Researchers have discovered the first UEFI bootkit designed specifically for Linux systems , called Bootkitty.
See also: Sophos: Chinese hackers are attacking network devices
This discovery marks a pivotal moment in the evolution of UEFI threats, which have traditionally targeted Windows systems.
The UEFI threat landscape has made significant progress over the past decade. Starting with Andrea Allievi 's PoC in 2012, the field has progressed to real threats like ESPecter and FinSpy in 2021, culminating in the infamous BlackLotus bootkit in 2023. However, Bootkitty represents a new frontier by specifically targeting Linux systems.
In addition to this, cybersecurity analysts at ESET noted that Bootkitty appears to be a PoC and not an actively developing threat.
Its primary objectives include:
- Disabling kernel signature verification
- Preloading two unknown ELF binaries via Linux init process
See also: Phoenix UEFI vulnerability affects hundreds of Intel computer models
The bootkit contains several artifacts that indicate its experimental nature, including unused functions that display ASCII art and a list of possible authors.
While the current version of Bootkitty may not pose an immediate threat to most Linux systems, its existence highlights the need for enhanced security measures.
The researchers also discovered a potentially related unsigned kernel module called BCDropper, which deploys an ELF binary (BCObserver) responsible for loading another unknown kernel module. While the connection to Bootkitty has not been confirmed, these components share similar characteristics and naming conventions.
Security analysts have urged active vigilance and along with that proactive security measures will be essential to protect Linux systems from sophisticated UEFI-based attacks
See also: LogoFAIL bugs in UEFI code allow bootkits to be installed via images
Linux servers are known for their stability, security, and flexibility, making them a popular choice for businesses of all sizes. They use the Linux operating system , which allows for extensive customization and optimization to meet specific needs. The open-source nature also means that a global community constantly contributes to maintaining and improving the platform, ensuring strong security features and the latest updates. Linux servers are ideal for hosting websites, managing networks, and handling high-volume transactions due to their ability to operate efficiently under a variety of workloads.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
