Critical Times Approach Windows and Linux Security

Time is placement of Windows and Linux users to change the cryptographic keys that protect their firmware-based systems UEFI Errorsa bad form of malware that loads before you use it and before malware protection starts.

Starting from June 24, the three certificates that guarantee that each part of the firmware and software that is loaded on the boot system will expire. A certificate signed by Microsoft is the linchpins of Secure Boot, a trust system developed by Microsoft. Boot Security checks the digital signature of all firmware that is loaded during boot to ensure that it comes from a trusted provider, such as the manufacturer of the motherboard being managed.

Security Protection is designed to prevent UEFI bootkits, a type of malware that modifies the Unified Extensible Firmware Interface, a successor to the BIOS, all of which start in the first sequence. Because these bootkits load the OS with a lot of other code, they are difficult to detect. Once installed, they can install malware on the OS that steals information, freezes the system, or does other malicious things. Even if the OS is protected, the bootkit can reboot the system. Bootkits survive OS updates.

A Brief History of Bootkits

The genesis of bootkits began in the early 1980s with the creation of several pieces of malware which checks the Apple II system during startup. They spread into the wild through floppy disks that apparently contained pirated games.

Windows bootkits became known in the early 2000s as proof of concept developed by offensive security researchers. BootRoot, bootkit showed at the 2005 Black Hat security conference, perhaps the first such event. The malware introduced the Network Driver Interface, which changed communication between protocol drivers that support functions such as TCP/IP network adapter drivers. In subsequent years, similar PoCs were incorporated vbootkitand Stone bootkitand Mebroot. There were many more.

In 2012, a new version of bootkit was introduced. Instead of targeting the system through the BIOS or master boot record, one Such a bootkit attacked Mac OS X systems by infecting EFI, a firmware package that started the boot process. A secondly The oldest bootkit targeting Windows 8 systems for booting UEFI boot kita guide to UEFI. Around 2013, a researcher introduced an advanced UEFI bootkit for Windows called Dreamboat.

The first known case of a real UEFI attack came in 2018 with the discovery of a malware known as malware. LoJax. A replica of the official anti-theft software known as LoJack, was created by a Kremlin-backed hacking group that went under names including Sednit, Fancy Bear, and APT 28. The malware was installed remotely using malware tools that can read and write parts of the flash memory of the UEFI firmware.

In 2020, researchers discovered a second known case of real-time malware attacking UEFI. Every time an infected device reboots, its UEFI checks to see if the malicious file was found in the Windows startup folder and, if not, installs it. Researchers from Kaspersky, the security provider that discovered the malware, called it “MosaicRegressor.” Researchers still don’t know how the compromised UEFIs got infected. Since then, new UEFI devices have appeared. They are marketed under names including ESpecter, FinSpy, and MoonBounce.

Necessity Is the Mother of Invention

In response to the growing threat of UEFI bootkits, Microsoft worked with hardware manufacturers to create Secure Boot, an industry standard that uses cryptographic signatures to ensure that each piece of firmware installed at boot is trusted by the computer manufacturer. Secure Boot is designed to create a level of trust that prevents attackers from replacing their intended firmware with malicious firmware. If one of the boot links is not recognized, Safe Boot prevents the device from booting.

Then in 2023, researchers found out LogoFaila number of problems found that UEFIs are starting on almost all Windows and Linux systems in the world. An image embedding error in software that displayed hardware manufacturers’ logos during startup allowed attackers to bypass Security Protection and infect UEFI with malicious firmware.