[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Windows Platform Binary Table (WPBT) - BIOS PE backdoor
Some more info
2015-08-12 14:44 GMT+03:00 Kevin Beaumont <kevin.beaumont@xxxxxxxxx>:
> There will be debate about if this is a vulnerability. It affects a
> majority of user PCs -- including all Enterprise editions of Windows,
> there is no way to disable it, and allows direct code execution into
> secure boot sequences. I believe it is worth discussing.
> Microsoft documented a feature in Windows 8 and above called Windows
> Platform Binary Table. Up until two days ago, this was a single Word
> document not referenced elsewhere on Google:
> This feature allows a BIOS to deliver the payload of an executable,
> which is run in memory, silently, each time a system is booted. The
> executable code is run under under Session Manager context (i.e.
> This technique is being used by Lenovo and HP to silently deliver
> software, even after systems are completely wiped. This issue came to
> light in this forum thread:
> Additionally, the code is injected and executed in Windows after the
> Windows kernel has booted - meaning hard drives are accessible. In a
> HP document - http://h10032.www1.hp.com/ctg/Manual/c03857419.pdf page
> 18 - they reference they use Windows Platform Binary Table to inject
> their code into encrypted systems (e.g. BitLocker) (!!!!).
> It is not possible to disable this functionality. If you can gain
> access to the BIOS, you can inject code into the Windows boot sequence
> using the documentation linked above. The BIOS delivered PE code is
> not countersigned by Microsoft.
> Microsoft say: "If partners intentionally or unintentionally introduce
> malware or unwanted software though the WPBT, Microsoft may remove
> such software through the use of antimalware software. Software that
> is determined to be malicious may be subject to immediate removal
> without notice."
> However, you are relying on Microsoft being aware of attacks. Since
> the code is executed in memory and not written to disk prior to
> activation, Windows Defender does not even scan the executed code.