Linux

There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.

In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.

You weren't hoping that Secure Boot saves your ass, were you?

Fyi if someone had physical access / administration access due to another vulnerability to your machine they can exploit it, news at 11:00

Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea? Or having them be accessible to the proper OS? Was there really no pushback, when UEFI was being standardized, to say "images that an OS can write to are not critical to initializing hardware functionality, don't include that"? Was that question not asked for every single piece of functionality in the standard?

I've never been a fan of the UEFI logo inserting itself into the boot screen. It's basically just an advertisement for the hardware vendor because they're jealous of the OS having the spotlight. And it's an ad that, like so many other ads before it, screws over the security and privacy of the advertisee because fuck you that's why.

I can’t believe stupid, pointless marketing crap didn’t have the best of the best working to ensure security.

As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.

So, does disabling the boot logo prevent the attack, or would it only make the attack obvious?

As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running.

Me using an old PC with BIOS instead of UEFI: 😏

It's rare that I get to feel anything remotely comforting about not being able to afford new hardware, but if I understand correctly, my BIOS-only dinosaur can't be exploited.

Still vulnerable to thousands of other exploits no doubt, but not this one.

The article didn't mention this, but would disabling the UEFI logo in the boot screen mitigate the vulnerability until proper patches get rolled out? (Or honestly at this point, I'd keep it disabled even after it's patched in case they didn't patch it right. UEFI's are all proprietary so it's not like you can check.) Since the vulnerability is in the image parser, would bypassing that be enough?

Do they even let you disable it?

Hello I am writing the firmware for MotherBoard 2021, a definitely completely different product than MotherBoard 2020, I am going to ship in in 2 weeks for Christmas, and I am going to write an image decoder on top of bare metal, and it is "not" going to let you hack the pants off the computer.

Said no one ever.

So this is only for the background of the motherboard boot up logo like from Asus, Acer, Gigabyte ect? Not your grub or rEFInd background correct?

We need more machines that support coreboot. These proprietary firmware vendors have been getting rich off making our machines worse for too long.

BIOS booting stays winning

I wonder if this effects coreboot builds like heads as they allow you to use external devices like a nitrokey for verification when you boot

I wonder if old BIOS are vulnerable...

So, does this affect dual boot systems, if e.g. Windows is compromised, now that malware in the efi partition can compromise the Linux system next time it boots? Yikes!

I suppose in principle malware from one OS can attack the other anyway, even if the other is fully encrypted and/or the first OS doesn't have drivers for the second's filesystems: because malware can install said drivers and attack at least the bootloader - though that night have been protected by secure boot if it weren't for this new exploit?