5 ms·
I think this exploit requires local administrative access. If an attacker already has this, you're pretty screwed to begin with. In other words, while this cou
by shimon 10y ago
I think this exploit requires local administrative access. If an attacker already has this, you're pretty screwed to begin with.
In other words, while this could definitely make an attack more damaging and harder to remove, it doesn't seem like a reason to stop using a computer that has decent software and physical security.
- bsilvereagle 10y agoThis exploit just requires physical, not administrative, access to the machine. You build an EFI "app", put it on a flash drive, and execute it from the UEFI shell.
- drzaiusapelord 10y agoOh come on, how practical is this attack? I don't think Lenovo will default boot off a usb drive without user intervention. If you can get someone to run a USB that'll boot you open the user up to a bazillion exploits already and already own the machine.
- JonathonW 10y agoThe readme at the linked Github repo mentions that it probably is exploitable from a running OS if you implement your own EFI_BASE_PROTOCOL.Communicate() function. I'm assuming that would probably need admin/root access to exploit, but it does mean that you can turn an OS-level privilege escalation bug into something substantially more persistent and difficult to recover from.
- wbkang 10y agoAny "physical" access is definitely way more privileged than just the local admin access.
- revelation 10y agoWell, physical access ranks higher than administrative. If an attacker has physical access, no system is secure, if only because the interface to the system is no longer.
- 45h34jh53k4j 10y agoits not longer fair to call game over with physical access; indeed countermeasure like full disk encryption, computrace and Mac firmware passwords are all examples of things we do to raise the difficulty for a physical attacker.
- revelation 10y agoAnd the vast majority of them is trivially defeated by a bug inline with your USB keyboard.
- startling 10y agoYou can reconstruct a lot of information with a keylogger but nowhere near all of it.
- umanwizard 10y agoOK, mind telling me how to get root on my iPhone, then? BTW, I have physical access.
- pritambaral 10y agoThe thread above is not talking about a locked down, limited-freedom device like an iPhone. Laptop computers come with the ability to boot from external devices, unlocked and unrestricted.