• _edge@discuss.tchncs.de
    ·
    1 year ago

    There are several ways to exploit LogoFAIL. Remote attacks work by first exploiting an unpatched vulnerability in a browser, media player, or other app and using the administrative control gained to replace the legitimate logo image processed early in the boot process with an identical-looking one that exploits a parser flaw. The other way is to gain brief access to a vulnerable device while it’s unlocked and replace the legitimate image file with a malicious one.

    In short, the adversary requires elevated access to replace a file on the EFI partition. In this case, you should consider the machine compromised with or without this flaw.

    You weren't hoping that Secure Boot saves your ass, were you?

    • plinky [he/him]
      ·
      1 year ago

      The worst part it persists through reinstalls (if i understood correctly)

        • Bitrot@lemmy.sdf.org
          ·
          edit-2
          1 year ago

          It can outlast those too.

          In many of these cases, however, it’s still possible to run a software tool freely available from the IBV or device vendor website that reflashes the firmware from the OS. To pass security checks, the tool installs the same cryptographically signed UEFI firmware already in use, with only the logo image, which doesn’t require a valid digital signature, changed.

    • Ithorian [comrade/them]
      ·
      1 year ago

      So if I have my computer set that it needs a sudo password for most changes am I good?

      • _edge@discuss.tchncs.de
        ·
        1 year ago

        Yes, that's my understanding. A normal user cannot do this. (And of course, an attacker shouldn't not control a local user in the first place.)

        Physical access is also a risk, but physical access trumps everything.

        • Ithorian [comrade/them]
          ·
          1 year ago

          Thanks for the answer. Unless my dog learns how to code I think I'm safe from anyone getting physical access

      • fl42v@lemmy.ml
        ·
        1 year ago

        Unless they find another way to escalate privileges... A bug, a random binary with suid, etc

    • timicin@lemmygrad.ml
      ·
      1 year ago

      You weren’t hoping that Secure Boot saves your ass, were you?

      i wonder if containerized firefox (eg snap/flatpak) will