{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"Byl objeven UEFI bootkit Bootkitty, kter\u00fd vkl\u00e1d\u00e1 \u0161kodliv\u00fd k\u00f3d do zav\u00e1d\u011bn\u00e9ho j\u00e1dra Linuxu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci ze spole\u010dnosti ESET objevili nov\u00fd bootkit \u201eBootkitty\u201c, kter\u00fd se instaluje po kompromitaci syst\u00e9mu m\u00edsto zavad\u011b\u010de GRUB a pou\u017e\u00edv\u00e1 se k vkl\u00e1d\u00e1n\u00ed \u0161kodliv\u00fdch komponent do j\u00e1dra Linuxu, co\u017e \u00fato\u010dn\u00edkovi umo\u017e\u0148uje skryt\u011b kontrolovat syst\u00e9m a prov\u00e1d\u011bt v n\u011bm sv\u00e9 \u010dinnosti. Tvrd\u00ed se, \u017ee jde o prvn\u00ed UEFI bootkit c\u00edlen\u00fd na syst\u00e9my Linux. <\/p>\n

Bootkitty je um\u00edst\u011bn v souboru grubx64.efi v syst\u00e9mov\u00e9 oblasti EFI (EFI system partition, \/boot\/efi\/EFI\/ubuntu) m\u00edsto standardn\u00edho zavad\u011b\u010de GRUB. Po aktivaci UEFI firmware bootkit na\u010dte do pam\u011bti skute\u010dn\u00fd zavad\u011b\u010d GRUB2 a provede v pam\u011bti um\u00edst\u011bn\u00e9m k\u00f3du GRUB2 zm\u011bny, kter\u00e9 deaktivuj\u00ed kontrolu integritu komponent, kter\u00e9 budou v budoucnu na\u010dteny, a tak\u00e9 p\u0159id\u00e1v\u00e1 obslu\u017enou rutinu, kter\u00e1 je vyvol\u00e1na po rozbalen\u00ed obrazu j\u00e1dra Linuxu do pam\u011bti. Tato obslu\u017en\u00e1 rutina prov\u00e1d\u00ed zm\u011bny v na\u010dten\u00fdch funkc\u00edch j\u00e1dra (deaktivuje kontrolu modul\u016f podle digit\u00e1ln\u00edho podpisu) a tak\u00e9 m\u011bn\u00ed spou\u0161t\u011bc\u00ed \u0159\u00e1dek inicia\u010dn\u00edho procesu z \u201e\/init\u201c na \u201eLD_PRELOAD=\/opt\/injector.so \/init\u201c. <\/p>\n

Knihovna injector.so zachyt\u00e1v\u00e1 n\u011bkter\u00e9 operace SELinux a funkci init_module, kter\u00e1 je pot\u00e9 pou\u017eita k na\u010dten\u00ed j\u00e1drov\u00e9ho modulu \/opt\/dropper.ko. J\u00e1drov\u00fd modul dropper.ko vytv\u00e1\u0159\u00ed a spou\u0161t\u00ed spustiteln\u00fd soubor \/opt\/observer, pot\u00e9 se skryje v seznamu j\u00e1drov\u00fdch modul\u016f a nastav\u00ed obslu\u017en\u00e9 rutiny syst\u00e9mov\u00fdch vol\u00e1n\u00ed, jako je getdents a tcp4_seq_show, aby skryl soubor \/opt\/observer a ur\u010dit\u00fd s\u00ed\u0165ov\u00fd provoz. Spustiteln\u00fd soubor \/opt\/observer na\u010d\u00edt\u00e1 j\u00e1drov\u00fd modul \/opt\/rootkit_loader.ko, kter\u00fd je zav\u00e1d\u011b\u010dem rootkitu \/opt\/rootkit.

\"Byl<\/center> <\/p>\n

Pro instalaci bootkitu je vy\u017eadov\u00e1n privilegovan\u00fd p\u0159\u00edstup k syst\u00e9mu a obvykle se tyto druhy \u0161kodliv\u00e9ho softwaru pou\u017e\u00edvaj\u00ed \u00fato\u010dn\u00edky po \u00fasp\u011b\u0161n\u00e9m prolomen\u00ed nebo kompromitaci syst\u00e9mu k upevn\u011bn\u00ed jejich dal\u0161\u00ed p\u0159\u00edtomnosti a skryt\u00ed prov\u00e1d\u011bn\u00e9 \u0161kodliv\u00e9 aktivity. Knihovna injector.so a \u0161kodliv\u00e9 j\u00e1drov\u00e9 moduly jsou um\u00edst\u011bny do obrazu po\u010d\u00e1te\u010dn\u00edho RAM disku nebo souborov\u00e9ho syst\u00e9mu \u00fato\u010dn\u00edkem. Zav\u00e1d\u011b\u010d grubx64.efi je um\u00edst\u011bn do odd\u00edlu s soubory pro UEFI. <\/p>\n

Ve variant\u011b Bootkitty, kter\u00e1 se dostala do rukou badatel\u016f, byla modifikace funkc\u00ed v pam\u011bti j\u00e1dra prov\u00e1d\u011bna podle p\u0159edem stanoven\u00fdch posun\u016f, ani\u017e by byla ov\u011b\u0159ov\u00e1na spr\u00e1vnost t\u011bchto posun\u016f pro na\u010dtenou verzi j\u00e1dra. Pou\u017e\u00edvan\u00e9 v Bootkitty posuny byly aplikovateln\u00e9 pouze na verze j\u00e1dra a GRUB dod\u00e1van\u00e9 v ur\u010dit\u00fdch distribuc\u00edch Ubuntu, zat\u00edmco v jin\u00fdch syst\u00e9mech vedly k selh\u00e1n\u00ed p\u0159i bootov\u00e1n\u00ed. Pro ov\u011b\u0159en\u00ed bootloaderu Bootkitty (grubx64.efi) byl pou\u017eit samopodepsan\u00fd certifik\u00e1t, co\u017e neumo\u017enilo aplikaci bootkitu na syst\u00e9mech se zapnut\u00fdm re\u017eimem UEFI Secure Boot, ani\u017e by byl certifik\u00e1t \u00fato\u010dn\u00edka p\u0159id\u00e1n na seznam d\u016fv\u011bryhodn\u00fdch certifik\u00e1t\u016f v UEFI. Takov\u00e9 rysy vnukly badatel\u016fm my\u0161lenku, \u017ee Bootkitty je pouze prototyp bootkitu, kter\u00fd zat\u00edm nen\u00ed pou\u017e\u00edv\u00e1n pro re\u00e1ln\u00e9 \u00fatoky. <\/p>\n

Po prostudov\u00e1n\u00ed zve\u0159ejn\u011bn\u00fdch informac\u00ed od ESET si badatel\u00e9 z firmy Binarly Research v\u0161imli mezi souvisej\u00edc\u00edmi artefakty Bootkitty BMP-obr\u00e1zk\u016f, pou\u017e\u00edvan\u00fdch k exploitaci zranitelnosti LogoFAIL, kter\u00e1 umo\u017e\u0148uje vykonat k\u00f3d na \u00farovni UEFI firmware a obej\u00edt mechanismus UEFI Secure Boot. V kontextu Bootkitty byla exploatace zranitelnosti LogoFAIL pou\u017eita k p\u0159id\u00e1n\u00ed samopodepsan\u00e9ho certifik\u00e1tu \u00fato\u010dn\u00edka, kter\u00fd podepsal bootloader bootkitu grubx64.efi, do seznamu schv\u00e1len\u00fdch certifik\u00e1t\u016f UEFI, co\u017e umo\u017enilo spustit bootkit na syst\u00e9mech s aktivn\u00edm UEFI Secure Boot bez manu\u00e1ln\u00edho p\u0159id\u00e1n\u00ed certifik\u00e1tu. <\/p>\n

\u00datok je prov\u00e1d\u011bn prost\u0159ednictv\u00edm um\u00edst\u011bn\u00ed speci\u00e1ln\u011b navr\u017een\u00e9ho BMP obr\u00e1zku do odd\u00edlu ESP (EFI System Partition), aby byl zobrazen UEFI firmware jako logo v\u00fdrobce. D\u00edky pou\u017eit\u00ed zraniteln\u00fdch knihoven v UEFI firmwarech pro pr\u00e1ci s obr\u00e1zky m\u016f\u017ee zpracov\u00e1n\u00ed speci\u00e1ln\u011b upraven\u00e9ho obr\u00e1zku vy\u00fastit ve p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku a vykon\u00e1n\u00ed k\u00f3du s privilegii UEFI firmware. Zranitelnost LogoFAIL byla odhalena p\u0159ed rokem a t\u00fdkala se UEFI firmware, mimo jin\u00e9 pou\u017e\u00edvan\u00fdch na notebooc\u00edch Acer, HP, Fujitsu a Lenovo. V nov\u00fdch verz\u00edch UEFI firmware byla probl\u00e9m odstran\u011bn, ale mnoh\u00e9 b\u011b\u017en\u011b u\u017e\u00edvan\u00e9 za\u0159\u00edzen\u00ed st\u00e1le b\u011b\u017e\u00ed na zraniteln\u00fdch verz\u00edch firmware.

\"Byl<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Byl objeven UEFI bootkit Bootkitty, kter\u00fd vkl\u00e1d\u00e1 \u0161kodliv\u00fd k\u00f3d do zav\u00e1d\u011bc\u00edho j\u00e1dra Linuxu | ProHoster","description":"Badatel\u00e9 z firmy ESET odhalili nov\u00fd bootkit \"Bootkitty\", kter\u00fd se instaluje po napaden\u00ed syst\u00e9mu m\u00edsto bootloaderu GRUB a pou\u017e\u00edv\u00e1 se k vlo\u017een\u00ed \u0161kodliv\u00fdch komponent do j\u00e1dra Linuxu, co\u017e n\u00e1sledn\u011b umo\u017e\u0148uje.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}