News for hackers. Stuff that matters.

A comment on LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group. Parent comment

Re:LoJax: First UEFI rootkit found in the wild, courtesy of ... by CodeWriter23 on Friday September 28, 2018 @01:40PM (#18095301)
Or a start up script on SysV Init systems.
[ Parent | on HN ]
Re:LoJax: First UEFI rootkit found in the wild, courtesy of ... by sounds on Friday September 28, 2018 @02:21PM (#18095693)
Here are some easy ways to prevent UEFI from tampering with your drive:

Disable UEFI. https://github.com/corna/me_cleaner

Disable the ACPI hooks that register the kernel with UEFI. http://heim.ifi.uio.no/~knuto/kernel/4.14/admin-guide/kernel...

Use full disk encryption - unlike Microsoft Bitlocker which left backdoors for LoJack, linux vulnerabilities are publicized and you can update as soon as the patch appears on the internet.

Switch to a filesystem that the UEFI malware does not understand. Or move fields and magic numbers around in an existing filesystem to create a "custom" filesystem.

Or a combination of all of the above.

[ Parent | on HN ]