5 ms·

I wasn’t aware that one could just copy paste and replace arbitrary UEFI boot files from user space? I was under the impression that they are in non-mounted par

by yunohn 3y ago

I wasn’t aware that one could just copy paste and replace arbitrary UEFI boot files from user space? I was under the impression that they are in non-mounted partitions controlled by the system.

airhangerf15 3y ago
You can comment out /boot/efi on Linux from the fstab, and only mount it when you need to run a grub update. I'm not sure which Linux systems keep it mounted by default (I suspect most of them do, mostly for grub updates) I don't think Windows mounts it by default anywhere. At the same time, on Windows or Linux, you would need root/Administrator access to inject this, wouldn't you? You could inject any binary. I guess the thing here is that if you just replace the bootloader, secure boot should stop the boot process with your unsigned binary. With this exploit, you can replace the logo and it doesn't do the same signature check?
- yjftsjthsd-h 3y ago
  > I guess the thing here is that if you just replace the bootloader, secure boot should stop the boot process with your unsigned binary. With this exploit, you can replace the logo and it doesn't do the same signature check? Exactly; most vendors apparently check signatures on anything officially executable but will blindly load any picture you hand them.
- yunohn 3y ago
  But you would need sudo access to create a malicious bootloader partition and edit fstab. And indeed on Windows, I’ve never seen the bootloader mounted. Maybe I’m missing something in the disclosure?
  - beeboobaa 3y ago
    You can just write to the disk as administrator on windows. No need to mount anything though you could probably do that too.
    - ikekkdcjkfke 3y ago
      How nice that asking for indiscriminate admin access is a must to install most programs Installer: Hey, can i create a folder in Program Files? Windows: nuclear launch codes
  - gunapologist99 3y ago
    How are you going to admin a Linux system without sudo or doas? (and even if you're protecting it with a password, the script can just silently wait and keep trying)
    - yunohn 3y ago
      If I run `sudo apt update`, how can an unrelated script get admin access?

by yunohn 3y ago

I wasn’t aware that one could just copy paste and replace arbitrary UEFI boot files from user space? I was under the impression that they are in non-mounted partitions controlled by the system.

airhangerf15 3y ago

You can comment out /boot/efi on Linux from the fstab, and only mount it when you need to run a grub update. I'm not sure which Linux systems keep it mounted by default (I suspect most of them do, mostly for grub updates) I don't think Windows mounts it by default anywhere. At the same time, on Windows or Linux, you would need root/Administrator access to inject this, wouldn't you? You could inject any binary. I guess the thing here is that if you just replace the bootloader, secure boot should stop the boot process with your unsigned binary. With this exploit, you can replace the logo and it doesn't do the same signature check?

yjftsjthsd-h 3y ago
> I guess the thing here is that if you just replace the bootloader, secure boot should stop the boot process with your unsigned binary. With this exploit, you can replace the logo and it doesn't do the same signature check? Exactly; most vendors apparently check signatures on anything officially executable but will blindly load any picture you hand them.
yunohn 3y ago
But you would need sudo access to create a malicious bootloader partition and edit fstab. And indeed on Windows, I’ve never seen the bootloader mounted. Maybe I’m missing something in the disclosure?
- beeboobaa 3y ago
  You can just write to the disk as administrator on windows. No need to mount anything though you could probably do that too.
  - ikekkdcjkfke 3y ago
    How nice that asking for indiscriminate admin access is a must to install most programs Installer: Hey, can i create a folder in Program Files? Windows: nuclear launch codes
- gunapologist99 3y ago
  How are you going to admin a Linux system without sudo or doas? (and even if you're protecting it with a password, the script can just silently wait and keep trying)
  - yunohn 3y ago
    If I run `sudo apt update`, how can an unrelated script get admin access?