Tag: UEFI

APT28 malware LoJax uses UEFI rootkit

~ hucktech ~ 4 Comments

 

https://thehackernews.com/2018/09/uefi-rootkit-malware.html?m=1

https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/

https://www.bleepingcomputer.com/news/security/apt28-uses-lojax-first-uefi-rootkit-seen-in-the-wild/

CVE-2018-12169: Tianocore UEFI: Unauthenticated Firmware Chain-of-Trust Bypass

~ hucktech ~ Leave a comment

https://twitter.com/qrs/status/1044157466349633537

https://twitter.com/qrs/status/1044157473882591233

“The issue was reported by Trammell Hudson”

https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12169

https://nvd.nist.gov/vuln/detail/CVE-2018-12169

https://exchange.xforce.ibmcloud.com/vulnerabilities/150223

UEFI-Stub-Loader: Load the Linux EFI Stub (or any EFI application) with command line boot options on systems that don’t support UEFI firmware command lines

~ hucktech ~ Leave a comment

Features:
* UEFI 2.x support for PCs, and it also works on Macs with 64-bit EFI (e.g. MacBook Pro Late 2013)
* Loads and executes kernels compiled as native 64-bit UEFI applications (like the Linux kernel)
* Passes user-written commands (from a plain UTF16 text file) to loaded EFI applications
* Allows arbitrary placement of itself in addition to kernel images on the EFI system partition
* Fits on a floppy diskette, and some systems can actually boot it from a floppy
* Minimal UEFI development environment tuned for Windows, Mac, and Linux included in repository (1)

https://github.com/KNNSpeed/UEFI-Stub-Loader

 

UefiPayloadPkg: UEFI Payload Project: supports Coreboot and Slim Bootloader

~ hucktech ~ 1 Comment

A freshly-created Github project:

https://github.com/BenjaminYou/UEFIPayload

UEFI Payload (UefiPayloadPkg) aims to be an upgrade to CorebootModulePkg and CorebootPayloadPkg. Features:
– Supporting Slim Bootloader in addition to Coreboot
– Source level configuration using .ini format
– User Extension using simple “C” codes
– Platform support library for adding platform specific codes

Lenovo ThinkPad X1 6en: Enabling S3 Sleep for Linux after Firmware Update

~ hucktech ~ Leave a comment

https://brauner.github.io/2018/09/08/thinkpad-6en-s3.html

sb-kmod-signload.sh: UEFI Secure Boot sign and load utility for Linux kernel modules

~ hucktech ~ Leave a comment

This script provides commands to sign a designated list of kernel modules and loads them via modprobe into the linux kernel. This was built to specfically address the issue of having to re-sign and reload kernel modules after upgrading the linux kernel, so they are not rejected by UEFI Secure Boot. (e.g. virtualbox kernel modules). As an example, this script is defaulted to load virtualbox kernel modules and will look for the private key and x509 cert in a specific directory. Please change these values inside the script as needed.[…]

https://github.com/plyint/sb-kmod-signload.sh

 

 

c-efi – UEFI Reference Specification Protocol Constants and Definitions

~ hucktech ~ Leave a comment

The c-efi project provides the protocol constants and definitions of the UEFI Reference Specification as native C11 code. The scope of this project is limited to those protocol definitions. The protocols are not actually implemented. As such, this project serves as base for any UEFI application that needs to interact with UEFI, or implement (parts of) the UEFI specification. Additionally to providing a C library, this project also serves as documentation base for UEFI programming in C. It provides target-triples for UEFI, bootstrap helpers, and a bunch of documentation how to get started.

https://github.com/c-util/c-efi

 

Linux UEFI firmware updates via LVFS at Linaro Connect

~ hucktech ~ Leave a comment

System Firmware and Device Firmware Updates using Unified Extensible Firmware Interface (UEFI) Capsules

Firmware is responsible for low-level platform initialization, establishing root-of-trust, and loading the operating system (OS). Signed UEFI Capsules define an OS-agnostic process for verified firmware updates, utilizing the root-of-trust established by firmware. The open source FmpDevicePkg in TianoCore provides a simple method to update system firmware images and device firmware images using UEFI Capsules and the Firmware Management Protocol (FMP). This session describes the EFI Development Kit II (EDK II) capsule implementation, implementing FMP using FmpDevicePkg, creating Signed UEFI Capsules using open source tools, and an update workflow based on the Linux Vendor Firmware Service (fwupd.org).

https://yvr18.pathable.com/meetings/740447

http://connect.linaro.org/schedule/

https://fwupd.org/