Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
What Is It?
Researchers from ESET released a whitepaper to coincide with a presentation at this week’s Microsoft BlueHat Security Conference. The whitepaper details their discovery of the first Unified Extensible Firmware Interface (UEFI) rootkit to be found in the wild, which they have dubbed Lojax.
They have tied this rootkit to the APT group they call Sednit, though more commonly known as APT28, Sofacy or Fancy Bear. This group has been named as the perpetrator of the Democratic National Committee hack in 2016, among many other successful compromises. Researchers found that this rootkit has been very selectively deployed, mainly against government agencies in the Balkans and unnamed Central and Eastern European countries.
Previously known to exist as proof of concepts from security conferences and potentially in the possession of some nation states, UEFI rootkits are highly sophisticated. UEFI is basically a modern version of a PC’s BIOS. UEFI provides access to the firmware which acts as an interface between the physical hardware and the operating system. By being able to update the flash memory that holds the UEFI, the Lojax malware is not only much more difficult to detect, but is completely unaffected by reformatting or even replacing the hard drive. The only way to remove the malware from the system is to reflash the UEFI memory with a clean copy of the firmware.
ESET named this malware Lojax as it utilizes a trojanized version of the legitimate Lojack software to gain access to the UEFI memory. Lojack, as the name suggests, is designed to notify the owner of the location of the system it is installed on, in the event it is lost or stolen. ESET found the only functionality present in the Lojax samples they analyzed is to place malware onto the infected system when it is booted up and execute that malware when Windows starts.
There are mitigations for Lojax and other potential UEFI malware. Recent UEFI versions have an option called Secure Boot, which when enabled, requires all firmware to be signed before it is executed. With Secure Boot enabled, the unsigned Lojax firmware would not run. In addition, Lojax can only infect UEFI memory on versions with vulnerabilities, meaning those systems with current firmware installed or systems with the Intel Platform Controller Hub, first released in 2008 alongside the Intel Series 5 chipsets will not be affected.
How Does It Propagate?
The malware does not self-propagate. There is no information regarding the attack vector used to initially infect systems with Lojax malware.
When/How Did BluVector Detect It?
The whitepaper contains a list of 12 samples related to Lojax and BluVector’s patented Machine Learning Engine (MLE) detected them all. Regression testing has shown the samples would have been detected an average of 47 months prior to their release.