The first UEFI bootkit for Linux

[Maxmars]

Used to be that Linux users had a kind of inflated sense of security about bootkits since up until now, it was a threat only to windows systems...

That time has ended... welcome to "Bootkitty" (someone has poured resources and effort into crating a bootkit for UNIX systems...) 



From ArsTechnica: Found on VirusTotal: The world’s first UEFI bootkit for Linux

Researchers at security firm ESET said Wednesday that they found the first UEFI bootkit for Linux. The discovery may portend that UEFI bootkits that have targeted Windows systems in recent years may soon target Linux too.

Bootkitty—the name unknown threat actors gave to their Linux bootkit—was uploaded to VirusTotal earlier this month. Compared to many Windows UEFI bootkits, Bootkitty is still relatively rudimentary, containing imperfections in key under-the-hood functionality and lacking the means to infect all Linux distributions other than Ubuntu. 

This malicious code is far from perfect, it leaves traces of itself behind.

Despite working on a handful of Ubuntu versions, Bootkitty contains flaws and limitations in crucial functionality required for it to run on a wider based on machines. One imperfection resides in the way the bootkit modifies the decompressed Linux kernel. As shown in the chunk of Bootkitty code displayed below, once the kernel image is decompressed, Bootkitty simply copies the malicious patches to the hardcoded offsets within the kernel image.

The result: “due to the lack of kernel-version checks in the function shown in [the figure above] Bootkitty can get to the point where it patches completely random code or data at these hardcoded offsets, thus crashing the system instead of compromising it,” ESET researchers explained.

Just thought I'd share the news.

[Maxmars]

Another associated story...

From ArsTecnica: Code found online exploits LogoFAIL to install Bootkitty Linux backdoor
Subtitled: Unearthed sample likely works against Linux devices from Acer, HP, Fujitsu, and Lenovo.

Researchers have discovered malicious code circulating in the wild that hijacks the earliest stage boot process of Linux devices by exploiting a year-old firmware vulnerability when it remains unpatched on affected models.

The critical vulnerability is one of a constellation of exploitable flaws discovered last year and given the name LogoFAIL. These exploits are able to override an industry-standard defense known as Secure Boot and execute malicious firmware early in the boot process. Until now, there were no public indications that LogoFAIL exploits were circulating in the wild.

The discovery of code downloaded from an Internet-connected web server changes all that. While there are no indications the public exploit is actively being used, it is reliable and polished enough to be production-ready and could pose a threat in the real world in the coming weeks or months.

The hits keep coming...

[Quantum12]

Linus Torvalds will be all over this.

[Sirius]

We never had to develop such things for linux because the servers all ran php and gave easy entry.

[OneStepBack]

Thanks for the heads up on this Maxmars.

ETA: Just realised that it is in fact different to rootkits.  I have a MSI motherboard. MSI doesn't have the option to change the boot logo so presumably its safe?