#BootKitty

0 posts0 participants0 posts today

jbz🐧Researchers Discover "Bootkitty" – First UEFI Bootkit Targeting Linux Kernels | The Hacker News"The bootkit's main goal is to disable the kernel's signature verification feature and to preload two as yet unknown ELF binaries via the Linux init process (which is the first process executed by the Linux kernel during system startup),"<a href="https://thehackernews.com/2024/11/researchers-discover-bootkitty-first.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://thehackernews.com/2024/11/researchers-discover-bootkitty-first.html</a><a href="https://indieweb.social/tags/bootkitty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bootkitty</a> <a href="https://indieweb.social/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://indieweb.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://indieweb.social/tags/uefi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#uefi</a>

Radio AzureusUEFI malware targeting Linux computing systems article has been updatedBootKitty attacks can be circumvented / mitigated when you follow best practices <a href="https://mastodon.social/tags/BootKitty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BootKitty</a> <a href="https://mastodon.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://mastodon.social/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a> <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://mastodon.social/tags/freeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freeBSD</a> <a href="https://mastodon.social/tags/netBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#netBSD</a> <a href="https://mastodon.social/tags/openBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openBSD</a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://mastodon.social/tags/POSIX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#POSIX</a><a href="https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/</a>

Fossery Tech :debian: :gnome:This week's Linux and FOSS news:LINUX NEWSelementary OS 8 released with new Wayland session (called Secure session) with prompts to give programs certain permissions, new Dock, Flathub out-of-the-box, new quick settings, system updates via system settings, option to conceal text on screenshots: <a href="https://news.itsfoss.com/elementary-os-8-release/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://news.itsfoss.com/elementary-os-8-release/</a> (The prompting for permission thing is pretty unique on Linux. I know some nerds will call it "phone approach" because mobile OSes do the same but I don't think it's necessarily bad. I'm personally satisfied with the regular approach to open Flatseal to control permissions after I download a program, but for many people the prompting approach is probably more efficient because they don't have to think about going to Flatseal first, yet they can still prevent some unnecessary access for programs.)NixOS 24.11 released with GNOME 47, KDE Plasma 6.2, PipeWire by default, Nix 2.24 package manager, improved support for Darwin into Nixpkgs, support for LLVM 19 compiler etc.: <a href="https://9to5linux.com/nixos-24-11-released-with-gnome-47-and-kde-plasma-6-2-pipewire-by-default" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://9to5linux.com/nixos-24-11-released-with-gnome-47-and-kde-plasma-6-2-pipewire-by-default</a>Armbian 24.11 released with support for OrangePi5 Max, Radxa ROCK 5B+ and many more devices: <a href="https://9to5linux.com/armbian-24-11-released-with-support-for-orangepi-5-max-and-radxa-rock-5b" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://9to5linux.com/armbian-24-11-released-with-support-for-orangepi-5-max-and-radxa-rock-5b</a>First UEFI bootkit for Linux, Bootkitty is discovered: <a href="https://news.itsfoss.com/bootkitty-linux/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://news.itsfoss.com/bootkitty-linux/</a> (Remember, no system is 100% secure, including Linux) (It's currently a proof-of-concept but regardless it's better to be aware of it, update your system regularly, keep Secure Boot enabled if your distro supports it, to be protected against these type of attacks in the future.)Cinnamon 6.4 released with new default theme, built-in Night Light feature, Power Profile options, updated applets etc.: <a href="https://9to5linux.com/cinnamon-6-4-desktop-environment-released-with-revamped-theme-night-light" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://9to5linux.com/cinnamon-6-4-desktop-environment-released-with-revamped-theme-night-light</a>KDE Plasma 6.2.4 released with re-enabled HDR mode for NVIDIA 565 and Linux 6.11 users, various bug fixes, improvements: <a href="https://9to5linux.com/kde-plasma-6-2-4-re-enables-hdr-mode-for-users-on-nvidia-565-and-linux-6-11" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://9to5linux.com/kde-plasma-6-2-4-re-enables-hdr-mode-for-users-on-nvidia-565-and-linux-6-11</a>Ubuntu Touch OTA-7 released with PulseAudio security fixes: <a href="https://9to5linux.com/ubuntu-touch-ota-7-released-for-linux-phones-with-pulseaudio-security-fixes" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://9to5linux.com/ubuntu-touch-ota-7-released-for-linux-phones-with-pulseaudio-security-fixes</a>(FOSS news in reply)<a href="https://social.linux.pizza/tags/WeeklyNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeeklyNews</a> <a href="https://social.linux.pizza/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSS</a> <a href="https://social.linux.pizza/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://social.linux.pizza/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://social.linux.pizza/tags/elementaryOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#elementaryOS</a> <a href="https://social.linux.pizza/tags/NixOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NixOS</a> <a href="https://social.linux.pizza/tags/Armbian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Armbian</a> <a href="https://social.linux.pizza/tags/Bootkitty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bootkitty</a> <a href="https://social.linux.pizza/tags/Cinnamon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cinnamon</a> <a href="https://social.linux.pizza/tags/KDE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KDE</a> <a href="https://social.linux.pizza/tags/KDEPlasma" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KDEPlasma</a> <a href="https://social.linux.pizza/tags/UbuntuTouch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UbuntuTouch</a> <a href="https://social.linux.pizza/tags/LinuxDistro" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LinuxDistro</a> <a href="https://social.linux.pizza/tags/FosseryTech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FosseryTech</a>

PrivacyDigestCode found online <a href="https://mas.to/tags/exploits" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#exploits</a> <a href="https://mas.to/tags/LogoFAIL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LogoFAIL</a> to install <a href="https://mas.to/tags/Bootkitty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bootkitty</a> <a href="https://mas.to/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://mas.to/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a> <a href="https://mas.to/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a><a href="https://arstechnica.com/security/2024/11/code-found-online-exploits-logofail-to-install-bootkitty-linux-backdoor/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/security/2024/11/code-found-online-exploits-logofail-to-install-bootkitty-linux-backdoor/</a>

:rss: Hacker NewsResearchers discover first UEFI bootkit malware for Linux <a href="https://www.bleepingcomputer.com/news/security/researchers-discover-bootkitty-first-uefi-bootkit-malware-for-linux/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/researchers-discover-bootkitty-first-uefi-bootkit-malware-for-linux/</a> <a href="https://rss-mstdn.studiofreesia.com/tags/ycombinator" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ycombinator</a> <a href="https://rss-mstdn.studiofreesia.com/tags/computers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#computers</a> <a href="https://rss-mstdn.studiofreesia.com/tags/windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#windows</a> <a href="https://rss-mstdn.studiofreesia.com/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://rss-mstdn.studiofreesia.com/tags/mac" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mac</a> <a href="https://rss-mstdn.studiofreesia.com/tags/support" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#support</a> <a href="https://rss-mstdn.studiofreesia.com/tags/tech_support" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech_support</a> <a href="https://rss-mstdn.studiofreesia.com/tags/spyware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spyware</a> <a href="https://rss-mstdn.studiofreesia.com/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://rss-mstdn.studiofreesia.com/tags/virus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#virus</a> <a href="https://rss-mstdn.studiofreesia.com/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://rss-mstdn.studiofreesia.com/tags/Bootkit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bootkit</a> <a href="https://rss-mstdn.studiofreesia.com/tags/Bootkitty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bootkitty</a> <a href="https://rss-mstdn.studiofreesia.com/tags/Kernel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kernel</a> <a href="https://rss-mstdn.studiofreesia.com/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://rss-mstdn.studiofreesia.com/tags/Ubuntu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ubuntu</a> <a href="https://rss-mstdn.studiofreesia.com/tags/UEFI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UEFI</a> <a href="https://rss-mstdn.studiofreesia.com/tags/virus_removal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#virus_removal</a> <a href="https://rss-mstdn.studiofreesia.com/tags/malware_removal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware_removal</a> <a href="https://rss-mstdn.studiofreesia.com/tags/computer_help" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#computer_help</a> <a href="https://rss-mstdn.studiofreesia.com/tags/technical_support" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#technical_support</a>

Chuck DarwinA rootkit is a piece of malware that runs in the deepest regions of the operating system it infects. It leverages this strategic position to hide information about its presence from the operating system itself. A bootkit, meanwhile, is malware that infects the boot-up process in much the same way. Bootkits for the UEFI —short for Unified Extensible Firmware Interface —lurk in the chip-resident firmware that runs each time a machine boots. These sorts of bootkits can persist indefinitely, providing a stealthy means for backdooring the operating system even before it has fully loaded and enabled security defenses such as antivirus software. The newly discovered <a href="https://c.im/tags/Bootkitty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bootkitty</a> suggests threat actors may be actively developing a Linux version of the same sort of unkillable bootkit that previously was found only targeting Windows machines. “Whether a proof of concept or not, Bootkitty marks an interesting move forward in the UEFI threat landscape, breaking the belief about modern UEFI bootkits being Windows-exclusive threats,” ESET researchers wrote. “Even though the current version from VirusTotal does not, at the moment, represent a real threat to the majority of Linux systems, it emphasizes the necessity of being prepared for potential future threats.”<a href="https://arstechnica.com/security/2024/11/found-in-the-wild-the-worlds-first-unkillable-uefi-bootkit-for-linux/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/security/2024/11/found-in-the-wild-the-worlds-first-unkillable-uefi-bootkit-for-linux/</a>

Recent searches

Search options

Administered by:

Server stats: