Bootkitty: Analyzing the first UEFI bootkit for Linux

FanJ · Nov 27, 2024

ESET Research - 27 Nov 2024
https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/

Over the past few years, the UEFI threat landscape, particularly that of UEFI bootkits, has evolved significantly. It all started with the first UEFI bootkit proof of concept (PoC) described by Andrea Allievi in 2012, which served as a demonstration of deploying bootkits on modern UEFI-based Windows systems, and was followed with many other PoCs (EfiGuard, Boot Backdoor, UEFI-bootkit). It took several years until the first two real UEFI bootkits were discovered in the wild (ESPecter, 2021 ESET; FinSpy bootkit, 2021 Kaspersky), and it took two more years until the infamous BlackLotus – the first UEFI bootkit capable of bypassing UEFI Secure Boot on up-to-date systems – appeared (2023, ESET).
Click to expand...

A common thread among these publicly known bootkits was their exclusive targeting of Windows systems. Today, we unveil our latest discovery: the first UEFI bootkit designed for Linux systems, named Bootkitty by its creators. We believe this bootkit is merely an initial proof of concept, and based on our telemetry, it has not been deployed in the wild. That said, its existence underscores an important message: UEFI bootkits are no longer confined to Windows systems alone.
Click to expand...

Long article. Read there more!

itman · Dec 2, 2024

The Eset discovered Linux BootKitty UEFI vulnerablity is no longer theoretical: https://www.bleepingcomputer.com/ne...re-exploits-logofail-to-infect-linux-systems/ ;

Update 12/2/24: ESET updated their original BootKitty article today, stating that the project was created by cybersecurity students in Korea's Best of the Best (BoB) training program.

"The primary aim of this project is to raise awareness within the security community about potential risks and to encourage proactive measures to prevent similar threats," the program told ESET.

"Unfortunately, few bootkit samples were disclosed prior to the planned conference presentation."
Click to expand...

It's amazing how fast these exploits can be deployed in-the-wild.

Log in or Sign up

Bootkitty: Analyzing the first UEFI bootkit for Linux

FanJ Updates Team

itman Registered Member

Log in or Sign up

Bootkitty: Analyzing the first UEFI bootkit for Linux

FanJ Updates Team

itman Registered Member

Useful Searches