UEFI vulnerabilities: The Far-Reaching Consequences of LogoFAIL

https://binarly.io/posts/The_Far_Reaching_Consequences_of_LogoFAIL/index.html

 

Windows and Linux devices vulnerable to new LogoFAIL firmware attack

Dan Goodin - 12/6/2023, 10:02 AM

https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/

"Hundreds of Windows and Linux computer models from virtually all hardware makers are
vulnerable to a new attack that executes malicious firmware early in the boot-up
sequence, a feat that allows infections that are nearly impossible to detect or remove
using current defense mechanisms."

...

"The affected parties are releasing advisories that disclose which of their products are
vulnerable and where to obtain security patches. Links to advisories and a list of
vulnerability designations appears at the end of this article."

 

Adversary needs physical or complete remote access to an administrator or root account on computer to perform this. In first case it is serious issue significantly increasing risk of leaving computer without physical security unattended. For the remaining second case you are already p0wned by something else, so it mostly adds additional persistence.

 

Not necessarily. A BIOS update can be modified to include an image in the unsigned section of the update, leaving the signed section intact so the modified BIOS update will install without any problems. Given that it's not really possible to verify if a BIOS update is authentic (unless you're an expert), there are enough ways to serve modified updates to users to abuse these vulnerabilities:

Though of course there are enough ways to compromise users machine/data without having a stealth firmware bootkit for additional persistence.

 

I assume that user downloads UEFI update from trusted sources: laptop/motherboard vendor site or LVFS through https. Of course there is a possibility that server hosting updates becomes compeomised and during that period indeed computers can become infected