Lenovo - if it's on your network, you ARE breached.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Junkware on the other hand - sure. Lenovo's own crapware to help them deploy their own drivers, etc. This was after the SF issue, so again, it's not known if actual malware was distributed this way.
That's malware. Plain and simple. When deployed via a rootkit. And more importantly, there was a rootkit!!
Is it a windows rootkit? Or is it using built in tech by MS and BIOS/UEFI makers as a deployment method?
It's MS encouraged UEFI rootkit. The rootkit was in firmware. It was only activated against Windows before getting caught. Linux would have been rooted the same though.
-
It's important to understand that Lenovo tried this rootkit deployment while under extreme scrutanty after being caught with superfish and is believed to have still been in a proof of concept phase of the attack without the real payloads having had a chance to be deployed yet.
It's like catching the crooks having broken into your house before they started carrying stuff out and you have to guess whether they were just stealing some food or everything that you owned. But they had already broken in, twice.
-
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Junkware on the other hand - sure. Lenovo's own crapware to help them deploy their own drivers, etc. This was after the SF issue, so again, it's not known if actual malware was distributed this way.
That's malware. Plain and simple. When deployed via a rootkit. And more importantly, there was a rootkit!!
Is it a windows rootkit? Or is it using built in tech by MS and BIOS/UEFI makers as a deployment method?
It's MS encouraged UEFI rootkit. The rootkit was in firmware. It was only activated against Windows before getting caught. Linux would have been rooted the same though.
Should it have? MS specifically has hooks for working with these BIOS/UEFI hooks, do any Linux distorts do this?
Unless you're saying it was taking advantage of a security flaw in Windows and Linux that isn't/can't be patched?
-
Let's break the topic of SMM out on its own and I'll participate as I'm able.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Junkware on the other hand - sure. Lenovo's own crapware to help them deploy their own drivers, etc. This was after the SF issue, so again, it's not known if actual malware was distributed this way.
That's malware. Plain and simple. When deployed via a rootkit. And more importantly, there was a rootkit!!
Is it a windows rootkit? Or is it using built in tech by MS and BIOS/UEFI makers as a deployment method?
It's MS encouraged UEFI rootkit. The rootkit was in firmware. It was only activated against Windows before getting caught. Linux would have been rooted the same though.
Should it have? MS specifically has hooks for working with these BIOS/UEFI hooks, do any Linux distorts do this?
Unless you're saying it was taking advantage of a security flaw in Windows and Linux that isn't/can't be patched?
AFAIK this particular exploit, being on the firmware, could make changes to any OS sitting on top of it, similar to getting a rootkit on your hypervisor would do. Windows hooks would help make that easier, but I don't believe that it is required to make it possible.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Let's break the topic of SMM out on its own and I'll participate as I'm able.
Maybe make a new one.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Let's break the topic of SMM out on its own and I'll participate as I'm able.
This is why I felt we needed a thread dedicated to just how bad Lenovo actually is. While many threads preceded it, more will follow!
-
@travisdh1 said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Let's break the topic of SMM out on its own and I'll participate as I'm able.
This is why I felt we needed a thread dedicated to just how bad Lenovo actually is. While many threads preceded it, more will follow!
Right, and it needs to be collected because, as we've seen already, later breaches often cover up earlier ones.
-
Sure, but the SMM issue is really outside of Lenovo because all PC makers can use it.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Sure, but the SMM issue is really outside of Lenovo because all PC makers can use it.
Can use it and do use it are different issues, but both are important as well.
-
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Sure, but the SMM issue is really outside of Lenovo because all PC makers can use it.
Can use it and do use it are different issues, but both are important as well.
Many do use it to deploy Compu Trace as previously mentioned.
-
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Junkware on the other hand - sure. Lenovo's own crapware to help them deploy their own drivers, etc. This was after the SF issue, so again, it's not known if actual malware was distributed this way.
That's malware. Plain and simple. When deployed via a rootkit. And more importantly, there was a rootkit!!
Is it a windows rootkit? Or is it using built in tech by MS and BIOS/UEFI makers as a deployment method?
It's MS encouraged UEFI rootkit. The rootkit was in firmware. It was only activated against Windows before getting caught. Linux would have been rooted the same though.
Should it have? MS specifically has hooks for working with these BIOS/UEFI hooks, do any Linux distorts do this?
Unless you're saying it was taking advantage of a security flaw in Windows and Linux that isn't/can't be patched?
AFAIK this particular exploit, being on the firmware, could make changes to any OS sitting on top of it, similar to getting a rootkit on your hypervisor would do. Windows hooks would help make that easier, but I don't believe that it is required to make it possible.
That's just it though - this is NOT an exploit. This is a system design, a design specifically in the BIOS/UEFI.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Junkware on the other hand - sure. Lenovo's own crapware to help them deploy their own drivers, etc. This was after the SF issue, so again, it's not known if actual malware was distributed this way.
That's malware. Plain and simple. When deployed via a rootkit. And more importantly, there was a rootkit!!
Is it a windows rootkit? Or is it using built in tech by MS and BIOS/UEFI makers as a deployment method?
It's MS encouraged UEFI rootkit. The rootkit was in firmware. It was only activated against Windows before getting caught. Linux would have been rooted the same though.
Should it have? MS specifically has hooks for working with these BIOS/UEFI hooks, do any Linux distorts do this?
Unless you're saying it was taking advantage of a security flaw in Windows and Linux that isn't/can't be patched?
AFAIK this particular exploit, being on the firmware, could make changes to any OS sitting on top of it, similar to getting a rootkit on your hypervisor would do. Windows hooks would help make that easier, but I don't believe that it is required to make it possible.
That's just it though - this is NOT an exploit. This is a system design, a design specifically in the BIOS/UEFI.
Obviously that the system is designed that way has no bearing on it being an exploit.
-
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Sure, but the SMM issue is really outside of Lenovo because all PC makers can use it.
Can use it and do use it are different issues, but both are important as well.
Many do use it to deploy Compu Trace as previously mentioned.
Right, as an exploit as is very clear. All kinds of well intentioned software can be exploited by bad actors. In fact, at the base of it, all code is based on chips and languages that were intended for good but exploited for other purposes.
https://threatpost.com/millions-of-pcs-affected-by-mysterious-computrace-backdoor-2/107700/
-
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
@scottalanmiller said in Lenovo - if it's on your network, you ARE breached.:
@dashrender said in Lenovo - if it's on your network, you ARE breached.:
Sure, but the SMM issue is really outside of Lenovo because all PC makers can use it.
Can use it and do use it are different issues, but both are important as well.
Many do use it to deploy Compu Trace as previously mentioned.
Right, as an exploit as is very clear. All kinds of well intentioned software can be exploited by bad actors. In fact, at the base of it, all code is based on chips and languages that were intended for good but exploited for other purposes.
https://threatpost.com/millions-of-pcs-affected-by-mysterious-computrace-backdoor-2/107700/
Wow, I hadn't heard that before, thanks.
-
Finally got a blog post up on this.
-
@travisdh1 Great article and read.
-
THis will be shared with the teams tomorrow.
-
-
Posting so @Obsolesce will see this thread.
