There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.
In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.
You weren’t hoping that Secure Boot saves your ass, were you?
True, but this was the case without this finding, wasn’t it? With write access to the EFI you could replace the boot loader and do whatever you please.
In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.
You weren’t hoping that Secure Boot saves your ass, were you?
Since the EFI partition is unencrypted, physical access would do the trick here too, even with every firmware/software security measure.
True, but this was the case without this finding, wasn’t it? With write access to the EFI you could replace the boot loader and do whatever you please.
Unless a proper secure boot + FDE setup is in place.
The idea is also that a compromised system will remains compromised after all storage drives are removed.
Yeah, if someone has write access to your boot partition then you’re kind of already screwed.