UEFI Rootkits

Whether you are a cybersecurity expert or not, there are some security risks that every business leader needs to be aware of—and UEFI rootkits definitely fall into that category. These nasty computer viruses are uniquely dangerous to your computer systems because they do not get wiped out when you reformat your hard drive or reinstall your operating system. Instead, they stick around in your computer’s flash memory and pop right back up again when you try to start using the machine. It is important that everyone be aware of UEFI rootkits to minimize their spread and limit the damage they can do to your systems.

UEFI Basics

To understand what makes UEFI rootkits so difficult to deal with, you first need to understand the basics of how modern computers are set up. You have probably heard the term BIOS before. The basic input/output system was the firmware used for decades to start your computer up, among other functions. But in recent years BIOS was replaced by Unified Extensible Firmware Interface or UEFI. UEFI is also used to boot up your operating system, among other tasks. Because it needs to be able to start up everything else, UEFI resides in your flash memory—the same place that the UEFI rootkit resides once it infects your computer.

What UEFI Rootkits Do

The genius of the UEFI rootkit is that it is placed in the one area where you are unlikely to get rid of it using normal security measures. It infiltrates your UEFI on your flash memory. The specific location of the virus is ideal to keep it coming back again and again. The antivirus does not find it. Even wiping the hard drive does not touch it. Only a very targeted effort to remove it from your UEFI will eliminate the problem from your machine.

The Challenge of Getting Rid of a UEFI Rootkit

For most computer users, the basics of security begin with running antivirus and antimalware products. But the majority of these products will not even look at your UEFI, which means they are not going to find a UEFI rootkit. The next step, which is typically considered quite drastic, is to wipe your hard drive and reinstall your operating system. Almost every computer virus can be eliminated by taking this step. Once you wipe the hard drive, you wipe out the virus. Yes, you have to go through the inconvenience of reinstalling everything—which can be very inconvenient, depending on what your business computers have installed and the kind of work you are doing. But it is usually a surefire way to eliminate a virus.

What can be so frustrating for businesses is that even taking the drastic measure of wiping and reinstalling does not solve the problem. You can even swap out the hard drive and install a brand new hard drive. When you consider that applying all of these fixes could take days for companies with tens or even hundreds of computers, you can appreciate how maddening it would be to have the problem persist.

What Can Businesses Do to Prevent UEFI Rootkits?

There are a few things that businesses can do to prevent these nasty viruses from showing their ugly heads:

1. Educate those that need to know.

Whatever IT staff you have, even if it is just a computer-savvy employee that keeps things going smoothly, should be educated on UEFI rootkits. When people know about them, it becomes much easier to address the problem. If you have taken the normal steps to eliminate the virus and it keeps popping up, you could have a UEFI rootkit problem on your hands.

2. Consider getting new hardware if you do not have Secure Boot capabilities or something similar.

Secure Boot is a solution used on modern computer systems to prevent unauthorized access to the firmware. It requires that anything attempting to make a change to the computer’s firmware have a security code to make changes. If it does not have the security credentials, no changes can be made. Older machines do not have Secure Boot capabilities.

3. Verify that your Secure Boot configuration is properly set up.

Secure Boot is not a fix all. It does need to be properly configured to work as intended. Make sure that all of your Secure Boot systems are properly configured to prevent anyone from accessing your firmware when they should not.