UEFIs booting Windows and Linux devices can be hacked by malicious logo images.
  • _edge@discuss.tchncs.de
    1563·
    11 months ago

    There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.

    In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.

    You weren’t hoping that Secure Boot saves your ass, were you?

    • deadcade@lemmy.deadca.de
      45·
      11 months ago

      Since the EFI partition is unencrypted, physical access would do the trick here too, even with every firmware/software security measure.

    • blindsight@beehaw.org
      18·
      11 months ago

      The idea is also that a compromised system will remains compromised after all storage drives are removed.

    • InnerScientist@lemmy.world
      15·
      11 months ago

      replace a file on the EFI partition.

      Doesn’t this mean that secure boot would save your ass? If you verify that the boot files are signed (secure boot) then you can’t boot these modified files or am I missing something?

      • _edge@discuss.tchncs.de
        151·
        11 months ago

        Well, not an expert. We learned now that logos are not signed. I’m not sure the boot menu config file is not either. So on a typical linux setup you can inject a command there.

      • hottari@lemmy.ml
        4·
        11 months ago

        If I can replace a file in your EFI, how hard would it be to sign the same file.

      • fl42v@lemmy.ml
        41·
        11 months ago

        If it can execute in ram (as far as I understand, they’ve been talking about fileless attacks, so… Possible?), it can just inject whatever

        Addit: also, sucure boot on most systems, well, sucks, unless you remove m$ keys and flash yours, at least. The thing is, they signed shim and whatever was the alternative chainable bootloader (mako or smth?) effectively rendering the whole thing useless; also there was a grub binary distributed as part of some kaspersky’s livecd-s with unlocked config, so, yet again, load whatever tf you want

        • InnerScientist@lemmy.world
          3·
          11 months ago

          Last time I enabled secure boot it was with a unified kernel image, there was nothing on the EFI partition that was unsigned.

          Idk about the default shim setup but using dracut with uki, rolled keys and luks it’d be secure.

          After this you’re protected from offline attacks only though, unless you sign the UKI on a different device any program with root could still sign the modified images itself but no one could do an Evil Maid Attack or similar.

          • fl42v@lemmy.ml
            1·
            11 months ago

            The point with m$ keys was that you should delete them as they’re used to sign stuff that loads literally anything given your maid is insistent enough.

            [note: it was mentioned in the arch wiki that sometimes removing m$ keys bricks some (which exactly wasn’t mentioned) devices]

  • JakenVeina@lemm.ee
    652·
    11 months ago

    Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea? Or having them be accessible to the proper OS? Was there really no pushback, when UEFI was being standardized, to say “images that an OS can write to are not critical to initializing hardware functionality, don’t include that”? Was that question not asked for every single piece of functionality in the standard?

    • gerdesj@lemmy.mlEnglish
      512·
      11 months ago

      Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea

      UEFI and Secure Boot were pushed forcibly by MS. That’s why FAT32 is the ESP filesystem.

      If I had to guess, a brief was drafted at MS to improve on BIOS, which is pretty shit, it has to be said. It was probably engineering led and not an embrace, extinguish thing. A budget and dev team and a crack team of lawyers would have been whistled up and given a couple of years to deliver. The other usual suspects (Intel and co) would be strong armed in to take whatever was produced and off we trot. No doubt the best and brightest would have been employed but they only had a couple of years and they were only a few people.

      UEFI and its flaws are testament to the sheer arrogance of a huge company that thinks it can put a man on the moon with a Clapham omnibus style budget and approach. Management identify a snag and say “fiat” (let it be). Well it was and is and it has a few problems.

      The fundamental problem with UEFI is it was largely designed by one team. The wikipedia page: https://en.wikipedia.org/wiki/UEFI is hilarious in describing it as open. Yes it is open … per se … provided you decide that FAT32 (patent encumbered) is a suitable file system for the foundations of an open standard.

      I love open, me.

      • evranch@lemmy.ca
        261·
        11 months ago

        UEFI is flawed for sure, but there’s no way that any remaining patents on FAT32 haven’t expired by now.

    • interceder270@lemmy.world
      184·
      11 months ago

      Less is more. I feel we’ve forgotten that so worthless designers can justify their useless existences.

      • Shareni@programming.dev
        41·
        11 months ago

        Yeah, the designers were lobbying to force showing hardware ads during boot…

        Less is more.

        Listen to your own maxim.

    • HiddenLayer5@lemmy.mlEnglish
      10·
      11 months ago

      It breaks the cardinal rule of executing privileged code: Only code that absolutely needs to be privilaged should be privileged.

      If they really wanted to have their logo in the boot screen, why can’t they just provide the image to the OS and request through some API that they display it? The UEFI and OS do a ton of back and fourth communication at boot so why can’t this be apart of that? (It’s not because then the OS and by extension the user can much more easily refuse to display what is essentially an ad for the hardware vendor right? They’d never put “features” in privileged code just to stop the user from doing anything about it… right?)

  • HiddenLayer5@lemmy.mlEnglish
    433·
    11 months ago

    I’ve never been a fan of the UEFI logo inserting itself into the boot screen. It’s basically just an advertisement for the hardware vendor because they’re jealous of the OS having the spotlight. And it’s an ad that, like so many other ads before it, screws over the security and privacy of the advertisee because fuck you that’s why.

    • ddkman@lemm.ee
      216·
      11 months ago

      I don’t know. It looks more aesthetically consistent. Your computer has to display something. Average users would be scared if it dumped logs on the display. so the vendor logo makes sense. It COULD just say loading, but this is a bit pedantic I think.

      • Nik282000@lemmy.ca
        122·
        11 months ago

        When it comes to security, particularly at boot time, fuck the user. Users don’t interact with devices at boot time so it doesn’t matter if it shows a blank screen, a mile of logs or a screaming clown penis. If it was up to users no device or service would have a password or security of any kind, and every byte of information about your life would be owned by 'The Cloud." Let the marketing wanks insert their logo into the Windows boot process,

        • 0xD@infosec.pub
          3·
          11 months ago

          I want to insert my own logo into the boot process, and I want these ducking vendors to properly validate and assess their mother ducking software. But nooo, penetration tests and any remediations are too expensive for these pieces of bit. Why do it when you can just stick your dick in everyone’s face, right?

          Fuck.

      • azertyfun@sh.itjust.works
        6·
        11 months ago

        ??

        With BIOS, it goes “Motherboard Logo -> OS Logo”

        With UEFI, it goes “Motherboard Logo -> Motherboard Logo”

        Sure, it’s more consistent, but the alternative is not user unfriendly, the only people it’s unfriendly to is the marketing wankers at Dell, Lenovo, Acer, etc.

  • Melllvar@startrek.websiteEnglish
    31·
    11 months ago

    As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.

    So, does disabling the boot logo prevent the attack, or would it only make the attack obvious?

    • lazylion_ca@lemmy.ca
      172·
      11 months ago

      If you have access to replace the logo file, you probably have access to enable it as well.

      • fl42v@lemmy.ml
        6·
        11 months ago

        Not necessarily, I guess. They’re talking about a firmware upgrade of sorts, and, at least on the machines I own(ed), performing it didn’t reset user settings (which disabling the logo is)

      • Melllvar@startrek.websiteEnglish
        13·
        11 months ago

        Usually you can, though the setting might be listed under something like “show diagnostic during boot”.

  • redcalcium@lemmy.institute
    377·
    11 months ago

    As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running.

    Me using an old PC with BIOS instead of UEFI: 😏

  • planish@sh.itjust.works
    222·
    11 months ago

    Hello I am writing the firmware for MotherBoard 2021, a definitely completely different product than MotherBoard 2020, I am going to ship in in 2 weeks for Christmas, and I am going to write an image decoder on top of bare metal, and it is “not” going to let you hack the pants off the computer.

    Said no one ever.

  • HiddenLayer5@lemmy.mlEnglish
    19·
    11 months ago

    The article didn’t mention this, but would disabling the UEFI logo in the boot screen mitigate the vulnerability until proper patches get rolled out? (Or honestly at this point, I’d keep it disabled even after it’s patched in case they didn’t patch it right. UEFI’s are all proprietary so it’s not like you can check.) Since the vulnerability is in the image parser, would bypassing that be enough?

    Do they even let you disable it?

  • kugmo@sh.itjust.worksEnglish
    16·
    11 months ago

    So this is only for the background of the motherboard boot up logo like from Asus, Acer, Gigabyte ect? Not your grub or rEFInd background correct?

  • const_void@lemmy.ml
    15·
    11 months ago

    We need more machines that support coreboot. These proprietary firmware vendors have been getting rich off making our machines worse for too long.

  • LainOfTheWired@lemy.lolEnglish
    12·
    11 months ago

    I wonder if this effects coreboot builds like heads as they allow you to use external devices like a nitrokey for verification when you boot

  • milicent_bystandr@lemm.ee
    101·
    11 months ago

    So, does this affect dual boot systems, if e.g. Windows is compromised, now that malware in the efi partition can compromise the Linux system next time it boots? Yikes!

    I suppose in principle malware from one OS can attack the other anyway, even if the other is fully encrypted and/or the first OS doesn’t have drivers for the second’s filesystems: because malware can install said drivers and attack at least the bootloader - though that night have been protected by secure boot if it weren’t for this new exploit?

  • Caveman@lemmy.world
    8·
    11 months ago

    On Linux/Mac you have no use sudo. For sudo you need a password.

    This thing will make it very easy to make a rubber ducky though.

    • HiddenLayer5@lemmy.mlEnglish
      10·
      11 months ago

      Would be pretty easy to pull off if you had hardware access. Just boot from a flash drive and drop the exploit from there.

      Even if their OS is full disk encrypted, this can easily inject a backdoor or just keylog the bootup password prompt.

  • Hagarashi8@sh.itjust.worksEnglish
    8·
    11 months ago

    I may be wrong, but does it mean that if someone is able to modify my uefi - they would be able to inject virus in booting image?