I actually am in the market for a new mobo and cpu.
Are there any mobo’s nowdays that don’t use UEFI? I just want an old traditional style BIOS with a jumper to restore it from a ROM chip if I get any malware, so I can actually trust my hardware.
I did force myself to deal with UEFI for the sake of windows, but gaming has gotten good enough on Linux, I don’t actually need to dual boot windows anymore.
As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.
So, does disabling the boot logo prevent the attack, or would it only make the attack obvious?
Not necessarily, I guess. They’re talking about a firmware upgrade of sorts, and, at least on the machines I own(ed), performing it didn’t reset user settings (which disabling the logo is)
It's rare that I get to feel anything remotely comforting about not being able to afford new hardware, but if I understand correctly, my BIOS-only dinosaur can't be exploited.
Still vulnerable to thousands of other exploits no doubt, but not this one.
Probably better than dying, high cholesterol is responsible for 7.1% of deaths in England alone. In 2022 that’s something like 40k deaths a year that could have been elimated.
For those of you who think you are using a local pharmacy, you might want to check whether or not they're owned by one of these. They buy out local pharmacies without obviously rebranding. And then they kill the store. At least, that's Rite Aid's MO.
As people have said in some of the many, many other threads on this subject, if they really wanted to copy someone else's style of full-screen error message they'd have done much better to go with "Guru Meditation"
arstechnica.com
Active