LoJax

LoJax is a unique and sophisticated piece of malware that targets the Unified Extensible Firmware Interface (UEFI) of a computer. First detected in 2018, LoJax was attributed to the Sednit group, also known as Fancy Bear, and it represented a significant leap in malware technology by being the first rootkit to directly attack the UEFI. The malware acts like a rootkit, gaining access to a computer or network's administrative levels while remaining hidden, and has the capability to survive an operating system reinstall, making it particularly resilient and difficult to remove. The mechanism through which LoJax operates involves exploiting a vulnerability in Computrace LoJack, a software that comes preinstalled on many computers' UEFI. It accesses both the UEFI and LoJack using binary files that compile information about the hardware from the operating system. This process allows the malware to persist even after OS reinstalls and hard drive replacements, especially on devices without state-of-the-art protection. Notably, series 5 Intel chipsets, introduced in 2008, have been found to be immune to LoJax. The discovery and analysis of LoJax highlighted the need for organizations to implement cybersecurity measures beyond those aimed at protecting operating systems alone. Many corporate cybersecurity solutions overlook threats like LoJax because they classify pre-installed software like Computrace LoJack and the UEFI software as safe. Therefore, the danger of LoJax isn't solely due to its ability to infect the UEFI, but also stems from the fact that it often goes undetected by conventional security solutions.