164 points

There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.

In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.

You weren’t hoping that Secure Boot saves your ass, were you?

permalink
report
reply
45 points

Since the EFI partition is unencrypted, physical access would do the trick here too, even with every firmware/software security measure.

permalink
report
parent
reply
23 points

True, but this was the case without this finding, wasn’t it? With write access to the EFI you could replace the boot loader and do whatever you please.

permalink
report
parent
reply
3 points

Unless a proper secure boot + FDE setup is in place.

permalink
report
parent
reply
18 points

The worst part it persists through reinstalls (if i understood correctly)

permalink
report
parent
reply
11 points

This is also my understanding, at least of you keep the EFI partition.

permalink
report
parent
reply
24 points
*

It can outlast those too.

In many of these cases, however, it’s still possible to run a software tool freely available from the IBV or device vendor website that reflashes the firmware from the OS. To pass security checks, the tool installs the same cryptographically signed UEFI firmware already in use, with only the logo image, which doesn’t require a valid digital signature, changed.

permalink
report
parent
reply
18 points
*

The idea is also that a compromised system will remains compromised after all storage drives are removed.

permalink
report
parent
reply
1 point
Deleted by creator
permalink
report
parent
reply
15 points

replace a file on the EFI partition.

Doesn’t this mean that secure boot would save your ass? If you verify that the boot files are signed (secure boot) then you can’t boot these modified files or am I missing something?

permalink
report
parent
reply
14 points

Well, not an expert. We learned now that logos are not signed. I’m not sure the boot menu config file is not either. So on a typical linux setup you can inject a command there.

permalink
report
parent
reply
4 points
*

If it can execute in ram (as far as I understand, they’ve been talking about fileless attacks, so… Possible?), it can just inject whatever

Addit: also, sucure boot on most systems, well, sucks, unless you remove m$ keys and flash yours, at least. The thing is, they signed shim and whatever was the alternative chainable bootloader (mako or smth?) effectively rendering the whole thing useless; also there was a grub binary distributed as part of some kaspersky’s livecd-s with unlocked config, so, yet again, load whatever tf you want

permalink
report
parent
reply
3 points

Last time I enabled secure boot it was with a unified kernel image, there was nothing on the EFI partition that was unsigned.

Idk about the default shim setup but using dracut with uki, rolled keys and luks it’d be secure.

After this you’re protected from offline attacks only though, unless you sign the UKI on a different device any program with root could still sign the modified images itself but no one could do an Evil Maid Attack or similar.

permalink
report
parent
reply
4 points

If I can replace a file in your EFI, how hard would it be to sign the same file.

permalink
report
parent
reply
3 points

Well, it rules out an evil maid attack and maybe jumping over a dual boot setup.

permalink
report
parent
reply

So if I have my computer set that it needs a sudo password for most changes am I good?

permalink
report
parent
reply
14 points

Yes, that’s my understanding. A normal user cannot do this. (And of course, an attacker shouldn’t not control a local user in the first place.)

Physical access is also a risk, but physical access trumps everything.

permalink
report
parent
reply

Thanks for the answer. Unless my dog learns how to code I think I’m safe from anyone getting physical access

permalink
report
parent
reply
6 points

Unless they find another way to escalate privileges… A bug, a random binary with suid, etc

permalink
report
parent
reply
7 points

See, I knew there were other reasons I wouldn’t touch secure boot lol

permalink
report
parent
reply
5 points

You weren’t hoping that Secure Boot saves your ass, were you?

i wonder if containerized firefox (eg snap/flatpak) will

permalink
report
parent
reply
2 points

Yeah, if someone has write access to your boot partition then you’re kind of already screwed.

permalink
report
parent
reply
76 points

Fyi if someone had physical access / administration access due to another vulnerability to your machine they can exploit it, news at 11:00

permalink
report
reply
8 points

Would resetting bios clear this?

permalink
report
parent
reply
7 points

More like reflashing entirely or just changing the image. Alternatively, you can often disable showing the.logo somewhere in the settings.

What’s known as resetting bios is more like removing the stuff saved in CMOS, AFAIK

permalink
report
parent
reply
2 points

Most fastboot options dont show the logo until windows bootloader comes along.
Though i am not sure how or why the logo is displayed when windows loads? Is that the same image? Loaded and displayed again or just didnt clear the display?

permalink
report
parent
reply
66 points
*

Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea? Or having them be accessible to the proper OS? Was there really no pushback, when UEFI was being standardized, to say “images that an OS can write to are not critical to initializing hardware functionality, don’t include that”? Was that question not asked for every single piece of functionality in the standard?

permalink
report
reply
53 points

Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea

UEFI and Secure Boot were pushed forcibly by MS. That’s why FAT32 is the ESP filesystem.

If I had to guess, a brief was drafted at MS to improve on BIOS, which is pretty shit, it has to be said. It was probably engineering led and not an embrace, extinguish thing. A budget and dev team and a crack team of lawyers would have been whistled up and given a couple of years to deliver. The other usual suspects (Intel and co) would be strong armed in to take whatever was produced and off we trot. No doubt the best and brightest would have been employed but they only had a couple of years and they were only a few people.

UEFI and its flaws are testament to the sheer arrogance of a huge company that thinks it can put a man on the moon with a Clapham omnibus style budget and approach. Management identify a snag and say “fiat” (let it be). Well it was and is and it has a few problems.

The fundamental problem with UEFI is it was largely designed by one team. The wikipedia page: https://en.wikipedia.org/wiki/UEFI is hilarious in describing it as open. Yes it is open … per se … provided you decide that FAT32 (patent encumbered) is a suitable file system for the foundations of an open standard.

I love open, me.

permalink
report
parent
reply
26 points

UEFI is flawed for sure, but there’s no way that any remaining patents on FAT32 haven’t expired by now.

permalink
report
parent
reply
13 points
*

You may be surprised to learn that they didn’t all run out until 2013. UEFI had been around for 7 years by this time, and Microsoft was doing patent enforcement actions against Tom Tom during this time period.

Sure, they’re expired now, but not at the time. It was supposed to be an open standard at the time.

permalink
report
parent
reply

Less is more. I feel we’ve forgotten that so worthless designers can justify their useless existences.

permalink
report
parent
reply
3 points
*

Yeah, the designers were lobbying to force showing hardware ads during boot…

Less is more.

Listen to your own maxim.

permalink
report
parent
reply
12 points
*

It breaks the cardinal rule of executing privileged code: Only code that absolutely needs to be privilaged should be privileged.

If they really wanted to have their logo in the boot screen, why can’t they just provide the image to the OS and request through some API that they display it? The UEFI and OS do a ton of back and fourth communication at boot so why can’t this be apart of that? (It’s not because then the OS and by extension the user can much more easily refuse to display what is essentially an ad for the hardware vendor right? They’d never put “features” in privileged code just to stop the user from doing anything about it… right?)

permalink
report
parent
reply
5 points

Yes.

permalink
report
parent
reply
46 points
*

I’ve never been a fan of the UEFI logo inserting itself into the boot screen. It’s basically just an advertisement for the hardware vendor because they’re jealous of the OS having the spotlight. And it’s an ad that, like so many other ads before it, screws over the security and privacy of the advertisee because fuck you that’s why.

permalink
report
reply
15 points

I don’t know. It looks more aesthetically consistent. Your computer has to display something. Average users would be scared if it dumped logs on the display. so the vendor logo makes sense. It COULD just say loading, but this is a bit pedantic I think.

permalink
report
parent
reply
10 points

When it comes to security, particularly at boot time, fuck the user. Users don’t interact with devices at boot time so it doesn’t matter if it shows a blank screen, a mile of logs or a screaming clown penis. If it was up to users no device or service would have a password or security of any kind, and every byte of information about your life would be owned by 'The Cloud." Let the marketing wanks insert their logo into the Windows boot process,

permalink
report
parent
reply
6 points

Tell me more about this screaming clown penis option…

permalink
report
parent
reply
3 points

I want to insert my own logo into the boot process, and I want these ducking vendors to properly validate and assess their mother ducking software. But nooo, penetration tests and any remediations are too expensive for these pieces of bit. Why do it when you can just stick your dick in everyone’s face, right?

Fuck.

permalink
report
parent
reply
6 points

??

With BIOS, it goes “Motherboard Logo -> OS Logo”

With UEFI, it goes “Motherboard Logo -> Motherboard Logo”

Sure, it’s more consistent, but the alternative is not user unfriendly, the only people it’s unfriendly to is the marketing wankers at Dell, Lenovo, Acer, etc.

permalink
report
parent
reply
38 points

I can’t believe stupid, pointless marketing crap didn’t have the best of the best working to ensure security.

permalink
report
reply

Linux

!linux@lemmy.ml

Create post

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

Community stats

  • 7.5K

    Monthly active users

  • 6.6K

    Posts

  • 179K

    Comments