New BIOS rootkit spotted
Posted on 08.06.2012
Towards the end of 2011, a Chinese company detected the first rootkit ever that targeted computers' BIOS in order to be able to reinfect computers over and over again, even after the hard drive is physically removed and replaced.

This BIOS rootkit was dubbed Mebromi (or MyBios), and targeted only the users who had Award BIOS (used by motherboards developed by Phoenix Technologies) on their computers.

Still, as it came bundled with a MBR toolkit, a kernel mode rootkit, a PE file infector and a Trojan downloader, users who didn't have those motherboards and that BIOS were still not spared an infection.

Fast forward to the present, and a second BIOS rootkit - dubbed Niwa!mem - has been detected by McAfee. Initially a rootkit that infected the Master Boot Record (MBR), its latest variant became a "BIOSkit".

"The malware overwrites the original MBR in sector 0 and writes the file to be dropped (the downloader) in hidden sectors. The DLL copies itself to the Recycle folder and deletes itself. The downloader is dropped and executed every time the system is started," the researchers explain.

"All the components dropped will be present in the DLL, including the utility cbrom.exe from the BIOS manufacturer, which the malware uses to flash the BIOS."

Award BIOS is still the target, and while there are some changes in the code of the malware, many strings are practically identical, making the researchers speculate that the same group developed both Mebromi and Niwa!mem.

"We have now seen two BIOSkit malware in the wild within a couple of months. When the first Bioskit was identified, we did not know how soon we would see another. Now it appears we should expect to see more in near future," say the researchers and add that cleaning BIOS infections will be a challenge for security vendors.

As it was already pointed out by Webroot's Marco Giuliani, an antivirus solution that is able to clean the BIOS ROM needs to be totally error-proof in order to avoid rendering the system unbootable at all.

"The job of handling with such specific system codes should be left to the developers of the specific motherboard model, who release BIOS updates along with specific tool to update the BIOS code," he proposed.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th