 1fn3zu8/aqYoYhoP1nedCoO3/EuncPYbOIr/PLtLN72DRn/7HYN6RinT/qsPx6bxRnV3 7/fg==

In-reply-to: <CAPsbc0+kvHXVNtf1wgm-Lv+xsAbrb3WOUkr=6=-zz7Y5SnLJNQ@mail.gmail.com>

List-archive: <http://ml.linuxvar.it/pipermail/talking/>

List-help: <mailto:talking-request@ml.linuxvar.it?subject=help>

List-id: linux_var - LUG di Varese e Provincia Mailing List <talking.ml.linuxvar.it>

List-post: <mailto:talking@ml.linuxvar.it>

List-subscribe: <http://ml.linuxvar.it/cgi-bin/mailman/listinfo/talking>, <mailto:talking-request@ml.linuxvar.it?subject=subscribe>

List-unsubscribe: <http://ml.linuxvar.it/cgi-bin/mailman/options/talking>, <mailto:talking-request@ml.linuxvar.it?subject=unsubscribe>

References: <CAPsbc0+kvHXVNtf1wgm-Lv+xsAbrb3WOUkr=6=-zz7Y5SnLJNQ@mail.gmail.com>

Reply-to: linux_var - LUG di Varese e Provincia Mailing List <talking@ml.linuxvar.it>

Sender: "Talking" <talking-bounces@ml.linuxvar.it>

Chi sa se è compatibile con i root kit di Nsa etc...

Il 16/lug/2015 10:11, "Lorenzo Lobba" <lorenzo.lobba@gmail.com> ha scritto:

Immagino che tutti abbiate sentito parlare di Hacking(ed) Team.
(HT)
Ci sono siti e blog che si stanno occupando di questo caso.

Mi sembra curioso e degno di nota il rootkit per l'EUFI.
Sì, proprio quel software che dovrebbe proteggere il PC....
A quanto pare, una volta installato il rootkit, la vittima anche se formatta l'hd o lo sostituisce con uno nuovo quando reinstallerà Windows si ritroverà ancora il software curiosone di HT vivo e vegeto.

http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-uses-uefi-bios-rootkit-to-keep-rcs-9-agent-in-target-systems/

Ciao,
Lorenzo

_______________________________________________
Talking mailing list
Talking@ml.linuxvar.it
http://ml.linuxvar.it/cgi-bin/mailman/listinfo/talking

_______________________________________________ Talking mailing list Talking@ml.linuxvar.it http://ml.linuxvar.it/cgi-bin/mailman/listinfo/talking

Follow-Ups:

Re: [linux_var] Rootkit per UEFI
- From: Marco Bevacqua <marcobev@gmail.com>

References:

[linux_var] Rootkit per UEFI
- From: Lorenzo Lobba <lorenzo.lobba@gmail.com>