3 ms·
Oh come on, how practical is this attack? I don't think Lenovo will default boot off a usb drive without user intervention. If you can get someone to run a USB
by drzaiusapelord 10y ago
Oh come on, how practical is this attack? I don't think Lenovo will default boot off a usb drive without user intervention.
If you can get someone to run a USB that'll boot you open the user up to a bazillion exploits already and already own the machine.
- JonathonW 10y agoThe readme at the linked Github repo mentions that it probably is exploitable from a running OS if you implement your own EFI_BASE_PROTOCOL.Communicate() function. I'm assuming that would probably need admin/root access to exploit, but it does mean that you can turn an OS-level privilege escalation bug into something substantially more persistent and difficult to recover from.