Downgrades and Attacking Security Things & Things Not to Miss at BH/DC – Trent Lo – PSW #838

"The Israeli researcher said he found a way to manipulate an action list XML file to push a ‘Windows Downdate’ tool that bypasses all verification steps, including integrity verification and Trusted Installer enforcement. In an interview with SecurityWeek ahead of the presentation, Leviev said the tool is capable of downgrading essential OS components that cause the operating system to falsely report that it is fully updated." - So it appears you can fool a Windows system into believing, and reporting, that it is fully patched, when, in fact, critical patches have been removed leaving it vulnerable to known vulnerabilities. I can't wait to see and hear more details.

"According to news reports, the mass wiping came as a shock to multiple students in Singapore, where the Mobile Guardian app has been the country’s official mobile device management provider for public schools since 2020. Singapore’s Ministry of Education said Monday that roughly 13,000 students from 26 secondary schools had their devices wiped remotely in the incident." - Yet another security tool being used to cause a disruption. What do we do when our security tools are used against us? Is this a new trend? I mean, from an attacker's point of view, why not?

I created cheat sheets for Windows, Linux, and Android on how to validate the supply chain of your firmware(s), with many more commands and tools:

• https://eclypsium.com/blog/linux-supply-chain-validation-cheat-sheet/
• https://eclypsium.com/blog/android-supply-chain-validation-cheat-sheet/
• https://eclypsium.com/blog/android-supply-chain-validation-cheat-sheet/

• "A bootloader is typically the first piece of software that runs on a device when it is powered on." - If you are labeling all of the software/firmware that runs before the bootloader as "firmware", then technically this would be correct. There are several pieces of software/firmware that run before the bootloader.
• "Attackers may target bootloaders to alter the operating system files and gain privileged access, which allows for complete control over the operating system, allowing for modification of system files, disabling security features, and more. Because the bootloader is responsible for loading the kernel and setting up the system environment, it is a juicy target for attackers. By compromising the bootloader an attacker can bypass several security checks designed to protect the integrity of the OS." - This is a great reminder that we focus heavily on OS security, but tend to forget to monitor the bootloader, which can be used to bypass OS protections. Typically on PCs and servers the bootloader is stored in the EFI partition, making it accessible, but also easier to restore than platform firmware.
• The article seems to reference bootloaders on devices such as smartphones and similar devices, where they play a larger role in the enforcement of a root of trust and validating software components during boot. Android hackers are familiar with this as you have to unlock your bootloader (meaning disabling the secure boot process) to install a custom operating system.

"Ultimately, certificate or signature metadata is an important piece of the puzzle to consider when analyzing a potential threat. Sometimes the information contained within a certificate is sufficient to verify whether a binary is benign or legitimate." - I really love this strategy and believe it's something not many organizations have a handle on. We tend to update and patch software, including updates to certificates and roots of trust when available, but do a poor job of looking at, and validating, the signatures and certificates that bless the software and firmware on our systems. We should get better at this because attackers are abusing the trust we are trying to create.

This is interesting, and somewhat similar to the Sitting Ducks DNS attacks: "Hosting providers who have published SPF records, and, in some cases, also add DKIM signatures, do not sufficiently verify the trust relationship of authenticated user against the allowed domains. This allows an authenticated attacker to spoof an identity in the email Message Header to send emails as anyone in the hosted domains of the hosting provider, while authenticated as a user of a different domain name."

"Ivanti is the gift that keeps on giving to cyber-attackers, taking three of the top ten spots in Qualys’ list of most exploited vulnerabilities." - So, like Rhianna, these vulnerabilities are still popular even though they have been released for some time. Musical tastes aside, I am struggling to understand the difference between weaponized and exploited in the wild based on this snippet:

• "in the first half of the year, the “annual count of reported Common Vulnerabilities and Exposures (CVEs) rose by about 30%, from 17,114 in 2023 to 22,254 in 2024.” Of these, just 0.91% were “weaponised”. Of the 204 weaponised CVEs, only a quarter (54) made it onto CISA’s KEV list, while just six were exploited by ransomware."

The short answer is yes, you should update your BIOS (UEFI in an overwhelming majority of cases). Updating your BIOS often provides crucial security updates, including (but not in all cases) updates to Secure Boot revocation lists and/or certificate updates (to address things such as PK fail), CPU microcode updates (Spectre/Meltdown), and general UEFI security updates. As with any software or firmware, there are risks to applying updates. The risk of your computer not booting is higher for UEFI updates than for many other types of software/firmware updates. Depending on your platform, there are ways to recover as some servers have multiple SPI flash chips and create backups. Many of the computer builds I've done also have a hardware reset which reverts all BIOS settings back to the default (which I've had to do more than once). BIOS updates can also fix bugs, for example, I recently updated the BIOS on my workstation and it fixed some USB bus errors that were driving me nuts when it came to audio devices. While I was quick to blame Linux (and who wouldn't when it comes to Linux and audio), it turns out the problem lay in the BIOS. So, my advice, apply BIOS updates, and don't blame me if your computer gets bricked :).

Can we call this a trend now? - "The discovery of SbaProxy underscores a troubling trend in the cyber threat landscape: sophisticated adversaries' weaponization of trusted security tools. By hijacking legitimate anti-virus software, these threat actors have found a way to operate under the radar, making traditional detection methods less effective. The use of valid certificates and the careful crafting of malicious binaries that closely resemble their legitimate counterparts highlight the growing complexity of these threats."

Most notably: "Add Meteor Lake SPI Support" - If you have a newer PC you can now get an SPI flash dump. Cool!

Hey, I know that guy! - "The report reveals a troubling trend of outdated software components in OT/IoT routers, with many devices running modified versions of OpenWrt that include known vulnerabilities,” said Larry Pesce, Director of Product Research and Development at Finite State. “These findings highlight the critical importance of addressing software supply chain risks, as our analysis identified an average of 161 known vulnerabilities per firmware image, including 24 with critical scores." - Also, even though vendors are using OpenWrt which has regular updates and addresses vulnerabilities quickly, the devices still are not being updated. So, even with great tools, vendors still hold back on updates, largely (in my opinion) due to dependencies that are not easily upgraded and/or customizations that make it hard to take an upstream update. Look what I can do! I can customize OpenWrt for our hardware! Great, now you are responsible for updates. Updates? You guys have updates?

It's so nice to see others saying things that I've been saying for some time now, such as:

• "Attackers have long developed malware implants that infect computer BIOS or UEFI, providing them with low-level persistence and stealth and the ability to reinfect a computer even if the OS is reinstalled or the hard drive is replaced. Because of this, modern UEFI comes with cryptographic code validation features such as Secure Boot and Intel Boot Guard, but vulnerabilities are still found that allow attackers to bypass these mechanisms."
• "It’s safe to say that there’s no shortage of UEFI vulnerabilities, and even if some of them can be specific to one vendor or IBV, the problem is that PC manufacturers do not release UEFI updates for motherboards that reach the end of life. Furthermore, users are not in the habit of manually installing UEFI updates and these updates are not performed automatically through mechanisms such as Windows Update. This means a very large number of PCs are likely to have known UEFI vulnerabilities at any time."

While it's not the most common attack vector for malware today, UEFI is a ripe attack surface that allows attackers to hide, maintain persistence, and, importantly, bypass OS security protections. This will be a more common tactic in malware for years to come, especially given that largely we do not have visibility into UEFI (I mean we could, but we don't implement the correct detections) and updates are super difficult to 1) even get a fix from a vendor due to the supply chain(s) 2) fixes not being issued for end of life gear and 3) many organizations do not prioritize firmware updates.

udm14 = Google - AI