{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"A fost descoperit un bootkit UEFI numit Bootkitty, care introduce cod mali\u021bios \u00een kernelul Linux \u00eenc\u0103rcat.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la ESET au descoperit un nou bootkit numit \u201eBootkitty\u201d, care este instalat dup\u0103 compromiterea sistemului \u00een locul bootloader-ului GRUB \u0219i este folosit pentru a introduce componente mali\u021bioase \u00een nucleul Linux, care apoi permit atacatorului s\u0103 controleze sistemul \u00een mod ascuns \u0219i s\u0103 efectueze ac\u021biuni \u00een acesta. Se afirm\u0103 c\u0103 acesta este primul bootkit UEFI destinat s\u0103 compromit\u0103 sistemele Linux. <\/p>\n

Bootkitty este plasat \u00een fi\u0219ierul grubx64.efi din parti\u021bia EFI (EFI system partition, \/boot\/efi\/EFI\/ubuntu) \u00een locul bootloader-ului GRUB standard. Dup\u0103 activarea de c\u0103tre firmware-ul UEFI, bootkit-ul \u00eencarc\u0103 \u00een memorie adev\u0103ratul bootloader GRUB2 \u0219i efectueaz\u0103 modific\u0103ri \u00een codul GRUB2 \u00eenc\u0103rcat \u00een memorie, dezactiv\u00e2nd verificarea integrit\u0103\u021bii componentelor care vor fi \u00eenc\u0103rcate ulterior, precum \u0219i ad\u0103ug\u00e2nd un handler care este apelat dup\u0103 desf\u0103\u0219urarea imaginii nucleului Linux \u00een memorie. Handler-ul specific efectueaz\u0103 modific\u0103ri \u00een func\u021biile nucleului \u00eenc\u0103rcate \u00een memorie (dezactiveaz\u0103 verificarea modulelor prin semn\u0103tur\u0103 digital\u0103) \u0219i, de asemenea, modific\u0103 linia de start a procesului de ini\u021bializare din \u201e\/init\u201d \u00een \u201eLD_PRELOAD=\/opt\/injector.so \/init\u201d. <\/p>\n

Biblioteca injector.so intercept\u0103 anumite opera\u021biuni SELinux \u0219i func\u021bia init_module, care este apoi utilizat\u0103 pentru a \u00eenc\u0103rca modulul nucleului \/opt\/dropper.ko. Modulul nucleului dropper.ko creeaz\u0103 \u0219i lanseaz\u0103 fi\u0219ierul executabil \/opt\/observer, apoi se ascunde \u00een lista modulelor nucleului \u0219i stabile\u0219te handleri pentru apeluri de sistem, cum ar fi getdents \u0219i tcp4_seq_show, pentru a ascunde fi\u0219ierul \/opt\/observer \u0219i anumite trafic de re\u021bea. Fi\u0219ierul executabil \/opt\/observer \u00eencarc\u0103 modulul nucleului \/opt\/rootkit_loader.ko, care este loader-ul rick-kit-ului \/opt\/rootkit.

\"A<\/center> <\/p>\n

Pentru a instala bootkit-ul, este necesar accesul privilegiat la sistem \u0219i, de obicei, astfel de tipuri de malware sunt utilizate de atacatori dup\u0103 ce sistemul a fost compromis cu succes sau \u00eenc\u0103lcat pentru a-\u0219i consolida prezen\u021ba viitoare \u0219i a ascunde activit\u0103\u021bile malefice desf\u0103\u0219urate. Biblioteca injector.so \u0219i modulele nucleului d\u0103un\u0103toare sunt plasate \u00een imaginea RAM disk ini\u021bial sau \u00een sistemul de fi\u0219iere de c\u0103tre atacator. Loader-ul grubx64.efi este plasat \u00een parti\u021bia de fi\u0219iere pentru UEFI. <\/p>\n

\u00cen varianta Bootkitty, ajuns\u0103 \u00een m\u00e2inile cercet\u0103torilor, modificarea func\u021biilor \u00een memoria nucleului se realiza pe baza unor deplas\u0103ri predefinite, f\u0103r\u0103 a verifica corectitudinea acestor deplas\u0103ri pentru versiunea \u00eenc\u0103rcat\u0103 a nucleului. Deplas\u0103rile utilizate \u00een Bootkitty erau aplicabile doar versiunilor nucleului \u0219i GRUB livrate \u00een anumite versiuni de Ubuntu, iar \u00een celelalte sisteme duceau la e\u0219ecuri la \u00eenc\u0103rcare. Pentru verificarea \u00eenc\u0103rc\u0103torului Bootkitty (grubx64.efi) a fost utilizat un certificat auto-semnat, ceea ce nu permitea aplicarea bootkit-ului pe sisteme cu modul UEFI Secure Boot activat, f\u0103r\u0103 a ad\u0103uga certificatul atacatorului \u00een lista de certific\u0103ri de \u00eencredere din UEFI. Aceste caracteristici au determinat cercet\u0103torii s\u0103 cread\u0103 c\u0103 Bootkitty este doar un prototip de bootkit, \u00een prezent neutilizat pentru atacuri reale. <\/p>\n

Studiind informa\u021biile publicate de ESET, cercet\u0103torii companiei Binarly Research au observat printre artefactele legate de Bootkitty imagini BMP, utilizate pentru a explora vulnerabilitatea LogoFAIL, care permite executarea codului la nivel de firmware UEFI \u0219i ocolirea mecanismului UEFI Secure Boot. \u00cen contextul Bootkitty, exploatarea vulnerabilit\u0103\u021bii LogoFAIL a fost utilizat\u0103 pentru a ad\u0103uga \u00een lista de certific\u0103ri aprobate UEFI un certificat auto-semnat al atacatorului, care avalidat \u00eenc\u0103rc\u0103torul bootkit grubx64.efi, ceea ce a permis lansarea bootkit-ului pe sisteme cu UEFI Secure Boot activ, f\u0103r\u0103 a ad\u0103uga certificatul manual. <\/p>\n

Atacul se desf\u0103\u0219oar\u0103 prin plasarea \u00eentr-o partajare ESP (EFI System Partition) a unei imagini special concepute \u00een format BMP pentru a fi afi\u0219at\u0103 de firmware UEFI ca logo al produc\u0103torului. Datorit\u0103 utiliz\u0103rii \u00een firmware UEFI a bibliotecilor vulnerabile pentru lucrul cu imaginile, procesarea imaginii special concepute poate conduce la suprascrierea buffer-ului \u0219i la executarea codului cu privilegii de firmware UEFI. Vulnerabilitatea LogoFAIL a fost identificat\u0103 acum un an \u0219i afecta firmware-urile UEFI, printre altele cele utilizate pe laptopuri Acer, HP, Fujitsu \u0219i Lenovo. \u00cen versiunile mai noi ale firmware-urilor UEFI, problema a fost rezolvat\u0103, dar multe dispozitive utilizate continu\u0103 s\u0103 opereze cu versiuni vulnerabile de firmware.

\"A<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost descoperit bootkit-ul UEFI Bootkitty, care injecteaz\u0103 cod mali\u021bios \u00een nucleul Linux la \u00eenc\u0103rcare | ProHoster","description":"Cercet\u0103torii de la ESET au descoperit un nou bootkit \"Bootkitty\", instalat dup\u0103 compromiterea sistemului, \u00een locul \u00eenc\u0103rc\u0103torului GRUB \u0219i utilizat pentru a introduce componente mali\u021bioase \u00een nucleul Linux, care apoi permit.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}