Bootkitty - The First UEFI Bootkit That Targets Linux

[@ryanspaceYT]

Temple os remains unaffected

[@NotHereLookAway]

the true temple of the mind (the scitzoid mind )

[@snowflakemelter7171]

The only 2 users of temple OS can breath a sigh of relief now.

[@buckbreaker5185]

​@snowflakemelter7171 >he doesn't use Temple OS as a daily driver Couldn't be me.

[@LinetteTheAsset]

AMEN BROTHER 🐘

[@xlmao]

if you trust nobody, not even your shadow, nobody, I REPEAT, nobody can trick you

[@rayaanansari4834]

Are we not going to talk about the fact that they got 3rd place and only $100 for this?

[@ASTH-yf9uu]

For real, these competitions are just to steal from the winner

[@aahh437]

wtf, no way

[@TheVexCortex]

I wanted to see what earned first and second place... Can't find anything about the program...

[@huuhhhhhhh]

FFS

[@real_xijinping]

​@@TheVexCortexProbably just some crap "AI" model stole from GitHub. I've attended a number of hackthon and most of them are just shameless bullshitting competitions.

[@megadjc192]

This isn't really a linux security issue but a generic security flaw in the uefi that has already been patched for a large number of systems. So this is nothing new. I think the more subtle point of this video is more about linux not being inherently more secure than windows if precautions aren't taken and vigilance not maintained.

[@dont.beknown5622]

I'm still confused on how you would "accidentally" get this onto your system. Most of the security issues require some pretty stupid actions on the part of the user - or physical access to the machine.

[@gramfero]

​@@dont.beknown5622the least secure part of any computer is usually sitting between the screen and the chair

[@mz00956]

​@@dont.beknown5622 Never underestimate the capabilities of the security problem 30cm infront of the screen

[@gurbuz12345]

@@dont.beknown5622 Simple, you can install it as a "software" from outside/user repos.

[@ThatYahoo]

@@dont.beknown5622 Have you heard of an Evil Maid Attack?

[@augustday9483]

As Linux continues to gain popularity for desktop use, I anticipate we'll start to see more genuine malware targeting common distros. Suffering from success.

[@Amaling]

Luckily by then I will be using my own abomination fork of my common distro of choice in the future

[@DreadHalfling9]

​@@Amaling and its gonna be more secure? 😅

[@iamwitchergeraltofrivia9670]

@@augustday9483 or buying amd cpu is more secure on linux with Memory encryption

[@boatunsold]

that's when we are moving to bsd and haiku

[@rogerss1]

Anyone who leaves systemd vulnerabilities in place deserves what they will get.

[@pommy_the_mimic]

Actually, this could be quite useful. I have some old cisco servers that refuse to boot because they don't have a good signature and it's impossible to turn off secure boot (thanks cisco). This is intentional and is confirmed on their forums. I'd really like to bypass secure boot somehow and use these servers some day

[@ferecece]

yep, kinda like mtkclient

[@christopherg2347]

Jailbreak your Ciscos?

[@kstergiou3]

Get them cisco bastards

[@Raspredval1337]

based malware 😎

[@ShirokoCycling]

@@pommy_the_mimic Cisco SUCKS! I'm glad EFI secure boot is being researched like this, we need to be able to bypass secure boot on the upcoming Windows 365 Link device.

[@t74devkw]

Legacy BIOS gang, how we doing? 😎

[@idkwhatwritehere000]

please just give me some money

[@ShirokoCycling]

i7-980X! Still alive.

[@chucky29949]

We chillin :)

[@nxx99]

Fine, brother!

[@Pepo..]

gotta patch it ourselves.

[@lambchomp1472]

Using Secure Boot with Nvidia and other propriety drivers can be a PITA, so most people don't use it to begin with. A lot of Linux users are vulnerable to this type of attack.

[@jeverett0902]

Signed Nvidia drivers are pretty sweet in Fedora 41, finally.

[@unconnectedbedna]

1. I patched my system IMMEDIATELY in Januari of 2024 2. The img in my boot sequence is disabled. I think I'm good...

[@dnman192]

​@marbens I haven't got around to doing on my Lenovo laptop because I'd have to reinstall Windows again. It's almost like Windows is more secure than Linux in this area unless you spend a lot of effort.

[@andmoreagain]

i hate AI generated images so much its unreal

[@Rolandfart]

well with the release of sora you'll be watching ai generated videos from now on! A whole new dimension of uncanny!

[@SockTaters]

Same. Why not draw a pretty little picture? Doesn't even have to look good, just not nauseate the audience like AI crap

[@bacalhau_seco]

same

[@inverlock]

@@SockTaters agree. shitty mspaint is way more entertaining and endearing than ai images.

[@halfsine]

what? you're telling me that you don't like art being replaced with soulless images generated by an ai? how dare you!

[@jordanmatthew6315]

Bruh, when i have my x86 assembly book, still with me from uni, and hearing about this; it is insane how small memory reallocation is needed to fool certificates. Holy shit, wow.

[@TibAverus]

Not even IF, but WHEN this gets more popular, this will be an absolute nightmare to deal with for a lot of people.

[@Dave_Parrott]

I give it a week.

[@ASTH-yf9uu]

They will hotfix the bmp lib and it will be over, I hope

[@PtolemyPetrie]

You can just clear the CMOS jumper and or pull the CMOS battery to restore the firmware, it's not that serious.

[@nadtz]

@@PtolemyPetrie I hope this is a troll post.

[@odnx]

im still using an asrock am4 board from 2018 that already patched logofail in january

[@Chuck8541]

Geez. I'm gonna go back to filing cabinets, and cathode ray tube televisions. Life was easy.

[@prophetzarquon]

My IBM PS/2 286 still works great

[@contradictorycrow4327]

How will you get the data onto paper? Printer spool virus vulnerability?

[@RossBradley-vd5rc]

@@contradictorycrow4327 Type writter

[@szaszm_]

Feels like a nothingburger. LogoFAIL is a previous vulnerability, and as soon as you have rights to install a new bootloader AND you can enroll keys, all bets are off. Reminder, that you need to execute code as root to exploit logofail and install a new bootloader. It's almost like saying if you exploit dirtycow to gain root on systems still vulnerable, then you can run arbitrary code as root on the system. It's a good demo of existing techniques, but no new revolutionary technique was used, just a clever combination.

[@kazii_the_avali]

this being said as linux becomes more popular more idiots are gonna start sudoing at every little thing. it is deffently good to know. and mother board manufacturers are not always super clear. ive seen a few asus bios updates that say "we fixed logofail" but some that doesnt say anything about logofail at all (including mine ROG STRIX B450-F GAMING.)

[@diego5733]

Exactly my thoughts.

[@CryptoSymposium]

My brain can identify bot comments and it won’t even let me look at them it’s just auto skips them

[@polandman07]

Good skill to have nowadays

[@VolkTikhon]

@@polandman07 Dystopian as fu

[@FuckFistingAss7osuFF7osu]

ai generated cat laptop.jpeg

[@ThePlayerOfGames]

Ewww

[@systemofapwne]

Thanks for this excellent video. That's why I have SecureBoot with my own PlatformKey enrolled and latest firmware installed to mitigate logofail. Yet, it absolutely does not invalidates the point that UEFI opens an unnecessary attack vector.

[@unconnectedbedna]

I didn't deep dive in this, but isn't the point of this malware to overwrite keys? Protection for this is to implement the LogoFAIL security patch for your mobo, that was most likely issued at the start of 2024.

[@TruthDoesNotExist]

oh god the comment section is already filled with bots

[@turanamo]

yeah, lots of temple os bots and ai is bad muppets

[@filthyfrankblack4067]

(points guun) "Always has been."

[@collectorguy3919]

Updating your firmware via fwupdmgr often doesn't have the latest from the manufacturer. LVFS works best when manufacturers use it, but when they don't it can give a false sense of security. I've had to boot Windows just to update the firmware for both Lenovo and HP.

[@unconnectedbedna]

I bumped into that problem (on HP G1 IIRC). You needed a win install to create the update usb or some dumb stuff like that on an old HP. I solved it by installing a virtual linux machine and run the HP-bios "create usb stick .exe" there, and it worked. (I tried doing it with wine, but with no success) But I DO remember faceslapping that they only released for windows this way. But FYI, you only need a virtual machine to create the update media, not a bare metal install. Can be done from another machine, the vm does NOT have be ran on the machine you want to update bios on. On newer HP machines, you can update the bios via internet directly in BIOS by just connecting a physical lan cable with access to the internet.

[@ssokolow]

@@unconnectedbedna *nod* The fact that ASRock offers a "BIOS ROM in a Zip file" download is one of the contributing factors to my decision to build my latest Linux box around one of their boards about a year ago.

[@user-fl4ug1nc1u]

can't believe youtube shadow banned this video for 1 minute...

[@SockTaters]

How do you determine if a video is shadow banned?

[@Foxyy01]

​@@SockTatersits a joke

[@PieyIsAPie]

​@@SockTaters r/woooosh

[@kjullthedemon]

@@Foxyy01 I don't get it either.

[@BusinessWolf1]

It was not, look into how yt comment processing looks for the first few mins after upload

[@snap_oversteer]

coreboot chads keep winning

[@darukutsu]

wish more laptops came with it ootb

[@vicstoron]

@@darukutsu same, we need more stuff like system76

[@marsovac]

Then you would have more people targeting coreboot, and CVEs filed for that. What is the most used is the most targeted.

[@RetroDelete]

Yeah, wish more laptops had coreboot support. Only device I have that supports coreboot is my ThinkPad T530, which I installed coreboot with tianocore on, quite nice to use!

[@thatoneannoyingtornadosire8755]

​@@RetroDeleteThinkPad bros just keep winning

[@illogicmath]

To be or not to be a bot. This is the question

[@BsktImp]

Predicted ages ago that, with the likely exodus from Microsoft Windows to Linux as Win10 support nears EoL, hackers and malware makers will exploit the vulnerabilities in Linux on a scale never seen.

[@kayatichopper]

took a very big poo earlier, not feeling good.

[@stefanjones8042]

You need a bigger one

[@TornadoSwoop]

i cant blee

[@kayatichopper]

​@@stefanjones8042 i'm getting there..

[@dry-bones]

Working on one right now

[@Foxyy01]

Keep us updated

[@RecoveringFpsJunkie]

Logofail has been patched already. This would only affect any system that hasn't done the security update.

[@tanall5959]

The problem is that patching Logofail requires a UEFI firmware flash. Which, even if you do everything exactly correctly, still has a decent chance of bricking your motherboard. Attempting to flash my old system to fix this is what lead me to my most recent system build :P

[@Pro_Triforcer]

How often do you update your bios? Most people don't. Most people don't even know what that is. It's usually not even recommended to update bios, despite the possibility of security patches.

[@justminibanana9128]

The last bios update made for my system was 2018 mann.

[@kunka592]

Assuming a lot of systems with this vulnerability will ever get another UEFI update.

[@HIDLad001]

@@Pro_Triforcer Windows automatically includes BIOS updates with Windows Update, so probably more often than you think.

[@dreamhollow]

Dude there are so many bots in the comments.

[@snowflakemelter7171]

Dead Internet theory becomes more believable every day.

[@nuclearicebreaker]

I dunno some dude was telling us about the dump he took I dont think there's a bot that does that

[@sayorancode]

@@nuclearicebreaker i could swear, these bots are getting more advanced by the day!

[@interstellarsurfer]

So says the guy with the Ukraine-ish avatar. 👏😉

[@cieplydran1]

​@@interstellarsurferSo if someone has yellow and blue in their pfp they are a bot?

[@giridharpavan1592]

this is how skynut is formed

[@witness1013]

has already been released as BootyKitty

[@Linkman8912]

I'm really curious as to what the image at 1:00 is supposed to be, it appears to be a cat with its paws on a laptop, but the laptop has a macropad instead of a trackpad?

[@ciberkid22]

All I know is that its most likely AI Generated

[@OhhCrapGuy]

It's AI generated trash used by someone who doesn't understand they shouldn't be using that crap.

[@Linkman8912]

@@OhhCrapGuy I know it's ai generated, I'm curious what sort of prompt you would have to use to get that nightmarish of an image

[@samuelmatheson9655]

Absolutly horrifying (5 years ago)

[@jonas314ano]

4:29 say that again

[@max373-1.0]

GET OUT OF MY HEAD

[@pecopeco2815]

LINUX TUAH

[@Ciapulek0165]

​@@pecopeco2815Tux Tuah, sudo on that thang

[@kodirovsshik]

what

[@noranoxica]

00:30 when a kitty cats

[@RafidW9]

This is why you run TempleOS

[@unconnectedbedna]

Wtih pissandshittium (google that and look for the ghub) as web browser right?

[@brawldude2656]

God protect us✊🙏🙏

[@DarkF00L]

This is why tools such as a Librem Key are important. If your system changes it changes the code. If your boot code doesn't match with the Librem Key code, it will notify you that something changed within the UEFI/TPM/Bitlocker, etc. If you made the change, update the code. If not, factory reset everything.

[@madrox1989]

Awesome overview, and kudos for prompting folks to patch!

[@KomiyanVT]

What about disabling the splash screen, opting for the POST text instead? If I remember correctly, this was a way to mitigate the image vulnerability by not loading one at all...

[@toorhideor8866]

been a dev for 10 years and kept my head in the computer for 20 years and i've never done one single bios update :)) always been scared of bricking the computer

[@unconnectedbedna]

If I were you I would keep that to myself unless I want to ridicule myself as a "dev". Being an insecure entrypoint to any project you work on is probably something you want to keep your mouth shut about. You are quite literally a risk to work with.

[@F.M671]

@@unconnectedbedna You're acting as if the majority of IT workers practice common sense cysec. They don't

[@josemcgomes]

@@unconnectedbedna Any company worth their salt has MDM software that prevents this. Plus, keeping quiet is the worst possible thing you can do. We all make mistakes, the sooner we admit them, the sooner we can fix them. I'd rather hear the security team at my workplace say they missed something in their testing procedure than have a dev come up to them with that same problem because they decided to keep quiet.

[@starsiegeplayer]

The LogoFail vulnerability is a year old now. Haven't motherboard manufacturers released updated BIOS to fix it?

[@Xaito]

The real shocker was that they have a "best of the best" competition, still valuing excellence. Over here it feels like everybody gets a participation trophy.

[@reversetransistor4129]

Nice, same idea as tracking pics, but deeper in the system, nice work!

[@mikescholz6429]

That penguin pops back up like, I hope no one saw that lmao

[@SG_GLOBAL]

Still safer than Windows... Good Info, thanks for reporting this.

[@iamwitchergeraltofrivia9670]

No

[@SG_GLOBAL]

@iamwitchergeraltofrivia9670 Are you on of those Linux ully-Trolls or is there an intelligeable response to be made on your behalf?

[@salce_with_onion]

​@@SG_GLOBALLinux safer than Windows is like laughable statement. By that logic TempleOS is the most secure system. The most vulnerable link is always the user, and the more obscure and unknown OS the less chance user would be dumb in his actions.

[@SG_GLOBAL]

@@salce_with_onion Valid. OPSEC is the largest issue under todays survellience state.

[@ahmetrefikeryilmaz4432]

The footage of penguins throwing themselves from the cliff was masterfully put.

[@M-dv1yj]

My work is called unified emergent field theory. And I miss read you using that acronym 😂. I was like who made a booklet in my work. 😮‍💨

[@stage6fan475]

algorithm. Thanks for doing all the work to find, understand, and explain these events. Greatly appreciated!

[@DerekSmit]

I once heard 1 out of 3 comments is by a bot, but this comment section is more like 9/3 comments is by a bot!

[@marklundeberg7006]

BMP files are actually often compressed. Run length encoding, the lowest form of compression (bad but helps a lot for a small logo on a black background).

[@JimBob1937]

Yeah, he likely meant that BMP are lossless, rather than lossy. People usually refer to lossless as uncompressed, even if reversible binary compression techniques are used.

[@JamaicaWhiteMan]

All I know is that everything I do on my Linux desktop takes half the time it did when I last used Windows, with no constant crashes of QGIS. As far as the bootkit goes, I'm sure it will be taken care of before I upgrade to the next version of Mint (22.1).

[@unconnectedbedna]

1. No software in userspace on EARTH can protect you from this. (there is absolutely nothing mint or any distro can do about this) 2. It already IS patched, in Januari of 2024. LogoFAIL firmware patch for your MOTHERBOARD.

[@Maritosu]

From the 💻Linux to the 🎋virus to the 🛤️UEFI to the 😺bootkitty🗣️🔥🔥🔥 wheres my 🏥Programmer always when my bios is broooookeeen💀

[@X-i_i-K]

1:01 the cat on the laptop is AI

[@brunodangelo1146]

You are clearly an AI bot

[@Web720]

No shit.

[@danielbaker1248]

You should do videos on how to patch these vulnerabilities as they come out.

[@Julio860JVL]

Attempt # 4. Trying to get your attention to check your microphone because your S letters sound like a sword cutting something.

[@Vilematrix]

Thanks for the explaination. I Can Now know for sure that I got 2 bootkits on 2 laptops of mine 😂

[@WorBlux]

firware updates applied, thanks for the reminder!

[@FriggnH8ters]

wtf are these comments

[@ArbyFyrelyte]

Joke is on ya'll, I disable fullscreen logo because I think the debug and boot information looks better

[@unconnectedbedna]

Joke's on me, I GET NO extra information by disabling it, just a black screen instead. xD Still disabled it when patching this security flaw in januari of this year though...

[@ArbyFyrelyte]

@@unconnectedbedna I mean yes I do too. But, I always did. I don't like other people's logos on the machine that I put together.

[@UsernameDoesntCare]

Gonna go make my own bootloader to btfo all malware by security by obscurity.

[@kneel1]

haha I was so mad when Gigabyte removed the ability to replace the Aorus logo, but they said it was a sec vuln

[@EdnovStormbrewer]

This method isn't old news. This bmp method was also used on older Sony PSP models as a viable way to jailbreak it.

[@ArthurTheEpicGuy]

The more popular the OS means more attacks on said OS.

[@MaskMajor]

Awww but it has such a cute name tho!!!

[@LouisSerieusement]

The best of the best is also a very fun and cheesy 80's karate movie x)

[@iosefka4567]

Hey Outlaw, does secure boot protect linux and do you recommend it? I ask because most distros don't support secure boot.

[@bcredeur97]

What if your old computer doesn’t get the update?

[@bananaman9869]

Logofail and now this, should’ve just listened to Luke Smith and use BIOS.

[@robotron1236]

I’m almost positive that he is luke smith. 😂

[@THEGOOD360]

I feel like we are on the verge of an internet dark age...

[@Z3r0Sk83r]

Master Boot Record mentioned.

[@ah-64apache84]

how would you go about recovering a compromised system???

[@D.von.N]

That interests me too... at worst send it to some specialist to flash the entire UEFI. I think Chernobyl did a similar thing. My mate had it back then. Nasty stuff.

[@kunka592]

Probably just a BIOS/UEFI flash.

It's been more than 10 years since I've seen something similar. But this still requires phisical access.

[@myhandleiswhat]

I half expect bootkitty to become a popular VTuber channel name and it'll completely drown out this entire discussion about this.

[@IlluminatiBG]

Sounds amazing. But how do you switch logo with the infected image without root access?

[@TILR]

so what happens if say the bios hasn't been updated from the motherboard manufacture since oh idk 2018

[@comradepeter87]

Don't most people keep secure boot off anyways in order to dual boot?

[@codemiesterbeats]

My grandma had a black cat named Boo and she often called it Boo Kitty.

[@guppy13]

how do you screw up something as trivial as a bmp decoder

[@xDMG15x]

How does the attacker get the bmp onto the flash chip or wherever the original boot logo lives?

[@misterholmes2758]

Could you make a video on your thoughts about SteamOS?

[@simonbackwash]

🐧Th penguin fall footage was rough ! 🐧🤕.

[@chrisn1847]

I have been working through Jon Ericsson’s book. The NOP sled seems to constantly fail due to stack canaries. You mentioned memory randomization not working, but are stack canaries not enabled when working at the point of bootup?

[@justinriley-l8o]

What do you think of Libreboot in 2024?

[@BenParkes-wz5bd]

As a person who uses inside h20 BIOS, this scared me a little bit cus my manufacturer doesn't provide new BIOS updates anymore

[@FebruaryWashington]

lmao same. really makes you feel like you're still using Windows XP after all this time!

[@dnman192]

7:40 And yet that's impossible to do w/o installing Windows first on my Lenovo laptop, genius.

[@alien76]

if all the small businesses would understand the scope of such vulnerabilities..

[@gabrielnilo6101]

so they discovered NSA toy and now it's going to be fixed in the future?

[@anonymoususer13666]

This is legitimately terrifying

[@HikaruAkitsuki]

So we have to be more careful on third party or unknown distro that does not supported by the community?

[@FranekMuschilek]

you could probably easily see if your system is infected by after setting up your OS directly making a clone of your MBR partition to an external drive and once in a while check bit for bit via a life linux if this is still the same as your MBR on the disk.

[@lavaos]

at least using this, we are able to understand how this could occur in the wild, and possibly the vulnerability can be patched up, right?

[@unconnectedbedna]

It was, in Januari 2024. LogoFAIL security patch for your mobo.

[@Foche_T._Schitt]

Jokes on them, I never figured out how to install an OS using UEFI.

[@いか-z4z1o]

how do you do fellow bots

[@zxGHOSTr]

You know how they say "enough internet for today"? Maybe we should skip internet for ever.

[@Merabbit]

Would the affect a type 1 hyper visor? Probably just the OS running on the bare metal?

[@alanonsr3942]

then all we got to do then is update the bios?

[@anti_globalista]

What would the path of infection be, how do they install it (if someone decides to use it non-ethically)?

[@LocalHost-p4x]

Im curious does it effect core boot do we have any info on that

[@random80085]

What if you disable the show boot logo in the uefi settings??

[@brentsaner]

UEFI doesn't *have* a Master Boot Record. It has an (or more than one) EFI System Partition.

[@Super61a]

so what do i do if im using 20 year old technology?

[@FlameForgedSoul]

Pray? Buy new gear? One of those.

[@Super61a]

@@FlameForgedSoul ibm is love, ibm is life.

[@interstellarsurfer]

​@@Super61aBest space heaters ever made. 👍

[@Compact-Disc_700mb]

@@FlameForgedSoul New stuff already has built in malware, intel me and amd psp. cell phones also have embedded malware.

[@Vidjnjsdnjk-en6tz]

@@Compact-Disc_700mb Why don't the feds use them then?

[@theloststarbounder]

if(image.width > 0 && image.height > 0) fixes it

[@hampocampo]

Does flashing the BIOS remove it?

[@MGunners9]

I am new to Linux, Fedora 41. How would I go about those updates you suggested? Many thanks

[@roccociccone597]

It is time for FreeBSD