CyberSecurity updates
Updated: 2024-12-04 13:07:16 Pacfic

Pierluigi Paganini @ Security Affairs
Bootkitty: First UEFI Bootkit Targeting Linux Systems - 5d

ESET researchers discovered Bootkitty, the first UEFI bootkit designed for Linux systems. While appearing to be a proof-of-concept, its existence signals a concerning shift in the UEFI threat landscape, expanding threats beyond traditionally targeted Windows systems. Further research is needed to determine its potential for active exploitation and the extent of its capabilities.

eclypsium.com
Sophos Firewall Appliance Hacking Campaign - 28d

Sophos has identified a five-year campaign, dubbed “Pacific Rim”, by Chinese threat actors targeting network appliances, particularly Sophos firewalls. These attackers, including APT31, APT41/Winnti, and a third group, have employed a variety of tactics, including botnets, zero-days, custom malware, firmware backdoors, and UEFI implants, in attempts to compromise these devices. The UEFI implants, while not entirely new, are particularly concerning as they provide attackers with a persistent foothold on the firewall, potentially enabling them to gain control over the entire network. This campaign highlights the vulnerability of network appliances and the increasing sophistication of threat actors. Attackers are exploiting vulnerabilities, utilizing zero-day exploits, and implementing backdoors to gain access to sensitive data and gain a foothold in targeted organizations.

cyberinsider.com
Multiple Critical Vulnerabilities Found in Intel's UEFI Firmware Affecting Millions of Devices - 5d

Intel has issued a security advisory regarding critical vulnerabilities found in the UEFI firmware of certain processors. These vulnerabilities, if exploited, could lead to privilege escalation, denial-of-service (DoS) attacks, or sensitive data leakage. Users are advised to wait for system manufacturers to release firmware updates to address these issues. The impact of these vulnerabilities is potentially widespread, as millions of devices may be affected. The security risks associated with these vulnerabilities are significant, as they could potentially grant attackers control over affected systems.

securityaffairs.com
PKFail: Secure Boot Bypass Vulnerability Remains a Significant Risk - UEFI Bootkit Malware Attacks - Major Cybersecurity Threat - 5d

A significant vulnerability, known as PKFail, allows attackers to bypass Secure Boot mechanisms and potentially install UEFI bootkit malware. This vulnerability is present in a substantial number of firmware images, making a wide range of devices susceptible to these attacks. UEFI bootkits are capable of establishing persistence at a low level of the system, allowing attackers to maintain control even after OS reboots.


This site is an experimental news aggregator using feeds I personally follow. You can provide me feedback using this form or using Bluesky.