{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"Felfedeztek egy UEFI bootkitet, a Bootkitty-t, amely rosszindulat\u00fa k\u00f3dot illeszt be a bet\u00f6ltend\u0151 Linux kernelbe.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az ESET kutat\u00f3i felfedezt\u00e9k az \u00faj Bootkitty nev\u0171 rootkitet, amely a rendszer hackel\u00e9se ut\u00e1n a GRUB bet\u00f6lt\u0151 helyett telep\u00fcl, \u00e9s a Linux magj\u00e1ba k\u00e1rt\u00e9kony \u00f6sszetev\u0151ket illeszt be, lehet\u0151v\u00e9 t\u00e9ve a t\u00e1mad\u00f3 sz\u00e1m\u00e1ra, hogy rejtve ir\u00e1ny\u00edtsa a rendszert \u00e9s v\u00e9grehajtsa benne a m\u0171veleteit. \u00c1ll\u00edt\u00f3lag ez az els\u0151 UEFI rootkit, amely a Linux rendszereket c\u00e9lozza meg. <\/p>\n

A Bootkitty a grubx64.efi f\u00e1jlban helyezkedik el az EFI rendszerpart\u00edci\u00f3n (EFI system partition, \/boot\/efi\/EFI\/ubuntu) a szok\u00e1sos GRUB bet\u00f6lt\u0151 helyett. Az UEFI firmware aktiv\u00e1l\u00e1sa ut\u00e1n a rootkit bet\u00f6lti a val\u00f3di GRUB2 bet\u00f6lt\u0151t a mem\u00f3ri\u00e1ba, \u00e9s m\u00f3dos\u00edt\u00e1sokat hajt v\u00e9gre a mem\u00f3ri\u00e1ban tal\u00e1lhat\u00f3 GRUB2 k\u00f3don, letiltva a k\u00e9s\u0151bb bet\u00f6lt\u00f6tt \u00f6sszetev\u0151k integrit\u00e1s\u00e1nak ellen\u0151rz\u00e9s\u00e9t, valamint hozz\u00e1ad egy kezel\u0151fel\u00fcletet, amely a Linux kernel k\u00e9p\u00e9nek mem\u00f3ria t\u00f6rl\u00e9s\u00e9t k\u00f6vet\u0151en aktiv\u00e1l\u00f3dik. A megadott kezel\u0151fel\u00fclet m\u00f3dos\u00edtja a bet\u00f6lt\u00f6tt mem\u00f3ri\u00e1ban tal\u00e1lhat\u00f3 kernel f\u00fcggv\u00e9nyeket (letiltja a modulok digit\u00e1lis al\u00e1\u00edr\u00e1s\u00e1nak ellen\u0151rz\u00e9s\u00e9t) \u00e9s megv\u00e1ltoztatja az inicializ\u00e1l\u00f3 folyamat ind\u00edt\u00e1si param\u00e9ter\u00e9t '\/init'-r\u00f3l 'LD_PRELOAD=\/opt\/injector.so \/init)-ra. <\/p>\n

Az injector.so k\u00f6nyvt\u00e1r egyes SELinux m\u0171veleteket \u00e9s az init_module funkci\u00f3t figyeli, amelyet ezut\u00e1n a \/opt\/dropper.ko kernel modul bet\u00f6lt\u00e9s\u00e9re haszn\u00e1lnak. A dropper.ko kernel modul l\u00e9trehozza \u00e9s elind\u00edtja az \/opt\/observer v\u00e9grehajthat\u00f3 f\u00e1jlt, majd eltitkolja mag\u00e1t a kernel modulok list\u00e1j\u00e1ban, \u00e9s be\u00e1ll\u00edtja a rendszerh\u00edv\u00e1sok kezel\u0151it, p\u00e9ld\u00e1ul a getdents \u00e9s tcp4_seq_show h\u00edv\u00e1sokat, hogy elrejtse az \/opt\/observer f\u00e1jlt \u00e9s bizonyos h\u00e1l\u00f3zati forgalmat. Az \/opt\/observer v\u00e9grehajthat\u00f3 f\u00e1jl bet\u00f6lti a \/opt\/rootkit_loader.ko kernel modult, amely a \/opt\/rootkit rootkit bet\u00f6lt\u0151je.

\"Felfedeztek<\/center> <\/p>\n

A bootkit telep\u00edt\u00e9s\u00e9hez privil\u00e9giumos hozz\u00e1f\u00e9r\u00e9s sz\u00fcks\u00e9ges a rendszerhez, \u00e9s az ilyen jelleg\u0171 rosszindulat\u00fa szoftvereket a t\u00e1mad\u00f3k \u00e1ltal\u00e1ban a rendszer sikeres felt\u00f6r\u00e9se vagy kompromitt\u00e1l\u00e1sa ut\u00e1n haszn\u00e1lj\u00e1k tov\u00e1bbi jelenl\u00e9t\u00fck meger\u0151s\u00edt\u00e9s\u00e9re \u00e9s a v\u00e9grehajtott rosszindulat\u00fa tev\u00e9kenys\u00e9g elrejt\u00e9s\u00e9re. Az injector.so k\u00f6nyvt\u00e1r \u00e9s a rosszindulat\u00fa kernel modulok a t\u00e1mad\u00f3 \u00e1ltal az initial RAM disk k\u00e9p\u00e9be vagy a f\u00e1jlrendszerbe ker\u00fclnek. A grubx64.efi bet\u00f6lt\u0151t az UEFI f\u00e1jlokkal rendelkez\u0151 part\u00edci\u00f3ra helyezik. <\/p>\n

A Bootkitty variant, which came into the hands of researchers, modified kernel functions in memory according to predefined offsets without checking the validity of these offsets for the loaded kernel version. The offsets used in Bootkitty were applicable only to certain versions of the kernel and GRUB provided in specific releases of Ubuntu, causing boot failures in other systems. To verify the Bootkitty bootloader (grubx64.efi), a self-signed certificate was used, which did not allow the bootkit to be applied on systems with UEFI Secure Boot enabled without installing the attacker's certificate in the list of trusted certificates in UEFI. Such features led researchers to believe that Bootkitty is merely a prototype of a bootkit, not yet used for real attacks. <\/p>\n

After studying the published ESET information, researchers from Binarly REsearch noticed among the artifacts related to Bootkitty BMP images used to exploit the LogoFAIL vulnerability, which allows code execution at the UEFI firmware level and bypasses the UEFI Secure Boot mechanism. In the context of Bootkitty, the exploit of the LogoFAIL vulnerability was used to add the attacker's self-signed certificate, which signed the Bootkitty loader grubx64.efi, to the list of approved UEFI certificates, allowing the bootkit to run on systems with active UEFI Secure Boot without manually adding the certificate. <\/p>\n

The attack is conducted by placing a specially crafted BMP image in the ESP (EFI System Partition) for it to be displayed by the UEFI firmware as the manufacturer logo. Due to the use of vulnerable libraries in UEFI firmwares for image handling, processing the specially crafted image may lead to a buffer overflow and execution of code with UEFI firmware privileges. The LogoFAIL vulnerability was identified a year ago and affected UEFI firmwares used, among others, on laptops from Acer, HP, Fujitsu, and Lenovo. In newer versions of UEFI firmwares, the issue has been resolved, but many commonly used devices continue to operate with vulnerable versions of the firmware.

\"Felfedeztek<\/center>
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Felt\u00e1rt\u00e1k a Bootkitty UEFI bootkitet, amely rosszindulat\u00fa k\u00f3dot injekt\u00e1l a bet\u00f6lt\u0151d\u0151 Linux kernelbe | ProHoster","description":"Researchers from ESET have identified a new bootkit \"Bootkitty\", which is installed after compromising the system instead of the GRUB loader and is used to inject malicious components into the Linux kernel, which then allows.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}