just 1 Posted September 6, 2022 Share Posted September 6, 2022 En gelişmiş BİOS virüsü ESET antivirüsünü bloklayabilir mi? Link to comment Share on other sites More sharing options...
Administrators Marcos 4,919 Posted September 7, 2022 Administrators Share Posted September 7, 2022 Since this is an English forum we kindly ask you to post in English. As to your question, ESET is one of very few AV vendors to scan UEFI for threats. https://www.eset.com/int/about/technology/ Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 198 Posted September 7, 2022 Most Valued Members Share Posted September 7, 2022 9 hours ago, Yusuf Alp said: En gelişmiş BİOS virüsü ESET antivirüsünü bloklayabilir mi? ESET will be able to detect threats in the BIOS/UEFI , but won't be able to clean them / remove them , a BIOS flash is necessary for that. Link to comment Share on other sites More sharing options...
just 1 Posted September 7, 2022 Author Share Posted September 7, 2022 1 hour ago, Marcos said: Burası İngilizce bir forum olduğu için İngilizce yazmanızı rica ediyoruz. Sorunuza gelince, ESET, UEFI'yi tehditlere karşı tarayan çok az AV satıcısından biridir. https://www.eset.com/int/about/technology/ 1 hour ago, Nightowl said: ESET, BIOS/UEFI'deki tehditleri algılayabilecek, ancak bunları temizleyemeyecek/kaldıramayacak, bunun için bir BIOS flaşı gereklidir. No, I'm not saying that. even if my system is infected by a state-of-the-art BIOS virus. Can this virus block ESET antivirus? Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 198 Posted September 7, 2022 Most Valued Members Share Posted September 7, 2022 It can be done by flashing BIOS image again from your motherboard manufacturer website ESET nor any other Antivirus cannot make modifications in the BIOS. Link to comment Share on other sites More sharing options...
just 1 Posted September 7, 2022 Author Share Posted September 7, 2022 1 minute ago, Nightowl said: Anakart üreticinizin web sitesinden BIOS görüntüsünü tekrar yanıp sönerek yapılabilir. ESET veya başka bir Antivirus, BIOS'ta değişiklik yapamaz. No, I'm not talking about that either. Can the most advanced BIOS virus Block ESET Antivirus Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 198 Posted September 7, 2022 Most Valued Members Share Posted September 7, 2022 Quote The computer code that starts right after the computer is turned on and has the ultimate power over the computer’s operating system (and thus the whole machine) is called firmware. The standard – think of it as a set of rules – for how the firmware behaves is called UEFI (its predecessor was called BIOS). Firmware and UEFI are often linked together and called UEFI firmware. A rootkit is a dangerous malware designed to gain “illegal” and persistent access to what is otherwise not allowed. Typically, a rootkit also masks its existence or the existence of other malware. A UEFI rootkit is a rootkit that hides in firmware, and there are two reasons for this type of rootkit being extremely dangerous. First, UEFI rootkits are very persistent, able to survive a computer’s reboot, re-installation of the operating system and even hard disk replacement. Second, they are hard to detect because the firmware is not usually inspected for code integrity. ESET security solutions containing a dedicated layer of protection, ESET UEFI Scanner, are an exception. https://www.eset.com/int/uefi-rootkit-cyber-attack-discovered/ Read here more about it. Link to comment Share on other sites More sharing options...
itman 1,629 Posted September 7, 2022 Share Posted September 7, 2022 (edited) I believe the OP's question is if UEFI base malware can disable/bypass anti-virus and other like security solutions. The answer is yes but it requires that a vulnerable currently exists in the UEFI bootloader: Quote Eclypsium researchers found that three UEFI bootloaders that were approved by Microsoft had vulnerabilities that permitted bypassing the Secure Boot feature and executing unsigned code In an advisory this week about the vulnerabilities, the Carnegie Mellon CERT Coordination Center warns that code executed in the early boot stages could “also evade common OS-based and EDR security defenses.” However, note the following: Quote Attackers exploiting any of the three vulnerabilities require elevated permissions on the system, such as admin on Windows or root on Linux machines, which is far from difficult to achieve on both platforms. Ref.: https://www.bleepingcomputer.com/news/security/microsoft-blocks-uefi-bootloaders-enabling-windows-secure-boot-bypass/ This also begs the question of the security status of devices where Win 10/11 Secure Boot feature is not enabled. Edited September 7, 2022 by itman Link to comment Share on other sites More sharing options...
just 1 Posted September 7, 2022 Author Share Posted September 7, 2022 1 minute ago, itman said: OP'nin sorusunun, UEFI tabanlı kötü amaçlı yazılımın anti-virüs ve diğer benzeri güvenlik çözümlerini devre dışı bırakıp atlayamayacağına inanıyorum. Cevap evet, ancak UEFI önyükleyicisinde şu anda bir güvenlik açığının bulunmasını gerektiriyor: Ancak aşağıdakilere dikkat edin: Referans: https://www.bleepingcomputer.com/news/security/microsoft-blocks-uefi-bootloaders-enable-windows-secure-boot-bypass/ I'm not asking him, can they bypass ESET antivirus even if it is infected with a security vulnerability? Link to comment Share on other sites More sharing options...
itman 1,629 Posted September 7, 2022 Share Posted September 7, 2022 35 minutes ago, Yusuf Alp said: I'm not asking him, can they bypass ESET antivirus even if it is infected with a security vulnerability? Impossible to determine at this point. First, a real malware exploit would need to exist in-the-wild. Next, the exploit would have to specifically target Eset installations. Finally, the exploit would need to be captured to test with. Link to comment Share on other sites More sharing options...
itman 1,629 Posted September 7, 2022 Share Posted September 7, 2022 (edited) I will say this about the noted UEFI bootloader vulnerability. I wouldn't "lose any sleep over it." First, it's a Secure Boot bypass and as previously noted, many don't have Secure Boot enabled for any number of reasons. Eset and most major AV vendors employ the Win 10/11 ELAM driver. This driver loads prior to other Win kernel mode drivers but after all kernel mode device drivers have loaded. The ELAM driver allows AV vendors to examine any drivers that load after it for malware status. As long as the AV vendor has a sig. for the malicious driver, you're protected. Now if a malicious kernel mode device driver got installed, you're well ............. screwed. Edited September 7, 2022 by itman Link to comment Share on other sites More sharing options...
rotaru 10 Posted September 17, 2022 Share Posted September 17, 2022 On 9/7/2022 at 3:02 AM, Marcos said: As to your question, ESET is one of very few AV vendors to scan UEFI for threats. It seems like Windows Defender ATP is doing it since 2020 UEFI scanner brings Microsoft Defender ATP protection to a new level - Microsoft Security Blog Link to comment Share on other sites More sharing options...
Most Valued Members peteyt 387 Posted September 17, 2022 Most Valued Members Share Posted September 17, 2022 37 minutes ago, rotaru said: It seems like Windows Defender ATP is doing it since 2020 UEFI scanner brings Microsoft Defender ATP protection to a new level - Microsoft Security Blog I think that may be the the business version Link to comment Share on other sites More sharing options...
itman 1,629 Posted September 17, 2022 Share Posted September 17, 2022 2 hours ago, rotaru said: It seems like Windows Defender ATP is doing it since 2020 Note the following: Quote Windows Defender System Guard helps defend against firmware attacks by providing guarantees for secure boot through hardware-backed security features like hypervisor-level attestation and Secure Launch, also known as Dynamic Root of Trust (DRTM), which are enabled by default in Secured-core PCs. The new UEFI scan engine in Microsoft Defender ATP expands on these protections by making firmware scanning broadly available. The key phrase above is "Secure-core PC's." Think motherboards that include Intel vPro chipset. Link to comment Share on other sites More sharing options...
rotaru 10 Posted September 18, 2022 Share Posted September 18, 2022 10 hours ago, itman said: The new UEFI scan engine in Microsoft Defender ATP expands on these protections by making firmware scanning broadly available. I see it differently; the new UEFI scan engine....expands on these protections ...making broadly available Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 198 Posted September 18, 2022 Most Valued Members Share Posted September 18, 2022 It scans the firmware , but yet cannot make any modifications or some sort of cleaning To have a clean UEFI/BIOS , you need to flash one again from manufacturer website , otherwise it cannot be touched by any AV, not Microsoft's and not ESET's and not Kaspersky's Link to comment Share on other sites More sharing options...
Recommended Posts