{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"De UEFI-bootkit Bootkitty is ontdekt, die schadelijke code invoegt in de opstartbare Linux-kernel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Onderzoekers van ESET hebben een nieuwe bootkit ontdekt, «Bootkitty», die na het hacken van het systeem in plaats van de GRUB-loader wordt ge\u00efnstalleerd en wordt gebruikt om kwaadaardige componenten in de Linux-kernel in te voegen, waarmee de aanvaller het systeem verborgen kan controleren en zijn acties kan uitvoeren. Er wordt gesteld dat dit de eerste UEFI-bootkit is die gericht is op Linux-systemen. <\/p>\n

Bootkitty wordt geplaatst in het bestand grubx64.efi in de EFI-systeempartitie (EFI system partition, \/boot\/efi\/EFI\/ubuntu) in plaats van de standaard GRUB-loader. Na activatie door de UEFI-firmware laadt de bootkit de echte GRUB2-loader in het geheugen en brengt wijzigingen aan in de in het geheugen geplaatste code van GRUB2, die de integriteitscontrole van de verder te laden componenten uitschakelt, en voegt een handler toe die wordt aangeroepen na het uitpakken van de Linux-kernel naar het geheugen. De genoemde handler brengt wijzigingen aan in de in het geheugen geladen kernelfuncties (schakelt de controle van modules op digitale handtekeningen uit), en wijzigt de opstartregel van het initialisatieproces van « \/init» naar «LD_PRELOAD= \/opt\/injector.so \/init)». <\/p>\n

De injector.so-bibliotheek onderschept bepaalde SELinux-operaties en de init_module-functie, die vervolgens wordt gebruikt om de kernelmodule \/opt\/dropper.ko te laden. De kernelmodule dropper.ko cre\u00ebert en start het uitvoerbare bestand \/opt\/observer, verbergt zichzelf in de lijst van kernelmodules en stelt system call-handlers in, zoals getdents en tcp4_seq_show, om het bestand \/opt\/observer en bepaald netwerkverkeer te verbergen. Het uitvoerbare bestand \/opt\/observer laadt de kernelmodule \/opt\/rootkit_loader.ko, die de rootkit \/opt\/rootkit laadt.

\"De<\/center> <\/p>\n

Voor de installatie van de bootkit is toegang met verhoogde rechten tot het systeem vereist. Dergelijke malware wordt doorgaans door aanvallers gebruikt na een succesvolle hack of compromittering van het systeem om hun verdere aanwezigheid te verankeren en hun kwaadaardige activiteiten te verbergen. De injector.so-bibliotheek en de kwaadaardige kernelmodules worden door de aanvaller in de afbeelding van de init RAM-disk of het bestandssysteem geplaatst. De bootloader grubx64.efi wordt in de partitie met bestanden voor UEFI geplaatst. <\/p>\n

In the Bootkitty variant examined by researchers, modifications to the kernel memory functions were carried out at predefined offsets without verifying the correctness of these offsets for the loaded kernel version. The offsets used in Bootkitty were applicable only to certain versions of the kernel and GRUB provided in specific releases of Ubuntu; in other systems, they caused boot failures. To verify the Bootkitty bootloader (grubx64.efi), a self-signed certificate was used, which prevented the application of the bootkit on systems with UEFI Secure Boot enabled without adding the attacker's certificate to the trusted certificate list in UEFI. Such characteristics led researchers to believe that Bootkitty is merely a prototype of a bootkit that has not yet been used for real attacks. <\/p>\n

After studying the published ESET information, researchers from Binarly Research noticed among the artifacts related to Bootkitty BMP images used to exploit the LogoFAIL vulnerability, which allows executing code at the UEFI firmware level and bypassing the UEFI Secure Boot mechanism. In the context of Bootkitty, the exploitation of the LogoFAIL vulnerability was used to add the attacker's self-signed certificate, which signed the Bootkitty bootloader grubx64.efi, to the list of approved UEFI certificates, allowing the bootkit to run on systems with active UEFI Secure Boot without manually adding the certificate. <\/p>\n

The attack is conducted by placing a specially crafted BMP image in the ESP (EFI System Partition) for it to be displayed by the UEFI firmware as the manufacturer's logo. Due to the use of vulnerable libraries for image processing in UEFI firmwares, processing the specially crafted image can lead to a buffer overflow and the execution of code with UEFI firmware privileges. The LogoFAIL vulnerability was discovered a year ago and affected UEFI firmwares, including those used in laptops from Acer, HP, Fujitsu, and Lenovo. In new versions of UEFI firmwares, the issue has been addressed, but many commonly used devices continue to operate with vulnerable firmware versions.

\"De<\/center>
\n
Bron: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UEFI-rootkit Bootkitty ontdekt, dat kwaadaardige code in de opstartende Linux-kernel injecteert | ProHoster","description":"Researchers from ESET have identified a new bootkit called \"Bootkitty,\" which is installed after gaining access to the system instead of the GRUB bootloader and is used to inject malicious components into the Linux kernel, which then allows.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}