2 ms·
And that if the attacker has admin and physical access to Windows they can just install GRUB from there, then exploit that to install a rootkit to persist their
by SAI_Peregrinus 6y ago
And that if the attacker has admin and physical access to Windows they can just install GRUB from there, then exploit that to install a rootkit to persist their access.
- usr1106 6y agoDo you really need physical access for that? Grub is not signed by Microsoft CA, only shims are. So the exploit is installing an old shim and a vulnerable grub.