arstechnica.com

Truck_kun, to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

I actually am in the market for a new mobo and cpu.

Are there any mobo’s nowdays that don’t use UEFI? I just want an old traditional style BIOS with a jumper to restore it from a ROM chip if I get any malware, so I can actually trust my hardware.

I did force myself to deal with UEFI for the sake of windows, but gaming has gotten good enough on Linux, I don’t actually need to dual boot windows anymore.

Am I asking too much?

yum13241,

No, and trying to use a pure BIOS system these days is a headache.

You can always just reflash your firmware from a trusted OS via FWUPD.

kelvie, to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

So I don’t get it, I have my entire boot image in a signed EFI binary, the logo is in there as well. I don’t think I’m susceptible to this, right? I don’t think systemd-boot or the kernel reads an unsigned logo file anywhere. (Using secure boot)

clmbmb,

This is way before reaching your bootloader. It’s about the manufacturer logo that’s displayed by UEFI while doing the whole hardware initialization.

kelvie,

That’s… Stored in the EFI partition or changeable in userspace?

clmbmb,

Depending on how the UEFI is configured, a simple copy/paste command, executed either by the malicious image or with physical access, is in many cases all that’s required to place the malicious image into what’s known as the ESP, short for EFI System Partition, a region of the hard drive that stores boot loaders, kernel images, and any device drivers, system utilities, or other data files needed before the main OS loads.

(from the article)

kelvie,

Right, I know EFI images are stored in the EFI partition, but with secure boot, only signed images can be executed, so they’d need to steal someone’s signing key to do this.

olafurp, to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

On Linux/Mac you have no use sudo. For sudo you need a password.

This thing will make it very easy to make a rubber ducky though.

HiddenLayer5, (edited )
@HiddenLayer5@lemmy.ml avatar

Would be pretty easy to pull off if you had hardware access. Just boot from a flash drive and drop the exploit from there.

Even if their OS is full disk encrypted, this can easily inject a backdoor or just keylog the bootup password prompt.

HiddenLayer5, (edited ) to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack
@HiddenLayer5@lemmy.ml avatar

I’ve never been a fan of the UEFI logo inserting itself into the boot screen. It’s basically just an advertisement for the hardware vendor because they’re jealous of the OS having the spotlight. And it’s an ad that, like so many other ads before it, screws over the security and privacy of the advertisee because fuck you that’s why.

ddkman,

I don’t know. It looks more aesthetically consistent. Your computer has to display something. Average users would be scared if it dumped logs on the display. so the vendor logo makes sense. It COULD just say loading, but this is a bit pedantic I think.

azertyfun,

??

With BIOS, it goes “Motherboard Logo -> OS Logo”

With UEFI, it goes “Motherboard Logo -> Motherboard Logo”

Sure, it’s more consistent, but the alternative is not user unfriendly, the only people it’s unfriendly to is the marketing wankers at Dell, Lenovo, Acer, etc.

nik282000,
@nik282000@lemmy.ca avatar

When it comes to security, particularly at boot time, fuck the user. Users don’t interact with devices at boot time so it doesn’t matter if it shows a blank screen, a mile of logs or a screaming clown penis. If it was up to users no device or service would have a password or security of any kind, and every byte of information about your life would be owned by 'The Cloud." Let the marketing wanks insert their logo into the Windows boot process,

jabib,

Tell me more about this screaming clown penis option…

nik282000,
@nik282000@lemmy.ca avatar

You gotta hold ctrl alt shift honk at power up.

0xD,

I want to insert my own logo into the boot process, and I want these ducking vendors to properly validate and assess their mother ducking software. But nooo, penetration tests and any remediations are too expensive for these pieces of bit. Why do it when you can just stick your dick in everyone’s face, right?

Fuck.

HiddenLayer5, (edited ) to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack
@HiddenLayer5@lemmy.ml avatar

The article didn’t mention this, but would disabling the UEFI logo in the boot screen mitigate the vulnerability until proper patches get rolled out? (Or honestly at this point, I’d keep it disabled even after it’s patched in case they didn’t patch it right. UEFI’s are all proprietary so it’s not like you can check.) Since the vulnerability is in the image parser, would bypassing that be enough?

Do they even let you disable it?

const_void,
Hagarashi8, to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

I may be wrong, but does it mean that if someone is able to modify my uefi - they would be able to inject virus in booting image?

BellaDonna,

Yes, that is exactly the implication

buwho, to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

is it common practice to have a web browser or media player running with elevated permissions? seems like a strange thing to do…

Acters,

Very unlikely unless there is an elevated privilege exploit to use alongside this

const_void, to linux in Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

We need more machines that support coreboot. These proprietary firmware vendors have been getting rich off making our machines worse for too long.

Manbart,
@Manbart@beehaw.org avatar

A flashed Chromebook is an accessible option

mrchromebox.tech

downdaemon,
@downdaemon@lemmy.ml avatar

i use coreboot but i’d prefer libreboot if a gaming level system with linux supported it. Are their any? I ask to the masses, not you specifically lol

youngGoku, to linux in New systemd update will bring Windows’ infamous Blue Screen of Death to Linux | Ars Technica

This is a joke, right?

youngGoku,

When the system crashes?

So very rarely I guess.

ardent_abysm,
@ardent_abysm@lemm.ee avatar

It is a real, and useful feature, while also being a joke.

Cralder,

It’s real. A bluescreen is literally just an error message displayed in fullscreen so it’s not as weird as it sounds

virr,

More of it will display the LOG_EMERG message instead of just stopping without displaying anything.

There are some headless servers I’d prefer to just reboot, but unless actual hardware is faulty I would not be too worried about it.

colourlesspony, to linux in New systemd update will bring Windows’ infamous Blue Screen of Death to Linux | Ars Technica

At first I was like WTF but actually it makes sense. A screen showing an error code is much better than a hard reset, blinking cursor, kernel panic, or just black screen you usually get when something bad happens on linux.

carlytm, to linux in New systemd update will bring Windows’ infamous Blue Screen of Death to Linux | Ars Technica

At last, the Year of the Linux Desktop.

kbal, to linux in New systemd update will bring Windows’ infamous Blue Screen of Death to Linux | Ars Technica
@kbal@fedia.io avatar

As people have said in some of the many, many other threads on this subject, if they really wanted to copy someone else's style of full-screen error message they'd have done much better to go with "Guru Meditation"

westyvw, (edited ) to linux in New systemd update will bring Windows’ infamous Blue Screen of Death to Linux | Ars Technica

What a sensational, over blown article. ArsTechnica this is shitty journalism and you should know it.

The headline would be about as correct if it said “SystemD update will bring Amiga’s Guru Meditation screen to Linux.”

This update has nothing to do with Windows. Error displays with additional information about the crash is not exclusive to windows, nor new. In fact a Kernel Panic screen happened in Unix.

Waluigis_Talking_Buttplug,

The majority of linux articles have me checking the comments first to see if someone talks about ridiculous click bait crap, honestly saved me a lot of time.

muhyb,

I was sick of Reddit’s clickbait titles. It’s sad to see they moved here as well.

Waluigis_Talking_Buttplug,

To be fair, it’s the articles themselves

muhyb,

I suppose that’s the main problem, I didn’t check the article since the title reeks clickbaity enough. However I wouldn’t share an article if the the title obviously is a clickbait, I’m sure there are bunch of respectable sources about this development.

mex,

To be fair, it is called a BSOD, which is a term widely associated with Windows.

melroy, to linux in New systemd update will bring Windows’ infamous Blue Screen of Death to Linux | Ars Technica
@melroy@kbin.melroy.org avatar

What?? No no.. Please no.

dotslashme, (edited ) to privacyguides in CVS, Rite Aid, Walgreens hand out medical records to cops without warrants

I might be pretty stupid, but why would police even want medical information? In what way are medical records a help in any police duty?

Edit: thanks for the responses. My only comment is that these examples are fucking terrifying.

520,

Helps a cop gain evidence against a perp.

"You're on this medication, we got it from X pharmacy. You shouldn't have been driving while on it, should you?"

Jarlsburg, (edited )

I worked at a pharmacy and the only time it actually happened was when a patient tried to sell their Vicodin to an undercover cop outside the store. The cop came in and asked for the information about the prescription and we gave it to him.

princessnorah,
@princessnorah@lemmy.blahaj.zone avatar

Freely admits on the internet to violating someone’s right to due process. But they were a druggie, so no biggie right?

Jarlsburg, (edited )

Yeah, I didn’t say any of that but ok. HIPAA/employers actually require you to give law enforcement information in a variety of situations, including specifically the situation I mentioned:

To report PHI that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity’s premises (45 CFR 164.512(f)(5)).

HHS - When does the Privacy Rule allow covered entities to disclose information to law enforcement

mx_smith,

Is that without a warrant? It wouldn’t be hard to impersonate a cop or even a cop with a grudge against someone to come find out what medications they are taking to dig further into someone’s lives and ruin said life.

Jarlsburg,

Yes, without a warrant. It’s in the Privacy Notice in any retail pharmacy.

Impersonating a cop is a pretty big step that’s illegal in its own right but we did have moms trying to see if their adult daughter was on birth control, but that’s pretty easy to stop. Just lock their profile and ask the patient to make up a passcode or only deal with them in person.

GnomeKat,
@GnomeKat@lemmy.blahaj.zone avatar

bootlicker

HootinNHollerin,
@HootinNHollerin@sh.itjust.works avatar

Tell him to come back with a warrant

Imgonnatrythis,

Finding weaknesses. If a person has breathing difficulties they can save time and don’t need to put their knee on their neck for so long.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • localhost
  • All magazines
  • Loading…
    Loading the web debug toolbar…
    Attempt #