{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"U zbulua UEFI bootkit Bootkitty, q\u00eb fut kod t\u00eb keq n\u00eb b\u00ebrtham\u00ebn e ngarkuar Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga kompania ESET zbuluan nj\u00eb bootkit t\u00eb ri \"Bootkitty\", i instaluar pas hackimit t\u00eb sistemit n\u00eb vend t\u00eb ngarkuesit GRUB dhe i p\u00ebrdorur p\u00ebr t\u00eb futur p\u00ebrb\u00ebr\u00ebs t\u00eb d\u00ebmsh\u00ebm n\u00eb b\u00ebrtham\u00ebn Linux, t\u00eb cilat m\u00eb pas lejojn\u00eb sulmuesin t\u00eb kontrolloj\u00eb fshehurazi sistemin dhe t\u00eb kryej\u00eb veprimet e tij aty. Kjo thuhet se \u00ebsht\u00eb bootkiti i par\u00eb UEFI q\u00eb synon t\u00eb d\u00ebmtoj\u00eb sistemet Linux. <\/p>\n

Bootkitty vendoset n\u00eb skedarin grubx64.efi n\u00eb nj\u00ebsin\u00eb EFI (EFI system partition, \/boot\/efi\/EFI\/ubuntu) n\u00eb vend t\u00eb ngarkuesit standard GRUB. Pas aktivizimit nga firmueri UEFI, bootkiti ngarkon n\u00eb memorie ngarkuesin real GRUB2 dhe b\u00ebn ndryshime n\u00eb kodin e vendosur n\u00eb memorie t\u00eb GRUB2 q\u00eb \u00e7aktivizojn\u00eb verifikimin e integritetit t\u00eb p\u00ebrb\u00ebr\u00ebsve q\u00eb do t\u00eb ngarkohen m\u00eb von\u00eb, si dhe shton nj\u00eb trajtues q\u00eb thirret pas ekstraktimit t\u00eb imazhit t\u00eb b\u00ebrtham\u00ebs Linux n\u00eb memorie. Ky trajtues b\u00ebn ndryshime n\u00eb funksionet e ngarkuara n\u00eb memorie t\u00eb b\u00ebrtham\u00ebs (\u00e7aktivizon verifikimin e moduleve me n\u00ebnshkrim digjital), si dhe ndryshon vargun e nisjes s\u00eb procesit t\u00eb inicializimit nga \"\/init\" n\u00eb \"LD_PRELOAD=\/opt\/injector.so \/init\". <\/p>\n

Biblioteka injector.so kap disa operacione t\u00eb SELinux dhe funksionin init_module, i cili p\u00ebrdoret m\u00eb pas p\u00ebr t\u00eb ngarkuar modulimin e b\u00ebrtham\u00ebs \/opt\/dropper.ko. Moduli i b\u00ebrtham\u00ebs dropper.ko krijon dhe ekzekuton nj\u00eb skedar ekzekutiv \/opt\/observer, dhe m\u00eb pas e fsheh veten n\u00eb list\u00ebn e moduleve t\u00eb b\u00ebrtham\u00ebs dhe vendos trajtime p\u00ebr thirrje sistemike, si getdents dhe tcp4_seq_show, p\u00ebr t\u00eb fshehur skedarin \/opt\/observer dhe nj\u00eb pjes\u00eb t\u00eb trafikut rrjet. Skedari ekzekutiv \/opt\/observer ngarkon modulimin e b\u00ebrtham\u00ebs \/opt\/rootkit_loader.ko, i cili \u00ebsht\u00eb ngarkuesi i rootkit-it \/opt\/rootkit.

\"U<\/center> <\/p>\n

P\u00ebr t\u00eb instaluar bootkitin k\u00ebrkohet qasje e privilegjuar n\u00eb sistem dhe zakonisht k\u00ebto lloje t\u00eb malware p\u00ebrdoren nga sulmuesit pas nj\u00eb thyerje t\u00eb suksesshme ose kompromitimi t\u00eb sistemit p\u00ebr t\u00eb konsoliduar pranin\u00eb e tyre t\u00eb m\u00ebtejshme dhe p\u00ebr t\u00eb fshehur aktivitetin e tyre t\u00eb d\u00ebmsh\u00ebm.Biblioteka injector.so dhe modulat e d\u00ebmshme t\u00eb b\u00ebrtham\u00ebs vendosen n\u00eb imazhin e diskut RAM fillestar ose sistemin e skedar\u00ebve nga sulmuesi. Ngarkuesi grubx64.efi vendoset n\u00eb seksionin e skedar\u00ebve p\u00ebr UEFI. <\/p>\n

N\u00eb variantin e Bootkitty-t q\u00eb ra n\u00eb duar t\u00eb k\u00ebrkuesve, modifikimi i funksioneve n\u00eb memorje t\u00eb b\u00ebrtham\u00ebs u realizua n\u00eb offset-e t\u00eb paracaktuara pa verifikimin e sakt\u00ebsis\u00eb s\u00eb k\u00ebtyre offset-eve p\u00ebr versionin e ngarkuar t\u00eb b\u00ebrtham\u00ebs. Offsetet e p\u00ebrdorura n\u00eb Bootkitty ishin t\u00eb aplikueshme vet\u00ebm p\u00ebr versionet e b\u00ebrtham\u00ebs dhe GRUB q\u00eb ishin ofruar n\u00eb disa shp\u00ebrndarje t\u00eb Ubuntu, nd\u00ebrsa n\u00eb sistemet e tjera \u00e7onin n\u00eb d\u00ebshtimin gjat\u00eb ngarkimit. P\u00ebr verifikimin e ngarkuesit Bootkitty (grubx64.efi) u p\u00ebrdor nj\u00eb certifikat\u00eb e vet\u00eb-n\u00ebnshkruar, q\u00eb e b\u00ebnte t\u00eb pamundur p\u00ebrdorimin e bootkit-it n\u00eb sistemet me m\u00ebnyr\u00ebn UEFI Secure Boot t\u00eb aktivizuar pa instaluar certifikat\u00ebn e sulmuesit n\u00eb list\u00ebn e certifikatave t\u00eb besueshme n\u00eb UEFI. K\u00ebto ve\u00e7ori nxit\u00ebn k\u00ebrkuesit t\u00eb mendojn\u00eb se Bootkitty \u00ebsht\u00eb thjesht nj\u00eb prototip bootkit, ende i pap\u00ebrdorur p\u00ebr sulme reale. <\/p>\n

Pas shqyrtimit t\u00eb informacionit t\u00eb publikuar nga ESET, k\u00ebrkuesit nga Binarly Research vun\u00eb re midis artefakteve t\u00eb lidhura me Bootkitty imazhe BMP, t\u00eb p\u00ebrdorura p\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb LogoFAIL, e cila lejon ekzekutimin e kodit n\u00eb nivelin e firmware-it UEFI dhe evitimin e mekanizmit UEFI Secure Boot. N\u00eb kontekstin e Bootkitty, shfryt\u00ebzimi i dob\u00ebsis\u00eb LogoFAIL u p\u00ebrdor p\u00ebr t\u00eb shtuar n\u00eb list\u00ebn e certifikatave t\u00eb miratuara UEFI nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar nga sulmuesi, me t\u00eb cil\u00ebn u n\u00ebnshkrua ngarkuesi i bootkit-it grubx64.efi, q\u00eb lejonte q\u00eb bootkiti t\u00eb niste n\u00eb sistemet me UEFI Secure Boot aktiv pa e shtuar certifikat\u00ebn manualisht. <\/p>\n

Sulmi realizohet p\u00ebrmes vendosjes n\u00eb seksionin ESP (EFI System Partition) t\u00eb nj\u00eb imazhi t\u00eb strukturuar posa\u00e7\u00ebrisht n\u00eb formatin BMP p\u00ebr t'u shfaqur nga firmware UEFI si logotip i prodhuesit. P\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb bibliotekave t\u00eb ndjeshme n\u00eb firmware-t UEFI p\u00ebr t\u00eb punuar me imazhet, p\u00ebrpunimi i imazhit t\u00eb strukturuar posa\u00e7\u00ebrisht mund t\u00eb shkaktoj\u00eb mbipopullimin e memories dhe ekzekutimin e kodit me privilegjet e firmware-it UEFI. Dob\u00ebsia LogoFAIL u identifikua nj\u00eb vit m\u00eb par\u00eb dhe prekte firmware UEFI, p\u00ebrfshir\u00eb ato t\u00eb p\u00ebrdorura n\u00eb laptop\u00ebt Acer, HP, Fujitsu dhe Lenovo. N\u00eb versionet e reja t\u00eb firmware-eve UEFI problemi \u00ebsht\u00eb zgjidhur, por shum\u00eb pajisje t\u00eb zakonshme vazhdojn\u00eb t\u00eb funksionojn\u00eb me versione t\u00eb ndjeshme t\u00eb firmware-it.

\"U<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Zbulimi i UEFI-bootkit Bootkitty, i cili fut kod t\u00eb d\u00ebmsh\u00ebm n\u00eb b\u00ebrtham\u00ebn e ngarkuar Linux | ProHoster","description":"K\u00ebrkuesit nga kompania ESET zbuluan nj\u00eb bootkit t\u00eb ri \"Bootkitty\", i cili instalohet pas hakerimit t\u00eb sistemit n\u00eb vend t\u00eb ngarkuesit GRUB dhe p\u00ebrdoret p\u00ebr t\u00eb futur komponent\u00eb t\u00eb d\u00ebmsh\u00ebm n\u00eb b\u00ebrtham\u00ebn Linux, t\u00eb cil\u00ebt m\u00eb pas lejojn\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}