{"id":111907,"date":"2023-12-01T21:10:27","date_gmt":"2023-12-01T19:10:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov"},"modified":"2023-12-01T21:10:27","modified_gmt":"2023-12-01T19:10:27","slug":"logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","title":{"rendered":"LogoFAIL \u2014 atak na firmware UEFI poprzez podstawienie z\u0142o\u015bliwych logo","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Badacze z firmy Binarly zidentyfikowali szereg luk w kodzie do analizy obraz\u00f3w, u\u017cywanym w firmware UEFI r\u00f3\u017cnych producent\u00f3w. Luki te pozwalaj\u0105 na wykonanie w\u0142asnego kodu podczas uruchamiania systemu przez umieszczenie specjalnie sformatowanego obrazu w sekcji ESP (EFI System Partition) lub w cz\u0119\u015bci aktualizacji firmware, kt\u00f3ra nie jest opatrywana podpisem cyfrowym. Proponowana metoda ataku mo\u017ce by\u0107 stosowana do obej\u015bcia mechanizmu weryfikowanego uruchamiania UEFI Secure Boot oraz sprz\u0119towych mechanizm\u00f3w zabezpiecze\u0144, takich jak Intel Boot Guard, AMD Hardware-Validated Boot oraz ARM TrustZone Secure Boot. <\/p>\n

Problem wynika z tego, \u017ce firmware pozwala na wy\u015bwietlanie logotyp\u00f3w wskazanych przez u\u017cytkownika i wykorzystuje do tego biblioteki do analizy obraz\u00f3w, wykonywane na poziomie firmware bez zrzucania uprawnie\u0144. Zauwa\u017cono, \u017ce nowoczesne firmware zawieraj\u0105 kod do analizy format\u00f3w BMP, GIF, JPEG, PCX oraz TGA, w kt\u00f3rym wyst\u0119puj\u0105 luki prowadz\u0105ce do przepe\u0142nienia bufora podczas analizy niepoprawnych danych. <\/p>\n

Luki zosta\u0142y zidentyfikowane w firmware dostarczanych przez r\u00f3\u017cnych dostawc\u00f3w sprz\u0119tu (Intel, Acer, Lenovo) oraz producent\u00f3w firmware (AMI, Insyde, Phoenix). Poniewa\u017c problematyczny kod jest obecny w komponentach referencyjnych dostarczanych przez niezale\u017cnych dostawc\u00f3w firmware, u\u017cywanych jako podstawa do tworzenia w\u0142asnych firmware przez r\u00f3\u017cnych producent\u00f3w sprz\u0119tu, luki te nie s\u0105 specyficzne dla konkretnych dostawc\u00f3w i dotycz\u0105 ca\u0142ego ekosystemu. <\/p>\n

Szczeg\u00f3\u0142y dotycz\u0105ce wykrytych luk maj\u0105 zosta\u0107 ujawnione 6 grudnia na konferencji Black Hat Europe 2023. Na prezentacji na konferencji zostanie r\u00f3wnie\u017c zaprezentowany exploit umo\u017cliwiaj\u0105cy wykonanie w\u0142asnego kodu z uprawnieniami firmware na systemach z architektur\u0105 x86 i ARM. Pocz\u0105tkowo luki zosta\u0142y zidentyfikowane w trakcie analizy firmware Lenovo, opartej na platformach od Insyde, AMI i Phoenix, ale jako potencjalnie podatne wymieniane s\u0105 tak\u017ce firmware od Intel i Acer.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 ESP (EFI System Partition) \u0438\u043b\u0438 \u0432 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u0447\u0430\u0441\u0442\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111907","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LogoFAIL \u2014 atak na firmware UEFI przez podstawienie z\u0142o\u015bliwych logotyp\u00f3w | ProHoster","description":"Badacze z firmy Binarly zidentyfikowali szereg luk w kodzie do analizy obraz\u00f3w, u\u017cywanym w firmware UEFI r\u00f3\u017cnych producent\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LogoFAIL \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043b\u043e\u0433\u043e\u0442\u0438\u043f\u043e\u0432 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-01T19:10:27+00:00","article:modified_time":"2023-12-01T19:10:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/111907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=111907"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/111907\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=111907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=111907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=111907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}