Re:Plug’nPwn – Connect to Jailbreak
by Nextgrid on Tuesday October 13, 2020 @11:54AM
(#24766769)
To me it seems like it would be persistent. They modified the EFI application which is the first thing that runs when the computer is booted.
A backdoor in there can wait for the user to type in their full disk encryption password, mount the disk, replace the kernel binary with a malicious version and then boot the system.
For good measure, repeat the above steps upon each system boot in case a system update or something overwrote the backdoored kernel.
---
This is actually similar to how Computrace/LoJack worked, except that one didn't defeat full disk encryption and would only place its payload onto unencrypted disks.
A backdoor in there can wait for the user to type in their full disk encryption password, mount the disk, replace the kernel binary with a malicious version and then boot the system.
For good measure, repeat the above steps upon each system boot in case a system update or something overwrote the backdoored kernel.
---
This is actually similar to how Computrace/LoJack worked, except that one didn't defeat full disk encryption and would only place its payload onto unencrypted disks.