This week's Community Spotlights are:
LW Community: Forgotten Weapons ([email protected]) - A community dedicated to discussion around historical arms, mechanically unique arms, and Ian McCollum’s Forgotten Weapons content.
Mod(s): @[email protected]
How to submit a community you would like to see spotlighted
An oldie, but a goodie
I already have the desktop app, what difference should this even make? Pointless gatekeeping by the devs
Tesla Whistleblower Says 'Autopilot' System Is Not Safe Enough To Be Used On Public Roads::"It affects all of us because we are essentially experiments in public roads."
Firmware security company Binarly on Wednesday disclosed the details of an attack method that can be used to compromise many consumer and enterprise devices by leveraging malicious UEFI logo images.
The attack method, dubbed LogoFAIL, exploits vulnerabilities in the image parsers used by the UEFI firmware to display logos during the boot process or in the BIOS setup. Getting the affected parsers to process a specially crafted image can enable the attacker to hijack the execution flow and run arbitrary code.
Hackers can use the LogoFAIL attack to compromise the entire system and bypass security measures such as Secure Boot.
“These vulnerabilities can compromise the entire system’s security, rendering ‘below-the-OS’ security measures like any shade of Secure Boot ineffective, including Intel Boot Guard. This level of compromise means attackers can gain deep control over the affected systems,” Binarly explained.
Binarly’s analysis showed that UEFI vendors use various types of parsers for BMP, PNG, JPEG, GIF and other types of images. The security firm’s research targeted firmware from Insyde, AMI and Phoenix and led to the discovery of two dozen vulnerabilities, more than half of which have been assigned a ‘high severity’ rating.
The impacted firmware is shipped with hundreds of consumer and enterprise computer models — including x86 and ARM-based devices — made by companies such as Acer, Dell, Framework, Fujitsu, Gigabyte, HP, Intel, Lenovo, MSI, Samsung, and Supermicro. This means millions of devices worldwide could be exposed to attacks.
A LogoFAIL attack can be launched by abusing the firmware update procedure to replace the legitimate logo with a malicious version. Attacks through physical access may also be possible, using an SPI flash programmer, assuming that the logo is not protected by hardware verified boot technologies.
Some vendors — this includes Intel, Acer and Lenovo — offer features that enable users to customize the logos displayed during boot, which can make it possible to launch LogoFAIL attacks from the OS, without the need for physical access to the device.
It’s important to note that while image parser vulnerabilities have been found in devices from all of the aforementioned vendors, they cannot always be exploited. In Dell’s case, for instance, the logo is protected by Intel Boot Guard, which prevents its replacement even if the attacker has physical access to the targeted system. In addition, Dell does not offer any logo customization features.
Details of the attack were presented by Binarly at the Black Hat Europe conference on Wednesday, and the company has published a technical blog post describing its findings.
The security firm has published a video showing a proof-of-concept (PoC) LogoFAIL exploit in action, demonstrating how an attacker who has admin permissions on the operating system can escalate privileges to the firmware level.
The vulnerabilities were reported to impacted vendors through CERT/CC several months ago, but it can take a lot of time for patches for these types of security holes to reach end devices, even if vendors create the fixes.
Ryan Cohen became chairman on June 9 2021.
How has the company's financial standing change since then?
Although legal, the time frame and approach seems designed to shield the company from negligence.
550 paracord, simple cobra braid, bic lighter, singer brand scissors.
2,419 users here now
The World's Internet Frontpage Lemmy.World is a general-purpose Lemmy instance of various topics, for the entire world to use.
Be polite and follow the rules (https://legal.lemmy.world/fair-use/).
See the Getting Started Guide
If you would like to make a donation to support the cost of running this platform, please do so at the mastodon.world donation URLs:
LW Legal & Help Center
Join the team 😎
Questions / Issues
- Questions/issues post to
- To open a ticket
- Reporting is to be done via the reporting button under a post/comment.
- https://a.lemmy.world - Alexandrite UI
- https://photon.lemmy.world - Photon UI
- https://m.lemmy.world - Voyager mobile UI
- https://old.lemmy.world - A familiar UI
- Miscellaneous: https://status.lemmy.world/ - Lemmy World Status