{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"Tuvastati UEFI-butik Bootkitty, mis lisab pahavara Linuxi laetud kernelisse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ESET-i uurijad avastasid uue Bootkitty nime kandva bootkit'i, mis paigaldatakse p\u00e4rast s\u00fcsteemi r\u00fcndamist GRUB-i laadija asemel, et asendada Linuxi kernelis pahatahtlikke komponente. Need v\u00f5imaldavad r\u00fcndajal s\u00fcsteemi varjatult kontrollida ja teostada seal oma tegevusi. V\u00e4idetakse, et see on esimene UEFI bootkit, mis keskendub Linuxi s\u00fcsteemide m\u00f5jutamisele. <\/p>\n

Bootkitty paigutatakse grubx64.efi faili EFI s\u00fcsteemi osas (EFI system partition, \/boot\/efi\/EFI\/ubuntu) standardse GRUB laadija asemel. P\u00e4rast aktiveerimist UEFI-firmware poolt laadib bootkit m\u00e4llu reaalse GRUB2 laadija ja muudab GRUB2 m\u00e4les olevat koodi, keelates komponentide terviklikkuse kontrollimise, mis j\u00e4rgnevate laadimiste puhul, ning lisab k\u00e4itleja, mis kutsub \u00fcles p\u00e4rast Linuxi kernel'i pildi m\u00e4lu lahtipakkimist. Antud k\u00e4itleja muudab laaditud funktsioone kernel'is (keelab moodulite digitaalse allkirja kontrollimise) ja muudab initsialiseerimisprotsessi k\u00e4ivitamise rea '\/init' pealt 'LD_PRELOAD=\/opt\/injector.so \/init' peale. <\/p>\n

Injector.so raamatukogu p\u00fc\u00fcab kinni m\u00f5ned SELinuxi toimingud ja init_module funktsiooni, mida seej\u00e4rel kasutatakse tuumamooduli \/opt\/dropper.ko laadimiseks. Tuumamoodul dropper.ko loob ja k\u00e4ivitab t\u00e4idetava faili \/opt\/observer, seej\u00e4rel peidab end tuumamoodulite nimekirjast ja seab s\u00fcsteemikutsungite k\u00e4itlejad, nagu getdents ja tcp4_seq_show, et varjata faili \/opt\/observer ja teatud v\u00f5rgu liiklust. T\u00e4idetav fail \/opt\/observer laadib tuumamooduli \/opt\/rootkit_loader.ko, mis on rootkiti \/opt\/rootkit laadija.

\"Tuvastati<\/center> <\/p>\n

Bootkiti installimiseks on vajalik privileege omav juurdep\u00e4\u00e4s s\u00fcsteemile ning selliseid pahavara vorme kasutatakse tavaliselt r\u00fcndajate poolt p\u00e4rast edukat sissetungi v\u00f5i s\u00fcsteemi kompromiteerimist, et kindlustada oma edasine kohalolek ja varjata teostatavat pahatahtlikku tegevust. Injector.so raamatukogu ja pahatahtlikud tuumamoodulid paigutatakse r\u00fcndaja poolt algse RAM-diski kujutisse v\u00f5i failis\u00fcsteemi. Grubx64.efi laadija paigutatakse UEFI failide sektsiooni. <\/p>\n

Bootkitty versioonis, mis j\u00f5udis uurijate k\u00e4tte, tehti tuumafunktsioonide muudatused m\u00e4lus eelnevalt m\u00e4\u00e4ratletud offset'ide kaudu, ilma et nende offset'ide \u00f5igsust laaditud tuumaversiooni suhtes kontrollitaks. Bootkitty's kasutatud offset'id kehtisid vaid teatud Ubuntu versioonide ja GRUB'i puhul, kuid muudes s\u00fcsteemides t\u00f5id nad kaasa laadimisvea. Bootkitty laadija (grubx64.efi) allkirjastamiseks kasutati iseallkirjastatud sertifikaati, mis ei lubanud alglaadimiskit kasutada s\u00fcsteemides, kus on lubatud UEFI Secure Boot re\u017eiim, ilma et r\u00fcndaja sertifikaat oleks lisatud UEFI usaldusv\u00e4\u00e4rsete sertifikaatide nimekirja. Sellised omadused tekitasid uurijates kahtlusi, et Bootkitty on vaid protot\u00fc\u00fcp ja pole veel tegelikes r\u00fcnnakutes kasutusel. <\/p>\n

Uurides avaldatud ESET teavet, m\u00e4rkisid Binarly Researchi teadlased Bootkitiga seotud artefaktide seas BMP-pilte, mida on kasutatud LogoFAIL haavatavuse \u00e4rakasutamiseks. See haavatavus v\u00f5imaldab k\u00e4ivitada koodi UEFI-firmware tasemel ja \u00fcletada UEFI Secure Boot mehhanismi. Bootkiti kontekstis kasutati LogoFAIL haavatavuse \u00e4rakasutamist, et lisada UEFI heakskiidetud sertifikaatide nimekirja r\u00fcndaja enda allkirjastatud sertifikaat, millega on allkirjastatud Bootkiti laadija grubx64.efi, v\u00f5imaldades seel\u00e4bi Bootkiti k\u00e4ivitada s\u00fcsteemides, kus on aktiivne UEFI Secure Boot, ilma sertifikaati k\u00e4sitsi lisamata. <\/p>\n

R\u00fcnnak toimub ESP (EFI s\u00fcsteemiparteil) spetsiaalselt kujundatud BMP-formaadis pildi paigutamise kaudu, et see UEFI p\u00fcsivara tootja logo v\u00e4lja tuua. UEFI-p\u00fcsivara pildit\u00f6\u00f6tluseks kasutatavate haavatavate raamatukogude t\u00f5ttu v\u00f5ib spetsiaalselt kujundatud pildi t\u00f6\u00f6tlemine p\u00f5hjustada puhverserveri \u00fclekoormust ning UEFI p\u00fcsivara privileegidega koodi t\u00e4itmist. LogoFAIL haavatavus tuvastati aasta tagasi ning see m\u00f5jutab UEFI-p\u00fcsivara, sealhulgas neid, mida kasutatakse Acer, HP, Fujitsu ja Lenovo s\u00fclearvutites. Uusimates UEFI-p\u00fcsivara versioonides on probleem lahendatud, kuid paljud laialdaselt kasutatavad seadmed t\u00f6\u00f6tavad endiselt haavatavate p\u00fcsivara versioonidega.

\"Tuvastati<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tuvastatud on UEFI bootkit Bootkitty, mis s\u00fcstib pahatahtlikku koodi laaditavasse Linuxi tuuma | ProHoster","description":"ESETi teadlased on avastanud uue Bootkitty'ks nimetatud bootkitti, mis paigaldatakse s\u00fcsteemi h\u00e4kkerite toimel GRUB-i laadija asemel ja mis lisab Linuxi tuuma pahavara komponente, et r\u00fcndaja saaks s\u00fcsteemi varjatult juhtida ja seal oma tegevusi teostada. V\u00e4idetavalt on see esimene UEFI bootkit, mis on suunatud Linuxi s\u00fcsteemide r\u00fcndamisele. Bootkitty paigutatakse grubx64.efi faili s\u00fcsteemi jaotisse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}