{"id":120801,"date":"2024-12-01T03:46:13","date_gmt":"2024-12-01T01:46:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux"},"modified":"2024-12-01T03:46:13","modified_gmt":"2024-12-01T01:46:16","slug":"vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","title":{"rendered":"UEFI-bootkit Bootkitty har identifierats, som injicerar skadlig kod i den laddade Linux-k\u00e4rnan.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare fr\u00e5n f\u00f6retaget ESET har identifierat en ny bootkit kallad «Bootkitty», som installeras efter att systemet har hacks och ers\u00e4tter GRUB-laddaren. Den anv\u00e4nds f\u00f6r att injicera skadliga komponenter i Linux-k\u00e4rnan, vilket g\u00f6r att angriparen kan d\u00f6lja och kontrollera systemet samt utf\u00f6ra \u00e5tg\u00e4rder. Det p\u00e5st\u00e5s vara den f\u00f6rsta UEFI-bootkit riktad mot Linux-system. <\/p>\n

Bootkitty placeras i filen grubx64.efi i EFI-systempartitionen (EFI system partition, \/boot\/efi\/EFI\/ubuntu) ist\u00e4llet f\u00f6r den vanliga GRUB-laddaren. Efter aktivering av UEFI-firmware laddar bootkiten den verkliga GRUB2-laddaren i minnet och g\u00f6r \u00e4ndringar i koden f\u00f6r GRUB2 som \u00e4r placerad i minnet. Dessa \u00e4ndringar inaktiverar integritetskontrollen av de komponenter som laddas senare och l\u00e4gger till en hanterare som anropas efter att Linux-k\u00e4rnans bild har packats upp i minnet. Den angivna hanteraren g\u00f6r \u00e4ndringar i de funktioner som har laddats i minnet av k\u00e4rnan (inaktiverar kontrollen av moduler med digital signatur) samt \u00e4ndrar startstr\u00e4ngen f\u00f6r init-processen fr\u00e5n « \/init » till « LD_PRELOAD=\/opt\/injector.so \/init) ». <\/p>\n

Biblioteket injector.so f\u00e5ngar upp vissa SELinux-operationer och funktionen init_module, som sedan anv\u00e4nds f\u00f6r att ladda k\u00e4rnmodulen \\\/opt\\\/dropper.ko. K\u00e4rnmodulen dropper.ko skapar och k\u00f6r en exekverbar fil \\\/opt\\\/observer, d\u00f6ljer sig sedan i listan \u00f6ver k\u00e4rnmoduler och st\u00e4ller in hanterare f\u00f6r systemanrop, s\u00e5som getdents och tcp4_seq_show, f\u00f6r att d\u00f6lja filen \\\/opt\\\/observer och viss n\u00e4tverkstrafik. Den exekverbara filen \\\/opt\\\/observer laddar k\u00e4rnmodulen \\\/opt\\\/rootkit_loader.ko, som \u00e4r en laddare f\u00f6r rootkit \\\/opt\\\/rootkit.

\"UEFI-bootkit<\/center> <\/p>\n

F\u00f6r att installera bootkit kr\u00e4vs privilegierad \u00e5tkomst till systemet och s\u00e5dana typer av skadlig programvara anv\u00e4nds vanligtvis av angripare efter ett framg\u00e5ngsrikt intr\u00e5ng eller kompromiss av systemet f\u00f6r att s\u00e4kra sin framtida n\u00e4rvaro och d\u00f6lja sin skadliga aktivitet. Biblioteket injector.so och de skadliga k\u00e4rnmodulerna placeras i en bild av den initiala RAM-diskarna eller filsystemet av angriparen. Laddaren grubx64.efi placeras i partitionen med filer f\u00f6r UEFI. <\/p>\n

I Bootkitty-versionen som f\u00f6ll i forskarnas h\u00e4nder modifierades funktioner i k\u00e4rnans minne enligt f\u00f6rutbest\u00e4mda f\u00f6rskjutningar utan att kontrollera korrektheten av dessa f\u00f6rskjutningar f\u00f6r den inl\u00e4sta k\u00e4rnversionen. De f\u00f6rskjutningar som anv\u00e4ndes i Bootkitty var endast till\u00e4mpliga p\u00e5 k\u00e4rnversioner och GRUB som tillhandah\u00f6lls i vissa Ubuntu-utg\u00e5vor, medan de i andra system ledde till misslyckad start. F\u00f6r att verifiera Bootkitty-laddaren (grubx64.efi) anv\u00e4ndes ett sj\u00e4lvsignerat certifikat, vilket hindrade anv\u00e4ndningen av bootkit p\u00e5 system med aktiverad UEFI Secure Boot utan att angriparens certifikat lades till i listan med betrodda certifikat i UEFI. Dessa egenskaper fick forskarna att tro att Bootkitty bara \u00e4r en prototyp av ett bootkit och fortfarande inte anv\u00e4nds f\u00f6r verkliga attacker. <\/p>\n

Genom att studera den publicerade informationen fr\u00e5n ESET m\u00e4rkte forskare fr\u00e5n f\u00f6retaget Binarly Research bland de artefakter som \u00e4r relaterade till Bootkitty BMP-bilder som anv\u00e4nds f\u00f6r att utnyttja s\u00e5rbarheten LogoFAIL, vilket m\u00f6jligg\u00f6r k\u00f6rning av kod p\u00e5 UEFI-firmware och kringg\u00e5r mekanismen UEFI Secure Boot. I Bootkitty-kontxtet anv\u00e4ndes utnyttjandet av s\u00e5rbarheten LogoFAIL f\u00f6r att l\u00e4gga till ett sj\u00e4lvsignerat certifikat fr\u00e5n angriparen, som signerade bootkit-laddaren grubx64.efi, i den godk\u00e4nda certifikatlistan f\u00f6r UEFI, vilket m\u00f6jliggjorde k\u00f6rning av bootkit p\u00e5 system med aktiv UEFI Secure Boot utan att certifikatet beh\u00f6vde l\u00e4ggas till manuellt. <\/p>\n

Attacken genomf\u00f6rs genom att placera en specialdesignad BMP-bild i ESP-delen (EFI System Partition) f\u00f6r att visa den av UEFI-firmware som tillverkarens logotyp. P\u00e5 grund av anv\u00e4ndningen av s\u00e5rbara bibliotek f\u00f6r bilder i UEFI-firmware kan behandlingen av den specialdesignade bilden leda till ett buffert\u00f6verfl\u00f6de och exekvering av kod med UEFI-firmwareprivilegier. S\u00e5rbarheten LogoFAIL identifierades f\u00f6r ett \u00e5r sedan och ber\u00f6rde UEFI-firmware som bland annat anv\u00e4ndes p\u00e5 b\u00e4rbara datorer fr\u00e5n Acer, HP, Fujitsu och Lenovo. I nya versioner av UEFI-firmware har problemet \u00e5tg\u00e4rdats, men m\u00e5nga enheter som fortfarande \u00e4r i bruk forts\u00e4tter att fungera med s\u00e5rbara firmwareversioner.

\"UEFI-bootkit<\/center>
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 «Bootkitty», \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u043a\u0440\u044b\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432 \u043d\u0435\u0439 \u0441\u0432\u043e\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 UEFI-\u0431\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c Linux. Bootkitty \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0435 grubx64.efi \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120802,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bootkitty UEFI-bootkit har identifierats, som injicerar skadlig kod i det laddade Linux-k\u00e4rnan | ProHoster","description":"Forskare fr\u00e5n f\u00f6retaget ESET har identifierat ett nytt bootkit \"Bootkitty\", som installeras efter att systemet har hackats ist\u00e4llet f\u00f6r GRUB-laddaren och anv\u00e4nds f\u00f6r att infoga skadliga komponenter i Linux-k\u00e4rnan, vilket sedan m\u00f6jligg\u00f6r.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d UEFI-\u0431\u0443\u0442\u043a\u0438\u0442 Bootkitty, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0435 \u044f\u0434\u0440\u043e Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u0443\u0442\u043a\u0438\u0442 "Bootkitty", \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 GRUB \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432 \u044f\u0434\u0440\u043e Linux \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/vyyavlen-uefi-butkit-bootkitty-podstavlyayushhij-vredonosnyj-kod-v-zagruzhaemoe-yadro-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-01T01:46:16+00:00","article:modified_time":"2024-12-01T01:46:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120801","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:28:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:28:23","updated":"2026-01-23 08:28:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=120801"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120801\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/120802"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=120801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=120801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=120801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}