New BIOS rootkit spotted
Towards the end of 2011, a Chinese company detected the first rootkit ever that targeted computers’ BIOS in order to be able to reinfect computers over and over again, even after the hard drive is physically removed and replaced.
This BIOS rootkit was dubbed Mebromi (or MyBios), and targeted only the users who had Award BIOS (used by motherboards developed by Phoenix Technologies) on their computers.
Still, as it came bundled with a MBR toolkit, a kernel mode rootkit, a PE file infector and a Trojan downloader, users who didn’t have those motherboards and that BIOS were still not spared an infection.
Fast forward to the present, and a second BIOS rootkit – dubbed Niwa!mem – has been detected by McAfee. Initially a rootkit that infected the Master Boot Record (MBR), its latest variant became a “BIOSkit”.
“The malware overwrites the original MBR in sector 0 and writes the file to be dropped (the downloader) in hidden sectors. The DLL copies itself to the Recycle folder and deletes itself. The downloader is dropped and executed every time the system is started,” the researchers explain.
“All the components dropped will be present in the DLL, including the utility cbrom.exe from the BIOS manufacturer, which the malware uses to flash the BIOS.”
Award BIOS is still the target, and while there are some changes in the code of the malware, many strings are practically identical, making the researchers speculate that the same group developed both Mebromi and Niwa!mem.
“We have now seen two BIOSkit malware in the wild within a couple of months. When the first Bioskit was identified, we did not know how soon we would see another. Now it appears we should expect to see more in near future,” say the researchers and add that cleaning BIOS infections will be a challenge for security vendors.
As it was already pointed out by Webroot’s Marco Giuliani, an antivirus solution that is able to clean the BIOS ROM needs to be totally error-proof in order to avoid rendering the system unbootable at all.
“The job of handling with such specific system codes should be left to the developers of the specific motherboard model, who release BIOS updates along with specific tool to update the BIOS code,” he proposed.