FlagThis

ESET researchers discovered Bootkitty, the first UEFI bootkit designed for Linux systems. While appearing to be a proof-of-concept, its existence signals a concerning shift in the UEFI threat landscape, expanding threats beyond traditionally targeted Windows systems. Further research is needed to determine its potential for active exploitation and the extent of its capabilities.

Sophos has identified a five-year campaign, dubbed “Pacific Rim”, by Chinese threat actors targeting network appliances, particularly Sophos firewalls. These attackers, including APT31, APT41/Winnti, and a third group, have employed a variety of tactics, including botnets, zero-days, custom malware, firmware backdoors, and UEFI implants, in attempts to compromise these devices. The UEFI implants, while not entirely new, are particularly concerning as they provide attackers with a persistent foothold on the firewall, potentially enabling them to gain control over the entire network. This campaign highlights the vulnerability of network appliances and the increasing sophistication of threat actors. Attackers are exploiting vulnerabilities, utilizing zero-day exploits, and implementing backdoors to gain access to sensitive data and gain a foothold in targeted organizations.

Intel has issued a security advisory regarding critical vulnerabilities found in the UEFI firmware of certain processors. These vulnerabilities, if exploited, could lead to privilege escalation, denial-of-service (DoS) attacks, or sensitive data leakage. Users are advised to wait for system manufacturers to release firmware updates to address these issues. The impact of these vulnerabilities is potentially widespread, as millions of devices may be affected. The security risks associated with these vulnerabilities are significant, as they could potentially grant attackers control over affected systems.

A significant vulnerability, known as PKFail, allows attackers to bypass Secure Boot mechanisms and potentially install UEFI bootkit malware. This vulnerability is present in a substantial number of firmware images, making a wide range of devices susceptible to these attacks. UEFI bootkits are capable of establishing persistence at a low level of the system, allowing attackers to maintain control even after OS reboots.