There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.
In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.
You weren’t hoping that Secure Boot saves your ass, were you?
Since the EFI partition is unencrypted, physical access would do the trick here too, even with every firmware/software security measure.
True, but this was the case without this finding, wasn’t it? With write access to the EFI you could replace the boot loader and do whatever you please.
Unless a proper secure boot + FDE setup is in place.
The idea is also that a compromised system will remains compromised after all storage drives are removed.
deleted by creator
Yeah, if someone has write access to your boot partition then you’re kind of already screwed.
Fyi if someone had physical access / administration access due to another vulnerability to your machine they can exploit it, news at 11:00
Would resetting bios clear this?
More like reflashing entirely or just changing the image. Alternatively, you can often disable showing the.logo somewhere in the settings.
What’s known as resetting bios is more like removing the stuff saved in CMOS, AFAIK
Most fastboot options dont show the logo until windows bootloader comes along.
Though i am not sure how or why the logo is displayed when windows loads? Is that the same image? Loaded and displayed again or just didnt clear the display?Loaded and displayed again, yes. It is stored in the BGRT table.
deleted by creator
I think so, but there can probably be some vendor-specific differences, like storing the image in a place that doesn’t get overwritten. For example, thinkpads provide a way to supply your own image, and when installing updates after that you’re asked if you want to keep it. But yeah, the update should neuter it anyways
Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea? Or having them be accessible to the proper OS? Was there really no pushback, when UEFI was being standardized, to say “images that an OS can write to are not critical to initializing hardware functionality, don’t include that”? Was that question not asked for every single piece of functionality in the standard?
Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea
UEFI and Secure Boot were pushed forcibly by MS. That’s why FAT32 is the ESP filesystem.
If I had to guess, a brief was drafted at MS to improve on BIOS, which is pretty shit, it has to be said. It was probably engineering led and not an embrace, extinguish thing. A budget and dev team and a crack team of lawyers would have been whistled up and given a couple of years to deliver. The other usual suspects (Intel and co) would be strong armed in to take whatever was produced and off we trot. No doubt the best and brightest would have been employed but they only had a couple of years and they were only a few people.
UEFI and its flaws are testament to the sheer arrogance of a huge company that thinks it can put a man on the moon with a Clapham omnibus style budget and approach. Management identify a snag and say “fiat” (let it be). Well it was and is and it has a few problems.
The fundamental problem with UEFI is it was largely designed by one team. The wikipedia page: https://en.wikipedia.org/wiki/UEFI is hilarious in describing it as open. Yes it is open … per se … provided you decide that FAT32 (patent encumbered) is a suitable file system for the foundations of an open standard.
I love open, me.
UEFI is flawed for sure, but there’s no way that any remaining patents on FAT32 haven’t expired by now.
You may be surprised to learn that they didn’t all run out until 2013. UEFI had been around for 7 years by this time, and Microsoft was doing patent enforcement actions against Tom Tom during this time period.
Sure, they’re expired now, but not at the time. It was supposed to be an open standard at the time.
deleted by creator
deleted by creator
Yes.
deleted by creator
I don’t know. It looks more aesthetically consistent. Your computer has to display something. Average users would be scared if it dumped logs on the display. so the vendor logo makes sense. It COULD just say loading, but this is a bit pedantic I think.
When it comes to security, particularly at boot time, fuck the user. Users don’t interact with devices at boot time so it doesn’t matter if it shows a blank screen, a mile of logs or a screaming clown penis. If it was up to users no device or service would have a password or security of any kind, and every byte of information about your life would be owned by 'The Cloud." Let the marketing wanks insert their logo into the Windows boot process,
Tell me more about this screaming clown penis option…
You gotta hold ctrl alt shift honk at power up.
I want to insert my own logo into the boot process, and I want these ducking vendors to properly validate and assess their mother ducking software. But nooo, penetration tests and any remediations are too expensive for these pieces of bit. Why do it when you can just stick your dick in everyone’s face, right?
Fuck.
As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running.
Me using an old PC with BIOS instead of UEFI: 😏
Also known as using a pc with unpatched cpu vulnerabilities
As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.
So, does disabling the boot logo prevent the attack, or would it only make the attack obvious?
If you have access to replace the logo file, you probably have access to enable it as well.
Not necessarily, I guess. They’re talking about a firmware upgrade of sorts, and, at least on the machines I own(ed), performing it didn’t reset user settings (which disabling the logo is)
deleted by creator
Usually you can, though the setting might be listed under something like “show diagnostic during boot”.
It’s rare that I get to feel anything remotely comforting about not being able to afford new hardware, but if I understand correctly, my BIOS-only dinosaur can’t be exploited.
Still vulnerable to thousands of other exploits no doubt, but not this one.
deleted by creator
We need more machines that support coreboot. These proprietary firmware vendors have been getting rich off making our machines worse for too long.
A flashed Chromebook is an accessible option
i use coreboot but i’d prefer libreboot if a gaming level system with linux supported it. Are their any? I ask to the masses, not you specifically lol
deleted by creator
coreboot exists
I wonder if this effects coreboot builds like heads as they allow you to use external devices like a nitrokey for verification when you boot
I wonder if old BIOS are vulnerable…
Nope, they aren’t as universal as EFI. I think the closest comparable attack vector for “old tech” is a bootsector virus.
So, does this affect dual boot systems, if e.g. Windows is compromised, now that malware in the efi partition can compromise the Linux system next time it boots? Yikes!
I suppose in principle malware from one OS can attack the other anyway, even if the other is fully encrypted and/or the first OS doesn’t have drivers for the second’s filesystems: because malware can install said drivers and attack at least the bootloader - though that night have been protected by secure boot if it weren’t for this new exploit?
Aaa! Name thief!
Don’t worry, I’m just on standby.
Is this potentially useful to me? Since it is persistent, can I use it on this motherboard I have over here that insists on using UEFI even if I do not want to?
So I don’t get it, I have my entire boot image in a signed EFI binary, the logo is in there as well. I don’t think I’m susceptible to this, right? I don’t think systemd-boot or the kernel reads an unsigned logo file anywhere. (Using secure boot)
This is way before reaching your bootloader. It’s about the manufacturer logo that’s displayed by UEFI while doing the whole hardware initialization.
That’s… Stored in the EFI partition or changeable in userspace?
Depending on how the UEFI is configured, a simple copy/paste command, executed either by the malicious image or with physical access, is in many cases all that’s required to place the malicious image into what’s known as the ESP, short for EFI System Partition, a region of the hard drive that stores boot loaders, kernel images, and any device drivers, system utilities, or other data files needed before the main OS loads.
(from the article)
Right, I know EFI images are stored in the EFI partition, but with secure boot, only signed images can be executed, so they’d need to steal someone’s signing key to do this.
is it common practice to have a web browser or media player running with elevated permissions? seems like a strange thing to do…
