Tweet

The dissection of the data from the Hacking Team leak has yielded another critical discovery: Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running.

They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops).  However, the code can very likely work on AMI BIOS as well.

A Hacking Team slideshow presentation claims that successful infection requires physical access to the target system; however, we can’t rule out the possibility of remote installation. An example attack scenario would be: The intruder gets access to the target computer, reboots into UEFI shell, dumps the BIOS, installs the BIOS rootkit, reflashes the BIOS, and then reboots the target system.

We’ve found that Hacking Team developed a help tool for the users of their BIOS rootkit, and even provided support for when the BIOS image is incompatible:

Figure 1. Technical support provided by Hacking Team

In installation, three modules are first copied from an external source (this might be from a USB key with UEFI shell) to a file volume (FV) in the modified UEFI BIOS. Ntfs.mod allows UEFI BIOS to read/write NTFS file. Rkloader.mod then hooks the UEFI event and calls the dropper function when the system boots. The file dropper.mod contains the actual agents, which have the file name scout.exe and soldier.exe.

Figure 2. Files copied when the UEFI BIOS rootkit is installed

This means that when the BIOS rootkit is installed, the existence of the agents are checked each time the system is rebooted. If they do not exist, the agent scout.exe is installed in the following path: \Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6To_60S7K_FU06yjEhjh5dpFw96549UU. 

Figure 3. The RCS agents installed in the target systems>

Although the dropper checks the existence of soldier.exe, it does not install the file for some unknown reason.

Figure 4. Scoute.exe (the agent’s name in debug mode) is deployed to every user in \Users\[username]\Appdata

Figure 5. Deployment of scoute.exe

This finding is only the most recent among the numerous discoveries triggered by the Hacking Team leak. So far, three Adobe Flash zero-day vulnerabilities have been discovered from their files, although this particular finding gives more context on their activities. While we are not certain of who have been affected, the fact that the group dubs the tool “The Hacking Suite for Governmental Interception” which clarifies for whom the tool is intended.

To prevent being affected by this, we recommend users to:

• Make sure UEFI SecureFlash is enabled
• Update the BIOS whenever there is a security patch
• Set up a BIOS or UEFI password

Admins managing servers can also opt to buy a server with physical BIOS write-protection, wherein the user will need to put a jumper or turn on a dip switch in order to update the BIOS.

Timeline of posts related to the Hacking Team