Researchers find serious vulnerabilities in uefi

Miter researchers have found two vulnerabilities in uefi, the platform that has largely replaced the bios. An attacker with administrative rights can therefore, for example, flash his own firmware to the uefi chip on Windows 8.

The two vulnerabilities allow attackers to do absolutely anything they want, say researchers at Miter, a non-profit research institution. For example, a computer can be infected with a rootkit that remains even after reinstalling an operating system. For example, the researchers built malware that is permanently present in the system management mode of x86 processors and that cannot be detected by the user. In addition, Secure Boot can be disabled. Also, a computer could be permanently bricked.

The vulnerabilities are in Intel’s reference implementation for uefi chips, which has been adopted by many other companies. In any case, Uefi chips from Intel itself, as well as Phoenix, AMI and HP are affected. 1500 systems from HP would have been affected; updates will now be issued for those systems. Dell’s Uefi chips have vulnerable code, but an attack proves ineffective; the vulnerable code will be completely removed anyway just to be safe. It is unclear what about manufacturers such as Acer, Asus, Gigabyte and MSI.

The integer overflow vulnerabilities allow an attacker to inject their own code. In any case, the vulnerabilities can be exploited under Windows 8, which offers a special api for updating the uefi firmware. It is not yet clear whether other operating systems can also be used for an attack on the uefi firmware.

Under Windows 8, an attacker must have administrator rights to exploit the vulnerabilities, but another vulnerability could be exploited to do so. For example, a Windows vulnerability recently surfaced that allows attackers to inject their own code via Office objects; if a user is logged in as administrator, that code will run as administrator.

It is not yet clear whether the vulnerability has been exploited. The researchers advise users to update their bios as soon as possible. The researchers also believe that the source code of UEFI firmware should be able to be inspected.