Hacking Team Uses UEFI BIOS Rootkit

The dissection of the data from the Hacking Team leak has yielded another critical discovery: Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets' systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running. They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops). However, the code can very likely work on AMI BIOS as well. A Hacking Team slideshow presentation claims that successful infection requires physical access to the target system; however, we can't rule out the possibility of remote installation. An example attack scenario would be: The intruder gets access to the target computer, reboots into UEFI shell, dumps the BIOS, installs the BIOS rootkit, reflashes the BIOS, and then reboots the target system. We've found that Hacking Team developed a help tool for the users of their BIOS rootkit, and even provided support for when the BIOS image is incompatible:

Figure 1. Technical support provided by Hacking Team

In installation, three modules are first copied from an external source (this might be from a USB key with UEFI shell) to a file volume (FV) in the modified UEFI BIOS. Ntfs.mod allows UEFI BIOS to read/write NTFS file. Rkloader.mod then hooks the UEFI event and calls the dropper function when the system boots. The file dropper.mod contains the actual agents, which have the file name scout.exe and soldier.exe.

Figure 2. Files copied when the UEFI BIOS rootkit is installed

This means that when the BIOS rootkit is installed, the existence of the agents are checked each time the system is rebooted. If they do not exist, the agent scout.exe is installed in the following path: \Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6To_60S7K_FU06yjEhjh5dpFw96549UU.

Figure 3. The RCS agents installed in the target systems>

Although the dropper checks the existence of soldier.exe, it does not install the file for some unknown reason.

Figure 4. Scoute.exe (the agent's name in debug mode) is deployed to every user in \Users\[username]\Appdata

Figure 5. Deployment of scoute.exe

This finding is only the most recent among the numerous discoveries triggered by the Hacking Team leak. So far, three Adobe Flash zero-day vulnerabilities have been discovered from their files, although this particular finding gives more context on their activities. While we are not certain of who have been affected, the fact that the group dubs the tool "The Hacking Suite for Governmental Interception" which clarifies for whom the tool is intended. To prevent being affected by this, we recommend users to:

Make sure UEFI SecureFlash is enabled
Update the BIOS whenever there is a security patch
Set up a BIOS or UEFI password

Admins managing servers can also opt to buy a server with physical BIOS write-protection, wherein the user will need to put a jumper or turn on a dip switch in order to update the BIOS. Timeline of posts related to the Hacking Team

DATE	UPDATE
July 5	The Italian company Hacking Team was hacked, with more than 400GB of confidential company data made available to the public.
July 7	Three exploits – two for Flash Player and one for the Windows kernel—were initially found in the information dump. One of these [CVE-2015-5119] was a Flash zero-day. The Windows kernel vulnerability (CVE-2015-2387) existed in the open type font manager module (ATMFD.dll) and can be exploited to bypass the sandbox mitigation mechanism. The Flash zero-day exploit (CVE-2015-5119) was added into the Angler Exploit Kit and Nuclear Exploit Pack. It was also used in limited attacks in Korea and Japan.
July 11	Two new Flash zero-day vulnerabilities, CVE-2015-5122 and CVE-2015-5123, were found in the hacking team dump.
July 13	Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems.
July 14	A new zero-day vulnerability (CVE-2015-2425) was found in Internet Explorer.
July 16	On the mobile front, a fake news app designed to bypass Google Play was discovered.
July 20	A new zero-day vulnerability (CVE-2015-2426) was found in Windows, which Microsoft fixed in an out-of-band patch.
July 21	Analysis of the RCSAndroid spying tool revealed that Hacking Team can listen to calls and roots devices to get in.
July 28	A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team.