Bootkit infects UEFI firmware

Stefan Mileschin · 26th January 2022, 10:29

MoonBounce Finds SPI flaws on the motherboard

Security researchers from Kaspersky said they have discovered a novel bootkit that can infect a computer's UEFI firmware.

Dubbed MoonBounce the bootkit doesn't burrow and hide inside a section of the hard drive named ESP (EFI System Partition), where some UEFI code typically resides, but instead it infects the SPI flaws memory that is found on the motherboard.

This means that, unlike similar bootkits, defenders can't reinstall the operating system and replace the hard drive, as the bootkit will continue to remain on the infected device until the SPI memory is re-flashed or the motherboard is replaced.

According to Kaspersky, MoonBounce marks the third UEFI bootkit they have seen so far that can infect and live inside the SPI memory, following previous cases such as LoJax and MosaicRegressor.

MoonBounce's discovery comes after researchers have also found additional UEFI bootkits in recent months, such as ESPectre, FinSpy's UEFI bootkit, and others, which has led the Kaspersky team to conclude that what was once considered unachievable following the rollout of the UEFI standard has gradually become the norm.

https://fudzilla.com/news/54262-boot...-uefi-firmware

26th January 2022, 10:29	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 148,812	Bootkit infects UEFI firmware MoonBounce Finds SPI flaws on the motherboard Security researchers from Kaspersky said they have discovered a novel bootkit that can infect a computer's UEFI firmware. Dubbed MoonBounce the bootkit doesn't burrow and hide inside a section of the hard drive named ESP (EFI System Partition), where some UEFI code typically resides, but instead it infects the SPI flaws memory that is found on the motherboard. This means that, unlike similar bootkits, defenders can't reinstall the operating system and replace the hard drive, as the bootkit will continue to remain on the infected device until the SPI memory is re-flashed or the motherboard is replaced. According to Kaspersky, MoonBounce marks the third UEFI bootkit they have seen so far that can infect and live inside the SPI memory, following previous cases such as LoJax and MosaicRegressor. MoonBounce's discovery comes after researchers have also found additional UEFI bootkits in recent months, such as ESPectre, FinSpy's UEFI bootkit, and others, which has led the Kaspersky team to conclude that what was once considered unachievable following the rollout of the UEFI standard has gradually become the norm. https://fudzilla.com/news/54262-boot...-uefi-firmware

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Malware downloader infects your PC without a mouse click	Stefan Mileschin	WebNews	0	12th June 2017 05:49
Malware infects computers by hiding in browser ad GIFs	Stefan Mileschin	WebNews	0	10th December 2016 15:21
How to Enable Intel VT-x in Your Computer’s BIOS or UEFI Firmware	Stefan Mileschin	WebNews	0	10th April 2015 10:25
Apple Readies Fix for Thunderstrike Bootkit Exploit	Stefan Mileschin	WebNews	0	26th January 2015 08:03
American Megatrends Introduces New Aptio V UEFI BIOS Firmware	Stefan Mileschin	WebNews	0	8th October 2012 07:49
Cyber Attack: Shamoon Malware Infects, Steals, Wipes MBR	Stefan Mileschin	WebNews	0	20th August 2012 07:21
UEFI Forum Releases UEFI 2.3.1 Specification Update	Stefan Mileschin	WebNews	0	4th July 2012 09:21
Conficker worm spikes, infects 1.1 million PCs in less than 24 hours	jmke	WebNews	0	16th January 2009 22:15
Virus Infects Space Station Laptops (Again)	jmke	WebNews	0	28th August 2008 13:11
Scientists Discover Virus that Infects Other Viruses	jmke	WebNews	2	7th August 2008 17:38