{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"Tuvastatud UEFI-botkit Bootkitty, mis sisestab pahatahtliku koodi Linuxi laaditavasse tuuma","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ESETi teadlased avastasid uue bootkiti \u201eBootkitty\u201c, mis installitakse s\u00fcsteemi h\u00e4kkimise j\u00e4rel GRUBi laadija asemele ning mida kasutatakse pahatahtlike komponentide sisestamiseks Linuxi tuuma, mis seej\u00e4rel v\u00f5imaldab r\u00fcndajal s\u00fcsteemi varjatult kontrollida ja seal oma tegevusi teostada. V\u00e4idetavalt on see esimene UEFI bootkit, mis on suunatud Linuxi s\u00fcsteemide r\u00fcndamisele. <\/p>\n

Bootkitty asetatakse grubx64.efi faili EFI s\u00fcsteemiosasse (EFI system partition, \/boot\/efi\/EFI\/ubuntu) tavap\u00e4rase GRUB laadija asemel. P\u00e4rast aktiveerimist UEFI-firmware'i kaudu laadib bootkit m\u00e4lu t\u00f5elise GRUB2 laadija ja muudab GRUB2 m\u00e4lu sisaldavat koodi, deaktiveerides edaspidi laaditavate komponentide terviklikkuse kontrollimise ning lisab t\u00f6\u00f6tleja, mis kutsutakse esile p\u00e4rast Linuxi tuuma pildi m\u00e4lu laadimist. Mainitud t\u00f6\u00f6tleja muudab m\u00e4lu laaditud tuuma funktsioone (deaktiveerib moodulite digitaalsete allkirjade kontrollimise) ning muudab algprotsessi initsialiseerimise k\u00e4ivitamisrida \u201e\/init\u201c muutudes \u201eLD_PRELOAD=\/opt\/injector.so \/init\u201c. <\/p>\n

Raamatukogu injector.so salvestab teatud SELinuxi toiminguid ja init_module funktsiooni, mida seej\u00e4rel kasutatakse mooduli tuuma laadimiseks \/opt\/dropper.ko. Moodul tuum dropper.ko loob ja k\u00e4ivitab k\u00e4ivitatava faili \/opt\/observer, seej\u00e4rel varjab iseennast tuuma moodulite nimekirjas ja seondab s\u00fcsteemik\u00f5nede k\u00e4itlejad, nagu getdents ja tcp4_seq_show, faili \/opt\/observer ja teatud v\u00f5rguliiklust varjamiseks. K\u00e4ivitatav fail \/opt\/observer laadib tuuma mooduli \/opt\/rootkit_loader.ko, mis on r\u00fctikite loader \/opt\/rootkit.

\"Tuvastatud<\/center> <\/p>\n

Bootkiti seadistamiseks on vajalik privileege omav juurdep\u00e4\u00e4s s\u00fcsteemile ja tavaliselt kasutatakse neid pahatahtlikke tarkvarasid r\u00fcndajate poolt p\u00e4rast s\u00fcsteemi edukat r\u00fcndamist v\u00f5i kompromiteerimist oma edasise kohaloleku kindlustamiseks ja pahatahtliku tegevuse varjamiseks. Raamatukogu injector.so ja pahatahtlikud tuuma moodulid paigutatakse r\u00fcndaja poolt algse RAM-disk'i kujutisse v\u00f5i failis\u00fcsteemi. Bootloader grubx64.efi paigutatakse UEFI failide osasse. <\/p>\n

Bootkitty variandis, mis uurijate k\u00e4tte sattus, viidi tuuma m\u00e4lus funktsioonide modifikatsioon l\u00e4bi ette m\u00e4\u00e4ratud silmade alusel, kontrollimata nende silmade korrektsust laaditud tuuma versiooni jaoks. Bootkitty's kasutatud silmad kehtisid ainult teatud Ubuntu v\u00e4ljalaskeversioonide tuuma ja GRUB versioonide jaoks, muudes s\u00fcsteemides p\u00f5hjustades k\u00e4ivitamisvigu. Bootkitty laadija (grubx64.efi) autentimisprotsessi verifitseerimiseks kasutati iset\u00f6\u00f6deldud sertifikaati, mis ei v\u00f5imaldanud bootkit'i kasutamist s\u00fcsteemides, kus on aktiveeritud UEFI Secure Boot re\u017eiim, ilma et r\u00fcndaja sertifikaat oleks lisatud UEFI usaldusv\u00e4\u00e4rsete sertifikaatide loendisse. Sellised omadused t\u00f5id uurijatele m\u00f5tte, et Bootkitty on vaid bootkit'i protot\u00fc\u00fcp, mis ei ole veel reaalses r\u00fcnnakus kasutusel. <\/p>\n

ESET'i avaldatud teavet uurides m\u00e4rkisid Binarly REsearchi uurijad Bootkittyga seotud artefaktide seas BMP-pilte, mida kasutatakse LogoFAIL haavatavuse \u00e4ra kasutamiseks, v\u00f5imaldades koodi k\u00e4ivitamist UEFI p\u00fcsivara tasemel ja UEFI Secure Boot mehhanismi \u00fcmbersuunamist. Bootkitty kontekstis kasutati LogoFAIL haavatavust agressori iset\u00f6\u00f6deldud sertifikaadi lisamiseks UEFI lubatud sertifikaatide loendisse, millega sertifitseeriti bootkit'i laadija grubx64.efi, v\u00f5imaldades bootkit'i k\u00e4ivitada s\u00fcsteemides, kus on aktiveeritud UEFI Secure Boot, ilma et sertifikaati oleks vaja k\u00e4sitsi lisada. <\/p>\n

R\u00fcnnak viiakse l\u00e4bi spetsiaalselt vormindatud BMP-pildi paigutamisega ESP (EFI System Partition) sektsiooni, et see n\u00e4idataks UEFI p\u00fcsivara poolt tootja logona. UEFI p\u00fcsivara kasutatavate haavatavate raamatukogude t\u00f5ttu, mis t\u00f6\u00f6tavad piltidega, v\u00f5ib spetsiaalselt vormindatud pildi t\u00f6\u00f6tlemine p\u00f5hjustada puhverserveri \u00fclevoolu ja koodi t\u00e4itmist UEFI p\u00fcsivara \u00f5igustega. LogoFAIL haavatavus tuvastati aastat tagasi ja see m\u00f5jutas UEFI p\u00fcsivara, sealhulgas neid, mida kasutati Aceri, HP, Fujitsu ja Lenovo s\u00fclearvutites. Uusimates UEFI p\u00fcsivara versioonides on probleem lahendatud, kuid paljud kasutuses olevad seadmed j\u00e4tkavad t\u00f6\u00f6tamist haavatavate p\u00fcsivara versioonidega.

\"Tuvastatud<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Avastatud UEFI-botkit Bootkitty, mis lisab pahavara laaditavasse Linuxi tuuma | ProHoster","description":"ESET'i uurijad tuvastasid uue bootkit'i \"Bootkitty\", mis installitakse p\u00e4rast s\u00fcsteemi h\u00e4kkimist GRUB laadija asemel ja mida kasutatakse Linuxi tuuma kahjulike komponentide asendamiseks, mis seej\u00e4rel v\u00f5imaldavad.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}