LogoFAIL: UEFI Vulnerabilities Expose Devices to Stealth Malware Attacks

The Unified Extensible Firmware Interface (UEFI) code from several unbiased firmware/BIOS sellers (IBVs) has been uncovered susceptible to possible attacks as a result of large-effect flaws in impression parsing libraries embedded into the firmware.

The shortcomings, collectively labeled LogoFAIL by Binarly, “can be employed by menace actors to deliver a malicious payload and bypass Secure Boot, Intel Boot Guard, and other security systems by design and style.”

On top of that, they can be weaponized to bypass security options and deliver persistent malware to compromised devices for the duration of the boot phase by injecting a destructive brand impression file into the EFI system partition.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Although the issues are not silicon-certain, indicating they effects the two x86 and ARM-centered gadgets, they are also UEFI and IBV-specific. The vulnerabilities comprise a heap-dependent buffer overflow flaw and an out-of-bounds study, specifics of which are envisioned to be designed general public later on this 7 days at the Black Hat Europe meeting.

Precisely, these vulnerabilities are activated when the injected pictures are parsed, foremost to the execution of payloads that could hijack the stream and bypass security mechanisms.

“This attack vector can give an attacker an edge in bypassing most endpoint security options and providing a stealth firmware bootkit that will persist in an ESP partition or firmware capsule with a modified emblem impression,” the firmware security enterprise reported.

In accomplishing so, menace actors could get entrenched manage more than the impacted hosts, ensuing in the deployment of persistent malware that can fly under the radar.

Compared with BlackLotus or BootHole, it’s truly worth noting that LogoFAIL does not break runtime integrity by modifying the boot loader or firmware element.

The flaws have an effect on all main IBVs like AMI, Insyde, and Phoenix as effectively as hundreds of consumer and company-grade gadgets from distributors, such as Intel, Acer, and Lenovo, building it both intense and popular.

The disclosure marks the initially general public demonstration of attack surfaces related to graphic impression parsers embedded into the UEFI method firmware due to the fact 2009, when researchers Rafal Wojtczuk and Alexander Tereshkin introduced how a BMP graphic parser bug could be exploited for malware persistence.

“The sorts – and sheer volume – of security vulnerabilities learned […] clearly show pure merchandise security maturity and code high quality in typical on IBVs reference code,” Binarly pointed out.

Located this article interesting? Stick to us on Twitter  and LinkedIn to study far more distinctive articles we article.