LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

Re:LoJax: First UEFI rootkit found in the wild, courtesy of ... by stordoff on Friday September 28, 2018 @01:09PM (#18095011)

> If Linux included functionality to have the firmware legitimately push applications

Does it need to? Is there anything stopping the firmware dropping, say, a systemd service on the disc?

[ Parent | on HN ]

Re:LoJax: First UEFI rootkit found in the wild, courtesy of ... by tinus_hn on Saturday September 29, 2018 @05:11AM (#18099431)

That’s not legitimate. This is a documented api the firmware can use to get Windows to run a binary at boot.

[ Parent | on HN ]

Re:LoJax: First UEFI rootkit found in the wild, courtesy of ... by CodeWriter23 on Friday September 28, 2018 @01:40PM (#18095301)

Or a start up script on SysV Init systems.

[ Parent | on HN ]

Re:LoJax: First UEFI rootkit found in the wild, courtesy of ... by sounds on Friday September 28, 2018 @02:21PM (#18095693)

Here are some easy ways to prevent UEFI from tampering with your drive:

Disable UEFI. https://github.com/corna/me_cleaner

Disable the ACPI hooks that register the kernel with UEFI. http://heim.ifi.uio.no/~knuto/kernel/4.14/admin-guide/kernel...

Use full disk encryption - unlike Microsoft Bitlocker which left backdoors for LoJack, linux vulnerabilities are publicized and you can update as soon as the patch appears on the internet.

Switch to a filesystem that the UEFI malware does not understand. Or move fields and magic numbers around in an existing filesystem to create a "custom" filesystem.

Or a combination of all of the above.

[ Parent | on HN ]