Bootkitty - The First UEFI Bootkit That Targets Linux

[@ryanspaceYT]

Temple os remains unaffected

[@NotHereLookAway]

the true temple of the mind (the scitzoid mind )

[@snowflakemelter7171]

The only 2 users of temple OS can breath a sigh of relief now.

[@buckbreaker5185]

​@snowflakemelter7171 >he doesn't use Temple OS as a daily driver Couldn't be me.

[@LinetteTheAsset]

AMEN BROTHER 🐘

[@xlmao]

if you trust nobody, not even your shadow, nobody, I REPEAT, nobody can trick you

[@rayaanansari4834]

Are we not going to talk about the fact that they got 3rd place and only $100 for this?

[@ASTH-yf9uu]

For real, these competitions are just to steal from the winner

[@aahh437]

wtf, no way

[@TheVexCortex]

I wanted to see what earned first and second place... Can't find anything about the program...

[@huuhhhhhhh]

FFS

[@real_xijinping]

​@@TheVexCortexProbably just some crap "AI" model stole from GitHub. I've attended a number of hackthon and most of them are just shameless bullshitting competitions.

[@megadjc192]

This isn't really a linux security issue but a generic security flaw in the uefi that has already been patched for a large number of systems. So this is nothing new. I think the more subtle point of this video is more about linux not being inherently more secure than windows if precautions aren't taken and vigilance not maintained.

[@dont.beknown5622]

I'm still confused on how you would "accidentally" get this onto your system. Most of the security issues require some pretty stupid actions on the part of the user - or physical access to the machine.

[@gramfero]

​@@dont.beknown5622the least secure part of any computer is usually sitting between the screen and the chair

[@mz00956]

​@@dont.beknown5622 Never underestimate the capabilities of the security problem 30cm infront of the screen

[@gurbuz12345]

@@dont.beknown5622 Simple, you can install it as a "software" from outside/user repos.

[@ThatYahoo]

@@dont.beknown5622 Have you heard of an Evil Maid Attack?

[@augustday9483]

As Linux continues to gain popularity for desktop use, I anticipate we'll start to see more genuine malware targeting common distros. Suffering from success.

[@Amaling]

Luckily by then I will be using my own abomination fork of my common distro of choice in the future

[@DreadHalfling9]

​@@Amaling and its gonna be more secure? 😅

[@iamwitchergeraltofrivia9670]

@@augustday9483 or buying amd cpu is more secure on linux with Memory encryption

[@boatunsold]

that's when we are moving to bsd and haiku

[@rogerss1]

Anyone who leaves systemd vulnerabilities in place deserves what they will get.

[@pommy_the_mimic]

Actually, this could be quite useful. I have some old cisco servers that refuse to boot because they don't have a good signature and it's impossible to turn off secure boot (thanks cisco). This is intentional and is confirmed on their forums. I'd really like to bypass secure boot somehow and use these servers some day

[@ferecece]

yep, kinda like mtkclient

[@christopherg2347]

Jailbreak your Ciscos?

[@kstergiou3]

Get them cisco bastards

[@Raspredval1337]

based malware 😎

[@ShirokoCycling]

@@pommy_the_mimic Cisco SUCKS! I'm glad EFI secure boot is being researched like this, we need to be able to bypass secure boot on the upcoming Windows 365 Link device.

[@t74devkw]

Legacy BIOS gang, how we doing? 😎

[@idkwhatwritehere000]

please just give me some money

[@ShirokoCycling]

i7-980X! Still alive.

[@chucky29949]

We chillin :)

[@nxx99]

Fine, brother!

[@Pepo..]

gotta patch it ourselves.

[@andmoreagain]

i hate AI generated images so much its unreal

[@Rolandfart]

well with the release of sora you'll be watching ai generated videos from now on! A whole new dimension of uncanny!

[@SockTaters]

Same. Why not draw a pretty little picture? Doesn't even have to look good, just not nauseate the audience like AI crap

[@bacalhau_seco]

same

[@inverlock]

@@SockTaters agree. shitty mspaint is way more entertaining and endearing than ai images.

[@halfsine]

what? you're telling me that you don't like art being replaced with soulless images generated by an ai? how dare you!

[@lambchomp1472]

Using Secure Boot with Nvidia and other propriety drivers can be a PITA, so most people don't use it to begin with. A lot of Linux users are vulnerable to this type of attack.

[@marbens]

Unless they actually update their UEFI to patch LOGOFAIL.

[@jeverett0902]

Signed Nvidia drivers are pretty sweet in Fedora 41, finally.

[@unconnectedbedna]

1. I patched my system IMMEDIATELY in Januari of 2024 2. The img in my boot sequence is disabled. I think I'm good...

[@alfos.192]

​@@marbens I haven't got around to doing on my Lenovo laptop because I'd have to reinstall Windows again. It's almost like Windows is more secure than Linux in this area unless you spend a lot of effort.

[@TibAverus]

Not even IF, but WHEN this gets more popular, this will be an absolute nightmare to deal with for a lot of people.

[@Dave_Parrott]

I give it a week.

[@ASTH-yf9uu]

They will hotfix the bmp lib and it will be over, I hope

[@PtolemyPetrie]

You can just clear the CMOS jumper and or pull the CMOS battery to restore the firmware, it's not that serious.

[@nadtz]

@@PtolemyPetrie I hope this is a troll post.

[@odnx]

im still using an asrock am4 board from 2018 that already patched logofail in january

[@jordanmatthew6315]

Bruh, when i have my x86 assembly book, still with me from uni, and hearing about this; it is insane how small memory reallocation is needed to fool certificates. Holy shit, wow.

[@szaszm_]

Feels like a nothingburger. LogoFAIL is a previous vulnerability, and as soon as you have rights to install a new bootloader AND you can enroll keys, all bets are off. Reminder, that you need to execute code as root to exploit logofail and install a new bootloader. It's almost like saying if you exploit dirtycow to gain root on systems still vulnerable, then you can run arbitrary code as root on the system. It's a good demo of existing techniques, but no new revolutionary technique was used, just a clever combination.

[@kazii_the_avali]

this being said as linux becomes more popular more idiots are gonna start sudoing at every little thing. it is deffently good to know. and mother board manufacturers are not always super clear. ive seen a few asus bios updates that say "we fixed logofail" but some that doesnt say anything about logofail at all (including mine ROG STRIX B450-F GAMING.)

[@user-fl4ug1nc1u]

can't believe youtube shadow banned this video for 1 minute...

[@SockTaters]

How do you determine if a video is shadow banned?

[@Foxyy01]

​@@SockTatersits a joke

[@PieyIsAPie]

​@@SockTaters r/woooosh

[@kjullthedemon]

@@Foxyy01 I don't get it either.

[@BusinessWolf1]

It was not, look into how yt comment processing looks for the first few mins after upload

[@Chuck8541]

Geez. I'm gonna go back to filing cabinets, and cathode ray tube televisions. Life was easy.

[@prophetzarquon]

My IBM PS/2 286 still works great

[@contradictorycrow4327]

How will you get the data onto paper? Printer spool virus vulnerability?

[@RossBradley-vd5rc]

@@contradictorycrow4327 Type writter

[@TruthDoesNotExist]

oh god the comment section is already filled with bots

[@turanamo]

yeah, lots of temple os bots and ai is bad muppets

[@kayatichopper]

took a very big poo earlier, not feeling good.

[@stefanjones8042]

You need a bigger one

[@iiiiiiiifiijfjfujgjugj]

i cant blee

[@kayatichopper]

​@@stefanjones8042 i'm getting there..

[@dry-bones]

Working on one right now

[@Foxyy01]

Keep us updated

[@systemofapwne]

Thanks for this excellent video. That's why I have SecureBoot with my own PlatformKey enrolled and latest firmware installed to mitigate logofail. Yet, it absolutely does not invalidates the point that UEFI opens an unnecessary attack vector.

[@unconnectedbedna]

I didn't deep dive in this, but isn't the point of this malware to overwrite keys? Protection for this is to implement the LogoFAIL security patch for your mobo, that was most likely issued at the start of 2024.

[@illogicmath]

To be or not to be a bot. This is the question

[@collectorguy3919]

Updating your firmware via fwupdmgr often doesn't have the latest from the manufacturer. LVFS works best when manufacturers use it, but when they don't it can give a false sense of security. I've had to boot Windows just to update the firmware for both Lenovo and HP.

[@unconnectedbedna]

I bumped into that problem (on HP G1 IIRC). You needed a win install to create the update usb or some dumb stuff like that on an old HP. I solved it by installing a virtual linux machine and run the HP-bios "create usb stick .exe" there, and it worked. (I tried doing it with wine, but with no success) But I DO remember faceslapping that they only released for windows this way. But FYI, you only need a virtual machine to create the update media, not a bare metal install. Can be done from another machine, the vm does NOT have be ran on the machine you want to update bios on. On newer HP machines, you can update the bios via internet directly in BIOS by just connecting a physical lan cable with access to the internet.

[@ssokolow]

@@unconnectedbedna *nod* The fact that ASRock offers a "BIOS ROM in a Zip file" download is one of the contributing factors to my decision to build my latest Linux box around one of their boards about a year ago.

[@CryptoSymposium]

My brain can identify bot comments and it won’t even let me look at them it’s just auto skips them

[@polandman07]

Good skill to have nowadays

[@VolkTikhon]

@@polandman07 Dystopian as fu

[@FuckFistingAss7osuFF7osu]

ai generated cat laptop.jpeg

[@ThePlayerOfGames]

Ewww

[@snap_oversteer]

coreboot chads keep winning

[@darukutsu]

wish more laptops came with it ootb

[@vicstoron]

@@darukutsu same, we need more stuff like system76

[@marsovac]

Then you would have more people targeting coreboot, and CVEs filed for that. What is the most used is the most targeted.

[@RetroDelete]

Yeah, wish more laptops had coreboot support. Only device I have that supports coreboot is my ThinkPad T530, which I installed coreboot with tianocore on, quite nice to use!

[@thatoneannoyingtornadosire8755]

​@@RetroDeleteThinkPad bros just keep winning

[@RecoveringFpsJunkie]

Logofail has been patched already. This would only affect any system that hasn't done the security update.

[@tanall5959]

The problem is that patching Logofail requires a UEFI firmware flash. Which, even if you do everything exactly correctly, still has a decent chance of bricking your motherboard. Attempting to flash my old system to fix this is what lead me to my most recent system build :P

[@Pro_Triforcer]

How often do you update your bios? Most people don't. Most people don't even know what that is. It's usually not even recommended to update bios, despite the possibility of security patches.

[@justminibanana9128]

The last bios update made for my system was 2018 mann.

[@kunka592]

Assuming a lot of systems with this vulnerability will ever get another UEFI update.

[@HIDLad001]

@@Pro_Triforcer Windows automatically includes BIOS updates with Windows Update, so probably more often than you think.

[@dreamhollow]

Dude there are so many bots in the comments.

[@snowflakemelter7171]

Dead Internet theory becomes more believable every day.

[@tictacterminator]

I dunno some dude was telling us about the dump he took I dont think there's a bot that does that

[@sayorancode]

@@tictacterminator i could swear, these bots are getting more advanced by the day!

[@interstellarsurfer]

So says the guy with the Ukraine-ish avatar. 👏😉

[@cieplydran1]

​@@interstellarsurferSo if someone has yellow and blue in their pfp they are a bot?

[@X-i_i-K]

1:01 the cat on the laptop is AI

[@brunodangelo1146]

You are clearly an AI bot

[@RafidW9]

This is why you run TempleOS

[@unconnectedbedna]

Wtih pissandshittium (google that and look for the ghub) as web browser right?

[@brawldude2656]

God protect us✊🙏🙏

[@witness1013]

has already been released as BootyKitty

[@stage6fan475]

algorithm. Thanks for doing all the work to find, understand, and explain these events. Greatly appreciated!

[@EveryoneisHereB]

From the 💻Linux to the 🎋virus to the 🛤️UEFI to the 😺bootkitty🗣️🔥🔥🔥 wheres my 🏥Programmer always when my bios is broooookeeen💀

[@jonas314ano]

4:29 say that again

[@max373-1.0]

GET OUT OF MY HEAD

[@pecopeco2815]

LINUX TUAH

[@alfos.192]

7:40 And yet that's impossible to do w/o installing Windows first on my Lenovo laptop, genius.

[@madrox1989]

Awesome overview, and kudos for prompting folks to patch!

[@samuelmatheson9655]

Absolutly horrifying (5 years ago)

[@reversetransistor4129]

Nice, same idea as tracking pics, but deeper in the system, nice work!

[@BsktImp]

Predicted ages ago that, with the likely exodus from Microsoft Windows to Linux as Win10 support nears EoL, hackers and malware makers will exploit the vulnerabilities in Linux on a scale never seen.

[@DerekSmit]

I once heard 1 out of 3 comments is by a bot, but this comment section is more like 9/3 comments is by a bot!

[@bananaman9869]

Logofail and now this, should’ve just listened to Luke Smith and use BIOS.

[@robotron1236]

I’m almost positive that he is luke smith. 😂

[@UsernameDoesntCare]

Gonna go make my own bootloader to btfo all malware by security by obscurity.

[@SG_GLOBAL]

Still safer than Windows... Good Info, thanks for reporting this.

[@iamwitchergeraltofrivia9670]

No

[@SG_GLOBAL]

@iamwitchergeraltofrivia9670 Are you on of those Linux ully-Trolls or is there an intelligeable response to be made on your behalf?

[@salce_with_onion]

​@@SG_GLOBALLinux safer than Windows is like laughable statement. By that logic TempleOS is the most secure system. The most vulnerable link is always the user, and the more obscure and unknown OS the less chance user would be dumb in his actions.

[@SG_GLOBAL]

@@salce_with_onion Valid. OPSEC is the largest issue under todays survellience state.

[@Vilematrix]

Thanks for the explaination. I Can Now know for sure that I got 2 bootkits on 2 laptops of mine 😂

[@Julio860JVL]

Attempt # 4. Trying to get your attention to check your microphone because your S letters sound like a sword cutting something.

[@noranoxica]

00:30 when a kitty cats

It's been more than 10 years since I've seen something similar. But this still requires phisical access.

[@toorhideor8866]

been a dev for 10 years and kept my head in the computer for 20 years and i've never done one single bios update :)) always been scared of bricking the computer

[@unconnectedbedna]

If I were you I would keep that to myself unless I want to ridicule myself as a "dev". Being an insecure entrypoint to any project you work on is probably something you want to keep your mouth shut about. You are quite literally a risk to work with.

[@F.M671]

@@unconnectedbedna You're acting as if the majority of IT workers practice common sense cysec. They don't

[@josemcgomes]

@@unconnectedbedna Any company worth their salt has MDM software that prevents this. Plus, keeping quiet is the worst possible thing you can do. We all make mistakes, the sooner we admit them, the sooner we can fix them. I'd rather hear the security team at my workplace say they missed something in their testing procedure than have a dev come up to them with that same problem because they decided to keep quiet.

[@giridharpavan1592]

this is how skynut is formed

[@M-dv1yj]

My work is called unified emergent field theory. And I miss read you using that acronym 😂. I was like who made a booklet in my work. 😮‍💨

[@ArbyFyrelyte]

Joke is on ya'll, I disable fullscreen logo because I think the debug and boot information looks better

[@unconnectedbedna]

Joke's on me, I GET NO extra information by disabling it, just a black screen instead. xD Still disabled it when patching this security flaw in januari of this year though...

[@ArbyFyrelyte]

@@unconnectedbedna I mean yes I do too. But, I always did. I don't like other people's logos on the machine that I put together.

[@Linkman8912]

I'm really curious as to what the image at 1:00 is supposed to be, it appears to be a cat with its paws on a laptop, but the laptop has a macropad instead of a trackpad?

[@JamaicaWhiteMan]

All I know is that everything I do on my Linux desktop takes half the time it did when I last used Windows, with no constant crashes of QGIS. As far as the bootkit goes, I'm sure it will be taken care of before I upgrade to the next version of Mint (22.1).

[@unconnectedbedna]

1. No software in userspace on EARTH can protect you from this. (there is absolutely nothing mint or any distro can do about this) 2. It already IS patched, in Januari of 2024. LogoFAIL firmware patch for your MOTHERBOARD.

[@Xaito]

The real shocker was that they have a "best of the best" competition, still valuing excellence. Over here it feels like everybody gets a participation trophy.

[@WorBlux]

firware updates applied, thanks for the reminder!

[@Vilvaran]

What about disabling the splash screen, opting for the POST text instead? If I remember correctly, this was a way to mitigate the image vulnerability by not loading one at all...

[@ArthurTheEpicGuy]

The more popular the OS means more attacks on said OS.

[@kneel1]

haha I was so mad when Gigabyte removed the ability to replace the Aorus logo, but they said it was a sec vuln

[@myhandleiswhat]

I half expect bootkitty to become a popular VTuber channel name and it'll completely drown out this entire discussion about this.

[@mikescholz6429]

That penguin pops back up like, I hope no one saw that lmao

[@FriggnH8ters]

wtf are these comments

[@ahmetrefikeryilmaz4432]

The footage of penguins throwing themselves from the cliff was masterfully put.

[@zxGHOSTr]

You know how they say "enough internet for today"? Maybe we should skip internet for ever.

[@codemiesterbeats]

My grandma had a black cat named Boo and she often called it Boo Kitty.

[@marklundeberg7006]

BMP files are actually often compressed. Run length encoding, the lowest form of compression (bad but helps a lot for a small logo on a black background).

[@JimBob1937]

Yeah, he likely meant that BMP are lossless, rather than lossy. People usually refer to lossless as uncompressed, even if reversible binary compression techniques are used.

[@xgui4-studios]

my oem still havent release a UEFI update....i am cooked

[@AJohnSmith]

Nothing is secure; they’re deep into brainwave readers. “You will have to determine your OWN line in the sand…” Luigi Bro.

[@LouisSerieusement]

The best of the best is also a very fun and cheesy 80's karate movie x)

[@Foche_T._Schitt]

Jokes on them, I never figured out how to install an OS using UEFI.

[@roccociccone597]

It is time for FreeBSD

[@13thravenpurple94]

Excellent video 👍 Thank you 💜

[@petrblaha8806]

Media: Malware that targets linux! Me: *Laughs in FreeBSD*

[@jeonghutamilim2259]

I like stupid bios.

[@JosephAlnasl]

7:24 i have no idea how to do that lol

[@NeemoVideos]

Wtf are those comments?

[@Gregorius421]

Those damn vital logos are at it again. Imagine screwing up a BMP "decoder".

[@THEGOOD360]

I feel like we are on the verge of an internet dark age...

[@Z3r0Sk83r]

Master Boot Record mentioned.

[@Zeawi]

Mean the version used in the comp seems cool 😎 I'd just it on my laptop with 100% vulnerability because company hasn't updated it in almost 6 years... come out 7 years ago, as it turns out they dont care about the student machines Of all my computers only one was patched to fix logo fail properly Also happens to be the only expensive one made in last few years

[@Danilen52]

Finally a not "bottom of the barrel" video

[@ah-64apache84]

how would you go about recovering a compromised system???

[@D.von.N]

That interests me too... at worst send it to some specialist to flash the entire UEFI. I think Chernobyl did a similar thing. My mate had it back then. Nasty stuff.

[@kunka592]

Probably just a BIOS/UEFI flash.

[@Gunstick]

Bootkit: are normal people targeted? Well not really. To change the boot logo, you need root to do that. So this is a persistance technique used after the server is compromised so the malware can stay present after a reinstall (see first minute of the video) It is not a malware you may be subject to from a normal ransomware.

[@simonbackwash]

🐧Th penguin fall footage was rough ! 🐧🤕.

[@Trashingcanine]

Screw popular os systems, I’m gonna use the sun and pidgins to fo my math

[@ToryTyler]

posting from my thinkpad x41, what's a uefi?

[@bcredeur97]

What if your old computer doesn’t get the update?

[@lukeamos8280]

Good luck getting BIOS updates for old motherboards.

[@MaskMajor]

Awww but it has such a cute name tho!!!

[@BenParkes-wz5bd]

As a person who uses inside h20 BIOS, this scared me a little bit cus my manufacturer doesn't provide new BIOS updates anymore

[@FebruaryWashington]

lmao same. really makes you feel like you're still using Windows XP after all this time!

[@anamoyeee]

The worst fate of all: to have an ai generated image shown to you every time you boot up your computer...

[@VivekYadav-ds8oz]

Don't most people keep secure boot off anyways in order to dual boot?

[@justinriley-l8o]

What do you think of Libreboot in 2024?

[@danielbaker1248]

You should do videos on how to patch these vulnerabilities as they come out.

[@anti_globalista]

What would the path of infection be, how do they install it (if someone decides to use it non-ethically)?

[@spaghetticat110]

I clicked just because of the thumbnail. Scary shit

[@leveluptennis5440]

I had this exact error message on my dual boot potato pop up last week, I don't use arch btw

[@immameme]

Meow Ware and Imma1st Don't take my comments seriously. It's only a meme

[@CreativeWerxGFX]

Holyshit! Mah! What's for dinner? BOOTKITTY! What's that? LINUX MALWARE! Oh... Damnit, i hate malware!

[@seansingh4421]

*First bootkit for desktop Linux….these things are very prevalent in the server/enterprise world, like seriously if you have weak BMC creds or vulnerable onboard IPMI you’ll end up with a bootkit.

[@xDMG15x]

How does the attacker get the bmp onto the flash chip or wherever the original boot logo lives?

[@spider_corsa]

Switch the Linux development to Rust, to avoid buffer overflow problems they said...

[@GOOGLE-IS-EVIL-EMPIRE]

BlackLotus with persistence. Ah, you say that already when i write comment.

[@FranekMuschilek]

does anyone remember to have such issues as long as we were still all happy go lucky with BIOS and Microsoft didn't push anyone to use UEFI? Well not me, thats for sure

[@saltyowl3229]

How compatible is this? Like if you just made a custom kernel patch with extra init functions to directly block the functionality does it have workarounds? Is it possible to create an encryption stream for all kernel memory, mapping of function/data to specific locations, etc., such that even an EFI level process with secureboot permissions could not inject itself? I’ve always wondered about bootkits for linux cause the process is so much more variable. You could have the actual kernel files themselves and boot process files on the disk, randomize layout and labeling schemes for functions et al. along with loading order, such that a precompiled binary would not be able to determine where/how to inject into the stack, memory, or disk.

[@gabrielnilo6101]

so they discovered NSA toy and now it's going to be fixed in the future?

[@marbens]

Already been fixed, unless your hardware is no longer supported by your BIOS/UEFI provider (usually the manufacturer).