使命召唤

Ring 0级固件威胁：新型UEFI rootkit恶意软件BlackLotus曝光_我的网站

一 |     Ohio residents this week began voting on a constitutional amendment whose fate will ultimately determine abortion access in the state.Voters are considering two ballot initiatives; ballots began being accepted on Wednesday and go through Election Day on Nov. 7.The two measures are: Issue 1, the amendment that if approved would add abortion rights to the state constitution; and Issue 2, which would legalize recreational marijuana.The proposed abortion amendment would establish an "individual right to one's own reproductive medical treatment including but not limited to abortion" and then creates legal protections for those individuals, among other guarantees like for contraception and fertility treatment.The marijuana measure, if passed, would make Ohio the 24th state to legalize cannabis and would allow adults 21 years and older to buy and possess up to 2.5 ounces of flower and 15 grams of extract.In August, Ohio voters resoundingly rejected a contentious, Republican-backed ballot measure that would have raised the threshold for future changes to the state constitution -- an effort that would have specifically made it more difficult for the abortion amendment to pass.When the U.S. Supreme Court struck down its previous Roe v. Wade ruling, in 2022, the justices returned the question of abortion access to individual states. Since then, while some states have largely ceased abortion access, others have taken up ballot measures that put the question before voters. In those cases -- in both red and blue states so far -- voters have rejected the potential for abortion restrictions and bans or elected to expand access.On Sept. 27, the Ohio Supreme Court started hearing arguments about the state's six-week abortion ban, which was previously put on hold by a lower court.The success or failure of the abortion ballot measure could render that case moot, if state voters add abortion access to their constitution.Both sides have built up mobilization efforts over the past few weeks -- knocking on doors, canvassing and hosting rallies across the state."Whether you're pro-life or pro-choice, Issue 1 just goes too far," Ohio Gov. Mike DeWine, a Republican, said at a recent event at the Ohio GOP's headquarters.Ohio Democrats claimed last week to have been inching toward 100,000 doors knocked and more than 100,000 calls made in the time since their win in the August special election."We're not leaving anything behind as we work to protect women's rights to choose and prevent Ohio's extreme abortion ban from taking effect," Ohio Democratic Chairwoman Elizabeth Walters said during a recent press briefing.There's also been significant financial investment in the race. According to numbers from AdImpact released last week, $12.3 million had been spent or reserved in advertising around the abortion ballot measure, with anti-amendment groups outspending amendment supporters by about $1.6 million.

The two sides make their arguments

Both Ohioans United for Reproductive Rights, a coalition of groups supporting abortion rights, and allied Ohio Democrats have sounded the alarm on what they claim to be foul play by opponents of the abortion amendment.Last month, the state Supreme Court allowed the Republican-controlled Ohio Ballot Board -- which is overseen by Secretary of State Frank LaRose, who is also running for the U.S. Senate -- to use amendment language that includes the phrase "unborn child."Democrats on the board had asked for measure's language to remain what was on the petition that voters originally signed, which did not include that term.Amendment supporters have argued it was rewritten to confuse voters and is misleading about what the measure would actually do."They're running scared because they know their extreme abortion ban is wildly unpopular, and Ohio voters support a woman's right to make medical decisions for themselves without interference from politicians," Walters, with the state Democrats, said during a recent press call.Abortion opponents have also attempted to broaden the stakes of the proposal, arguing that it "goes far beyond" codifying the protections of Roe v. Wade to potentially affect parents' rights and "threaten the freedom of conscience of Ohio's healthcare professionals and preclude ... the enactment and enforcement of commonsense, protective laws," as Protect Women Ohio, one of the leading organizations fighting against the amendment, wrote in a memo."The Abortion Amendment victimizes rather than protects and empowers women and girls," they continued.LaRose, a leading voice against the measure, said in a statement to ABC News that "as a father and someone who's always stood up to protect life, I'll be working to defeat this radical measure."。    最近引发广泛讨论的“BlackLotus”，属于一款相当全能的固件级 rootkit 恶意软件。特点是能够躲过各种删除操作，以及绕过先进的 Windows 防护措施。此前这类高级攻击能力，仅被拥有深厚背景的机构所拥有，比如情报威胁组织。

二 | 然而据报道，一款更新、更强大的 UEFT rootkit，正被人挂到暗网论坛上叫卖。“防护环”示意（图自：Wikipedia / Hertzsprung）卖家宣称 BlackLotus 是一款固件级 rootkit 恶意软件，能够绕过 Windows 防护措施、并在 x86 架构的最底层运行恶意代码。率先曝光此事的安全研究人员指出，单个 rootkit 的许可证费用高达 5000 美元，而后续代码重建则只需 200 美元。

三 | 不过考虑到卖家罗列出来的功能，即使需要耗费重资，世界各地的网络犯罪分子和黑帽黑客也会趋之若鹜。

四 | Scott Scheferman 总结道：BlackLotus 采用了汇编与 C 语言编写，体量仅 80KB（约 81920 字节）。通过在内核级别（ring 0）提供‘代理防护’（agent protection），该 rootkit 能够在 UEFI 固件中长期驻留。此外 BlackLotus 具有反虚拟机、反调试和代码混淆功能，以阻碍研究人员对其展开分析尝试，且附带功能齐备的安装指南 / 常见问题解答。黑市叫卖帖与同类 rootkit 一样，BlackLotus 能够在 Windows 启动前的第一阶段被加载，因而能够绕过 Windows / x86 平台上的诸多安全防护措施。除了无视 Secure Boot、UAC、BitLocker、HVCI 和 Windows Defender，该恶意软件还提供了加载未签名驱动程序的能力。其它高级功能包括功能齐备的文件传输模式、以及易攻破的签名引导加载程序 —— 除非影响当今仍在使用的数百个引导加载程序，否则很难将它斩草除根。

五 | Scott Scheferman 还强调了 BlackLotus 可能对基于固件的现代安全防护机制构成威胁。而且新 UEFI rootkit 在易用性、扩展性、可访问性、持久性、规避和破坏潜力方面，都实现了相当大的跨越。此前人们一度认为这类威胁相当罕见，但过去几天不断被打脸的攻击报告，已经指向了截然不同的未来趋势。最后，安全社区将对 BlackLotus 恶意软件的实际样本展开更加细致、深入的分析，以确定传闻的真实性、还是说它只是某人精心编造的一个骗局。

Current article:http://www.choumaimuwogenkuzhainuan.bond/news/20260826_27388.xls

Published on:17:33:03