This is courtesy of
Xeno's
twitterfeed
http://www.intelsecurity.com/advanced-threat-research/blog.html
From the paper:
Updating the SPI flash, where system firmware is
usually stored, is usually accomplished either through physically attaching a
programmer to the chip or through a signed update mechanism built into the
firmware. One of the leaked emails contains a presentation (presumably for
potential customers) that describes this:
Explanations:
- "Attaching a programmer to the chip" - well known - supply chain attack or "black bag job"
- "Signed update mechanism" - presumed, but important since I think this is much more common on enterprise systems over personal or consumer
This is key - it means it needs a bag job, or an enterprise system.
If you support enterprise systems, you can consider yourself a target.
I'm sorry their email was compromised, but they're doing bad things, and they're not an entertainment company here, trash talking movie stars. They're targeting me and my clients/sponsors - the contents of the emails and files are fair game for us to protect ourselves.
How do I protect myself or my clients?
From the paper:
Intel has released
CHIPSEC,
which contains various tests and tools for platform security assessment,
including some forensic capabilities.
They go on to give examples of how to use and what the results mean, and most importantly:
Installing [the Hacking Team] firmware rootkit involves rewriting
SPI flash. The system firmware is responsible for securely configuring the
protections on SPI flash in order to prevent this. CHIPSEC contains
configuration checks that users can easily run:
- python chipsec_main.py -m common.bios_wp
This does not mean that the system
is infected, but it would be harder to infect a system that passes this test
than one that fails.If this test fails, it may be possible for software
running on the system to modify the BIOS in the SPI flash due to insecure
configuration of the hardware protections.
This means to me that you'll need python to run it (go figure, we're on windows, guys) , but I'll spin it up on a couple of machines to see what happens
P
