Firmware and Hardware Security

Firmware implants are the highest-persistence threat: they survive OS reinstall, disk wipe, and in some cases physical hardware replacement. They are also the highest-cost attack — firmware access typically requires a prior OS-level compromise or physical access. Detection requires out-of-band integrity checking (TPM PCR measurements, BMC logs) because once firmware is compromised, the OS cannot trust its own attestation. This chapter extends the UEFI bootkit coverage from ch198 with deeper hardware-layer attacks.

UEFI Attack Surface — Extended

BMC and IPMI Attacks

// BMC (Baseboard Management Controller): independent processor on motherboard
// Provides: remote power control, KVM-over-IP, serial-over-LAN, iDRAC/iLO/IPMI
// Runs embedded Linux (BusyBox) on management network (dedicated NIC or shared)
// Default credentials are the #1 entry point: ADMIN/ADMIN, root/calvin, admin/password

// IPMI 2.0 cipher suite 0 (Rakp Auth bypass):
// ipmitool -I lanplus -H 192.168.1.100 -C 0 -U admin -P "" chassis status
// Cipher suite 0 = no-auth; if server supports it, no password needed

// IPMI password hash leak (CVE-2013-4786):
// RAKP2 message contains HMAC over password hash — attacker initiates auth,
// receives HMAC, can offline-crack password from HMAC
// Tool: ipmipwner or hashcat mode 7300 (IPMI2 RAKP)
// hashcat -m 7300 ipmi_hashes.txt rockyou.txt

// BMC compromise workflow:
// 1. Scan management network for IPMI port 623/UDP
// 2. Try default credentials or exploit cipher-0 or RAKP hash crack
// 3. Once authenticated: access BMC shell via SOL (Serial-Over-LAN)
//    ipmitool -I lanplus -H BMC_IP -U root -P PASSWORD sol activate
// 4. From BMC shell: modify UEFI NVRAM, replace firmware image, install backdoor
//    → Backdoor persists after complete OS reinstall

// BMC virtual media (remote mount):
// ipmitool -I lanplus -H BMC_IP -U admin -P PASS chassis bootdev cdrom
// → Boot target from attacker-controlled ISO image

// BMC firmware implant (theoretical, demonstrated by researchers):
// Flash malicious BMC firmware via vendor's firmware update mechanism
// Malicious BMC firmware: intercepts ipmitool commands, adds backdoor user,
// maintains persistent access regardless of BMC password reset

NIC Firmware Implants

// NIC firmware implants: malicious code flashed into network card firmware
// Demonstrated by NSA (ANT catalog): HALLUXWATER, JETPLOW for Cisco firmware
// Civilian equivalent: Thunderstrike-style for Macs, NSA-documented SWAP for Intel NICs

// PCI device DMA attack path (without firmware flash):
// 1. Malicious Thunderbolt device (or PCI device) → DMA access to host memory
// 2. Reads/writes RAM directly bypassing CPU: steal keys, patch OS code
// IOMMU (Intel VT-d / AMD-Vi) mitigates DMA attacks:
//    → Restricts which memory ranges each PCIe device can access
//    → Windows DMA Protection: enabled by default on modern devices with Secure Boot

// Network-bootable implant (less persistent, no firmware modification):
// BMC → configure PXE boot order first
// Attacker hosts malicious PXE server on management network
// → On each boot, loads attacker's pre-OS agent before Windows → stealth agent

// Detection for DMA attacks: IOMMU fault events in firmware/BMC logs
// Detection for PXE boot changes: compare boot order configuration against baseline

TPM and Measured Boot

// TPM (Trusted Platform Module): tamper-resistant chip that stores measurements
// PCR (Platform Configuration Register): accumulates SHA-256 hashes of boot components
// Measured Boot: each boot component extends the relevant PCR before execution:
//   PCR 0: UEFI firmware
//   PCR 7: Secure Boot state
//   PCR 11: BitLocker
//   PCR 13: bootmgfw.efi loaded modules

// Remote Attestation: TPM quotes PCR values → verifier checks against golden baseline
// If any boot component changed (UEFI modified, Secure Boot disabled) → PCR mismatch
// → Remote attestation server refuses to unseal keys → BitLocker won't unlock
// → This is how Measured Boot detects UEFI implants (BlackLotus defeated pre-patch Secure Boot)

// Reading PCR values (Windows):
Get-TpmEndorsementKeyInfo
Get-PcpDeviceInfo

// PowerShell: read PCR values via TSS.MSR or WMI
$tpm = Get-WmiObject -Namespace "root\CIMV2\Security\MicrosoftTpm" -Class Win32_Tpm
$tpm.GetPropertyNumericBigIntBinary(512)  # PCR 9

// Linux: tpm2_pcrread sha256:0,7,11,13

// Attestation-based detection: if golden PCR baseline is:
// PCR[0] = AABBCC...  (UEFI hash from known-good build)
// And current measurement shows different value → firmware modification detected
// Requires: out-of-band attestation service (not the compromised host itself)

Detection Engineering

title: UEFI / Secure Boot State Change Detected
logsource:
  product: windows
  service: microsoft-windows-kernel-boot
detection:
  selection:
    EventID: 22  # Boot status indicates Secure Boot disabled or bypass
  condition: selection
level: critical
tags: [attack.defense_evasion, T1542.001]

title: EFI System Partition Mounted in Userland
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\mountvol.exe'
    CommandLine|contains: '/s'
  condition: selection
level: critical

-- MDE KQL: NVRAM modification via SetFirmwareEnvironmentVariable
DeviceEvents
| where ActionType == "SecurityGroupCreated"
    or ActionType == "PrivilegeEscalation"
| where AdditionalFields has "SeSystemEnvironmentPrivilege"
| project Timestamp, DeviceName, InitiatingProcessFileName, AdditionalFields

-- MDE KQL: BCDEdit disabling recovery (ransomware/bootkit prep)
DeviceProcessEvents
| where FileName =~ "bcdedit.exe"
| where ProcessCommandLine has_any ("recoveryenabled","bootstatuspolicy","safeboot")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

Q&A