David Baxter PhD
Late Founder
Researchers Find BIOS Rootkit Pre-Loaded in Laptops
By Ryan Naraine
July 30, 2009
LAS VEGAS -- A popular laptop theft-recovery service that ships on notebooks made by HP, Dell, Lenovo, Toshiba, Gateway, Asus and Panasonic is actually a dangerous BIOS rootkit that can be hijacked and controlled by malicious hackers.
The service -- called Computrace LoJack for Laptops -- contains design vulnerabilities and a lack of strong authentication that can lead to "a complete and persistent compromise of an affected system," according to Black Hat conference presentation by researchers Alfredo Ortega and Anibal Sacco from Core Security Technologies.
Computrace LoJack for Laptops, which is is pre-installed on about 60 percent of all new laptops, is a software agent that lives in the BIOS and periodically calls home to a central authority for instructions in case a laptop is stolen. The call-home mechanism allows the central authority to instruct the BIOS agent to wipe all information as a security measure, or to track the whereabouts of the system.
For it to be an effective theft-recovery service, Ortega and Sacco explained that it has to be stealthy, must have complete control of the system and must be highly-persistent to survive a hard disk wipe or operating system reinstall.
"This is a rootkit. It might be legitimate rootkit, but it's a dangerous rootkit," Sacco declared. The research team stumbled upon the rootkit-like technology in the course of their work on BIOS-based malware attacks. At last year's CanSecWest security conference, the duo demonstrate methods for infecting the BIOS with persistent code that survive reboots and reflashing attempts.
The biggest problem, Ortega explained, is that a malicious hacker can manipulate and control the call-home process. That's because the technology uses a configuration method that contains the IP address, port and URL, all hard-coded in the Option-ROM. At first run, Sacco explained that the configuration method is copied in many places, including the registry and hard-disk inter-partition space.
The duo found that it's trivial to search and modify the configuration, giving them the ability to point the the IP and URL to a malicious site, where un-authenticated payloads can be directed to laptop.
Because the rootkit is white-listed by anti-virus software, the malicious modifications will go unnoticed. On unsigned BIOSes, Sacco and Ortega aid modi cation of the con guration allows for a very persistent and dangerous form of rootkit.
The pair recommended a digital signature scheme to authenticate the call-home process.
With the help of the U.S. Computer Emergency Response Team (US-CERT) and one major laptop manufacturer, Core Security has reported the problems to Absolute Corp., the company that makes the Computrace software.
By Ryan Naraine
July 30, 2009
LAS VEGAS -- A popular laptop theft-recovery service that ships on notebooks made by HP, Dell, Lenovo, Toshiba, Gateway, Asus and Panasonic is actually a dangerous BIOS rootkit that can be hijacked and controlled by malicious hackers.
The service -- called Computrace LoJack for Laptops -- contains design vulnerabilities and a lack of strong authentication that can lead to "a complete and persistent compromise of an affected system," according to Black Hat conference presentation by researchers Alfredo Ortega and Anibal Sacco from Core Security Technologies.
Computrace LoJack for Laptops, which is is pre-installed on about 60 percent of all new laptops, is a software agent that lives in the BIOS and periodically calls home to a central authority for instructions in case a laptop is stolen. The call-home mechanism allows the central authority to instruct the BIOS agent to wipe all information as a security measure, or to track the whereabouts of the system.
For it to be an effective theft-recovery service, Ortega and Sacco explained that it has to be stealthy, must have complete control of the system and must be highly-persistent to survive a hard disk wipe or operating system reinstall.
"This is a rootkit. It might be legitimate rootkit, but it's a dangerous rootkit," Sacco declared. The research team stumbled upon the rootkit-like technology in the course of their work on BIOS-based malware attacks. At last year's CanSecWest security conference, the duo demonstrate methods for infecting the BIOS with persistent code that survive reboots and reflashing attempts.
The biggest problem, Ortega explained, is that a malicious hacker can manipulate and control the call-home process. That's because the technology uses a configuration method that contains the IP address, port and URL, all hard-coded in the Option-ROM. At first run, Sacco explained that the configuration method is copied in many places, including the registry and hard-disk inter-partition space.
The duo found that it's trivial to search and modify the configuration, giving them the ability to point the the IP and URL to a malicious site, where un-authenticated payloads can be directed to laptop.
Because the rootkit is white-listed by anti-virus software, the malicious modifications will go unnoticed. On unsigned BIOSes, Sacco and Ortega aid modi cation of the con guration allows for a very persistent and dangerous form of rootkit.
The pair recommended a digital signature scheme to authenticate the call-home process.
With the help of the U.S. Computer Emergency Response Team (US-CERT) and one major laptop manufacturer, Core Security has reported the problems to Absolute Corp., the company that makes the Computrace software.
