Everything you need to know about windows and linux users the deadline.
[ad_1]In 2012, a new form of bootkit was demonstrated. Instead of targeting machines through the BIOS or master boot record, one such bootkit attacked Mac OS X systems by infecting the EFI, a package of firmware that started the boot process. A second very primitive bootkit targeted Windows 8 machines by infecting the UEFI bootkit, the predecessor to the UEFI. Around 2013, a researcher demonstrated a more advanced UEFI bootkit for Windows named Dreamboat.
The first known case of a real-world attack targeting the UEFI came in 2018 with the discovery of malware dubbed LoJax. A repurposed version of legitimate anti-theft software known as LoJack, it was created by the Kremlin-backed hacking group tracked under names including Sednit, Fancy Bear, and APT 28. The malware was installed remotely using malware tools that can read and overwrite parts of the UEFI firmware’s flash memory.
In 2020, researchers unearthed the second known instance of real-world malware attacking the UEFI. Each time an infected device rebooted, its UEFI checked whether a malicious file was present in the Windows startup folder and, if not, installed it. Researchers from Kaspersky, the security provider that discovered the malware, named it “MosaicRegressor.” Researchers have yet to determine how the compromised UEFIs became infected. Since then, a handful of new UEFI bootkits have come to light. They are tracked under names including ESpecter, FinSpy, and MoonBounce.
Necessity is the mother of invention
In response to the more menacing threat of UEFI bootkits, Microsoft worked with device makers to develop Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure that each piece of firmware loaded during startup is trusted by a computer’s manufacturer. Secure Boot is designed to create a chain of trust that prevents attackers from replacing the intended bootup firmware with malicious firmware. If a single link in the startup chain isn’t recognized, Secure Boot will prevent the device from starting.
[ad_2]
Source link
More on windows and linux users the deadline
Stay tuned for updates on windows and linux users the deadline as the story develops. Related: Which MDM is right for you?.
Frequently Asked Questions
Secure Boot is an industry-wide standard developed by Microsoft with device makers in response to UEFI bootkits. It uses cryptographic signatures to ensure each piece of firmware loaded during startup is trusted by the computer's manufacturer, creating a chain of trust that blocks malicious boot firmware.
Known UEFI bootkits include LoJax (2018, linked to the Kremlin-backed group Sednit/Fancy Bear/APT28), MosaicRegressor (2020, discovered by Kaspersky), plus ESpecter, FinSpy and MoonBounce.
Secure Boot relies on cryptographic keys that validate the boot chain. The article notes a deadline is near for updating Secure Boot keys on Windows and Linux systems.
The 2018 LoJax malware, a repurposed version of legitimate anti-theft software LoJack, was installed remotely using tools that could read and overwrite parts of the UEFI firmware's flash memory.
