News Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

[Paliv]

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

UEFIs booting Windows and Linux devices can be hacked by malicious logo images.

arstechnica.com

I’ve was reading in depth about this last night. We just can’t have nice things. More whack a mole security.

 

[L&LD]

We can't have nice things to last forever.

But we do have nice things.

I'm just glad that researchers found these vulnerabilities. Hardened UEFIs are coming soon.

 

[coxhaus]

I use to build PCs using motherboards I would buy. But BIOS support was very lacking so I quit. I now buy Dell PCs new and used as Dell is good about Bios and firmware updates. They support their products for a long time.
I randomly update my BIOS from time to time just in case. I think I will do today. I overwrite my BIOS with one off Dell's support page new or not.

PS
I just did it. Dell already had an updated BIOS. I will update all my Dells now.

 

[sfx2000]

pre-builts and motherboards from the mainline manufactures should be able to release updates fairly quick...

challenge will be for those folks that bought those cheap QOTOM boxes to run pfSense and similar...

 

[coxhaus]

pre-builts and motherboards from the mainline manufactures should be able to release updates fairly quick...

challenge will be for those folks that bought those cheap QOTOM boxes to run pfSense and similar...

It is one of the reasons I bought a low wattage used Dell PC for my Pfsense so I had BIOS and hardware support.

 

[RMerlin]

challenge will be for those folks that bought those cheap QOTOM boxes to run pfSense and similar...

There`s a good chance that those don`t support customizable boot logos however.

 

[sfx2000]

There`s a good chance that those don`t support customizable boot logos however.

Depends on the UEFI firmware vendor - the hooks are still there, even if the OEM's firmware doesn't have the boot image...

 

[Justinh]

Before EFI, didn't you have to update the BIOS via the BIOS? Now you can do it from the OS, which gives a crucial attack vector.

Companies add security tech, but then that tech has security issues. It seems like just more complexity to use and more to fix. I'm sure it is all worth it for some scenario ...

 

[coxhaus]

I thought you flashed BIOS using DOS back in the old days. Even when I ran OS2 I used DOS to flash BIOS.

 

[sfx2000]

It helps to know that UEFI is basically an OS unto itself... and it runs underneath the upper layer OS (Win/Linux/BSD/Intel Macs) - and it's always there...

That's why things like this particular issue, as well as others, are fairly painful...

 

[follower]

This kind of attack is nothing new. You guys have never heard about MoonBounce for sure. Don't trust anything. There is always a backdoor whatever you do. Some people trust Firewall and Antivirus too much. Don't forget your Firewall and Antivirus don't work for these attacks, because the attackers know everything about the target. There is funny thing that some Snbforums users always say it doesn't exist.

 

[follower]

I use to build PCs using motherboards I would buy. But BIOS support was very lacking so I quit. I now buy Dell PCs new and used as Dell is good about Bios and firmware updates. They support their products for a long time.
I randomly update my BIOS from time to time just in case. I think I will do today. I overwrite my BIOS with one off Dell's support page new or not.

PS
I just did it. Dell already had an updated BIOS. I will update all my Dells now.
View attachment 54713

However, bad things are always happened before update release. The attacker knows about it very well. After update? There are variants. Rinse and repeat.

 

[Keenan]

Is this a concern if you don't have/use a boot logo?

 

[L&LD]

Yes, possibly. See above.

 

[follower]

Is this a concern if you don't have/use a boot logo?

It doesn't matter. This attack works even if you don't use a boot logo.

 

[sfx2000]

FWIW - Apple Intel Macs use UEFI, but they're secure from this... old school PPC uses OpenFirmware and AppleSilicaon uses iboot...

There are also many Dell's that are also immune...

At the end of the day - check with your hardware provider - there are quite a few that have already offered up patches...