{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"Der er opdaget en UEFI bootkit kaldet Bootkitty, der inds\u00e6tter ondsindet kode i det indl\u00e6ste Linux-kernel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra ESET har opdaget en ny bootkit kaldet \u2018Bootkitty\u2019, der installeres efter et systembrud i stedet for GRUB-bootloaderen og bruges til at injicere ondsindede komponenter i Linux-kerne, som derefter giver angriberen mulighed for skjult kontrol over systemet og udf\u00f8relse af handlinger der. Det h\u00e6vdes, at dette er den f\u00f8rste UEFI-bootkit, der sigter mod at ramme Linux-systemer. <\/p>\n

Bootkitty placeres i filen grubx64.efi i EFI-systempartitionen (\/boot\/efi\/EFI\/ubuntu) i stedet for den standard GRUB-bootloader. Efter aktivering af UEFI-firmware indl\u00e6ser bootkit\u2019en den virkelige GRUB2-bootloader i hukommelsen og foretager \u00e6ndringer i den indl\u00e6ste kode for GRUB2, der deaktiverer integritetskontrollen af de komponenter, der senere indl\u00e6ses, samt tilf\u00f8jer en behandler, der kaldes efter udpakning af Linux-kernebilledet i hukommelsen. Den n\u00e6vnte behandler foretager \u00e6ndringer i de indl\u00e6ste funktioner i kernen (deaktiverer kontrol af moduler baseret p\u00e5 digitale signaturer) og \u00e6ndrer initiationsprocessens opstartstr\u00e5d fra \u2018\/init\u2019 til \u2018LD_PRELOAD=\/opt\/injector.so \/init\u2019. <\/p>\n

Biblioteket injector.so opfanger nogle SELinux-operationer og funktionen init_module, som derefter bruges til at indl\u00e6se kernelmodulet \\\/opt\\\/dropper.ko. Kernelmodulet dropper.ko opretter og k\u00f8rer den eksekverbare fil \\\/opt\\\/observer, skjuler sig derefter p\u00e5 listen over kernelmoduler og ops\u00e6tter systemopkaldsbehandlere, s\u00e5som getdents og tcp4_seq_show, for at skjule filen \\\/opt\\\/observer og specifik netv\u00e6rkstrafik. Den eksekverbare fil \\\/opt\\\/observer indl\u00e6ser kernelmodulet \\\/opt\\\/rootkit_loader.ko, som er bootloaderen til rootkittet \\\/opt\\\/rootkit.

\"Der<\/center> <\/p>\n

For at installere bootkitten kr\u00e6ves privilegeret adgang til systemet, og s\u00e5danne typer af malware bruges typisk af angribere efter en vellykket kompromittering af systemet for at sikre deres videre tilstedev\u00e6relse og skjule den skadelige aktivitet. Biblioteket injector.so og de skadelige kernelmoduler placeres i billedet af den initiale RAM-disk eller filsystemet af angriberen. Bootloaderen grubx64.efi placeres i partitionen med filer til UEFI. <\/p>\n

I Bootkitty-varianten, der kom ned i h\u00e6nderne p\u00e5 forskerne, blev modifikationen af funktioner i kerne hukommelsen udf\u00f8rt efter forh\u00e5ndsdefinerede offset uden kontrol af korrektheden af disse offset for den indl\u00e6ste kerneversion. De offsets, der blev brugt i Bootkitty, var kun anvendelige til bestemte versioner af kernen og GRUB, der leveres i bestemte udgaver af Ubuntu, og i andre systemer f\u00f8rte de til fejl under opstart. For at verificere Bootkitty-l\u00e6seren (grubx64.efi) blev der anvendt et selvsigneret certifikat, hvilket forhindrede brugen af bootkit p\u00e5 systemer med aktiveret UEFI Secure Boot uden installation af angriberens certifikat i listen over betroede certifikater i UEFI. Disse funktioner fik forskerne til at overveje, at Bootkitty blot er en prototype p\u00e5 et bootkit, der endnu ikke er anvendt til reelle angreb. <\/p>\n

Ved at unders\u00f8ge den offentliggjorte information fra ESET bem\u00e6rkede forskere fra Binarly Research blandt de relaterede artefakter med Bootkitty BMP-billeder, der blev brugt til at udnytte s\u00e5rbarheden LogoFAIL, som g\u00f8r det muligt at k\u00f8re kode p\u00e5 UEFI-firmware niveau og omg\u00e5 mekanismen UEFI Secure Boot. I konteksten af Bootkitty blev udnyttelsen af s\u00e5rbarheden LogoFAIL brugt til at tilf\u00f8je et selvsigneret certifikat fra angriberen, der godkendte bootkit-l\u00e6seren grubx64.efi, til listen over godkendte UEFI-certifikater, hvilket gjorde det muligt at starte bootkit p\u00e5 systemer med aktivt UEFI Secure Boot uden manuel tilf\u00f8jelse af certifikatet. <\/p>\n

Angrebet udf\u00f8res ved at placere et specielt tilpasset BMP-billede i ESP (EFI System Partition), s\u00e5 det kan vises af UEFI-firmware som producentens logo. P\u00e5 grund af brugen af s\u00e5rbare biblioteker til billedbehandling i UEFI-firmware kan behandlingen af det specielt tilpassede billede f\u00f8re til buffer overflow og udf\u00f8relse af kode med UEFI-firmwarens privilegier. S\u00e5rbarheden LogoFAIL blev opdaget for et \u00e5r siden og ber\u00f8rte UEFI-firmware, blandt andet brugt p\u00e5 b\u00e6rbare computere fra Acer, HP, Fujitsu og Lenovo. Problemet er blevet l\u00f8st i nye versioner af UEFI-firmware, men mange enheder i brug forts\u00e6tter med at k\u00f8re de s\u00e5rbare versioner af firmwaren.

\"Der<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Udf\u00f8rt UEFI-bootkit Bootkitty, der inds\u00e6tter skadelig kode i den bootbare Linux-kernel | ProHoster","description":"Forskere fra ESET har afsl\u00f8ret en ny bootkit \"Bootkitty\", der installeres efter et systemnedbrud i stedet for GRUB-laderen og bruges til at inds\u00e6tte skadelig kode i Linux-kernen, som derefter muligg\u00f8r.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}