{"id":111907,"date":"2023-12-01T21:10:27","date_gmt":"2023-12-01T19:10:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov"},"modified":"2023-12-01T21:10:27","modified_gmt":"2023-12-01T19:10:27","slug":"logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","title":{"rendered":"LogoFAIL \u2014 atac asupra firmware-urilor UEFI prin \u00eenlocuirea logo-urilor mali\u021bioase.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Binarly au identificat o serie de vulnerabilit\u0103\u021bi \u00een codul de analiz\u0103 a imaginilor utilizat \u00een firmware-urile UEFI ale diferitelor produc\u0103tori. Aceste vulnerabilit\u0103\u021bi permit executarea propriului cod \u00een timpul boot-ului prin plasarea unei imagini special concepute \u00een sec\u021biunea ESP (EFI System Partition) sau \u00een partea actualiz\u0103rii firmware-ului care nu are o semn\u0103tur\u0103 digital\u0103 validat\u0103. Metoda de atac propus\u0103 poate fi utilizat\u0103 pentru a ocoli mecanismul de boot verificat UEFI Secure Boot \u0219i mecanismele de protec\u021bie hardware, cum ar fi Intel Boot Guard, AMD Hardware-Validated Boot \u0219i ARM TrustZone Secure Boot. <\/p>\n

Problema este cauzat\u0103 de faptul c\u0103 firmware-urile permit afi\u0219area logo-urilor specificate de utilizator \u0219i folosesc pentru aceasta biblioteci de analiz\u0103 a imaginilor, care sunt executate la nivel de firmware f\u0103r\u0103 a reduce privilegiile. Se observ\u0103 c\u0103 firmware-urile moderne includ cod pentru analiza formatelor BMP, GIF, JPEG, PCX \u0219i TGA, care con\u021bin vulnerabilit\u0103\u021bi ce duc la overflow de buffer \u00een timpul analizei datelor incorecte. <\/p>\n

Vulnerabilit\u0103\u021bile au fost identificate \u00een firmware-urile furnizate de diver\u0219i furnizori de echipamente (Intel, Acer, Lenovo) \u0219i de produc\u0103tori de firmware (AMI, Insyde, Phoenix). Deoarece codul problematic este prezent \u00een componentele de referin\u021b\u0103 furnizate de furnizori independen\u021bi de firmware \u0219i utilizate ca temelie pentru crearea propriilor firmware-uri de c\u0103tre diferi\u021bi produc\u0103tori de echipamente, vulnerabilit\u0103\u021bile nu sunt specifice unui anumit furnizor \u0219i afecteaz\u0103 \u00eentreaga ecosistem. <\/p>\n

Detalii despre vulnerabilit\u0103\u021bile identificate vor fi divulgate pe 6 decembrie la conferin\u021ba Black Hat Europe 2023. \u00cen prezentarea de la conferin\u021b\u0103 va fi demonstrat de asemenea un exploit care permite executarea codului propriu cu privilegii de firmware pe sisteme cu arhitecturi x86 \u0219i ARM. Ini\u021bial, vulnerabilit\u0103\u021bile au fost identificate \u00een urma analizei firmware-urilor Lenovo, bazate pe platforme de la Insyde, AMI \u0219i Phoenix, dar firmware-urile de la Intel \u0219i Acer sunt men\u021bionate \u0219i ca fiind poten\u021bial vulnerabile.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 ESP (EFI System Partition) \u0438\u043b\u0438 \u0432 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u0447\u0430\u0441\u0442\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111907","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LogoFAIL \u2014 atac asupra firmware-urilor UEFI prin substituirea logo-urilor mali\u021bioase | ProHoster","description":"Cercet\u0103torii de la Binarly au identificat o serie de vulnerabilit\u0103\u021bi \u00een codul de analiz\u0103 a imaginilor utilizat \u00een firmware-urile UEFI ale diferitelor produc\u0103tori.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LogoFAIL \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043b\u043e\u0433\u043e\u0442\u0438\u043f\u043e\u0432 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Binarly \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/logofail-ataka-na-uefi-proshivki-cherez-podstanovku-vredonosnyh-logotipov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-01T19:10:27+00:00","article:modified_time":"2023-12-01T19:10:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=111907"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111907\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=111907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=111907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=111907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}