BootHole - virtually every Linux distribution is affected

“BootHole” vulnerability in the GRUB2 bootloader opens up Windows and Linux devices using Secure Boot to attack. All operating systems using GRUB2 with Secure Boot must release new installers and bootloaders.

Making matters worse, Eclypsium says that a BootHole attack also works even when servers or workstations have Secure Boot enabled.

the hackers are able to supply your real passwords – most probably gleaned from the multiple corporate break-ins that have happened over the past few years – is a clever change to the traditional cyber-blackmail methodology.

Srđan Pavlović:A danas sam video grub update da je bio

Odma je usledio reinstall na sva tri kompa i jaci pass

What to do?
Apparently, Eclypsium’s bug report prompted not just a bug fix in GRUB but a code review looking for other smilar coding errors, given the extra severity of buffer overflows in the bootloader world.

So the GRUB team has removed not only this bug (CVE-2020-10713) but also seven more, denoted CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 CVE-2020-15705,CVE-2020-15706 and CVE-2020-15707.

With this in mind:

Check your Linux distro for an update to GRUB if you use it. If you don’t need the size and complexity of GRUB, you might consider switching to a different bootloader.

Consider monitoring your GRUB.CFG files for unauthorised modifications. If you don’t already have tools for doing this sort of thing, check out the command inotifywait. But remember that a criminal with root access to overwrite the GRUB configuration file in the first place might be able to turn off or bypass your change monitoring anyway.

Review who has root-level access to your servers. You should do this anyway, and regularly, as much to prevent accidents as to keep crimimals out.

Use 2FA whenever you can. This makes it easier to make sysadmins individually accountable, which protects them as much as it protects you, and it stops crooks using simple phishing or keylogging tricks alone to recover passwords.

Note that if you aren’t using Secure Boot, then your bootloader code isn’t protected by digital signature checking anyway, but it’s still worth considering all these tips, because it’s probably easier for crooks to mess with your bootloader via GRUB.CFG than by using low-level techniques to write to the bootloader files and disk sectors directly.

We suspect that there won’t be many computers out there that are pure-play Windows or Mac devices – ones that don’t have a Linux partition at all – running GRUB, but even if you aren’t affected directly by this bug…

…take heed of tips 3 and 4 anyway, because they’re good advice for everyone!

Living Light:
Jel postoji takav "Pasword Manager" i za WIN7?

Ne znam, pa pitam.
Ako ima neko volje da pomogne...

Izvinite sto to pitam u Linux temi,
ali je nekako povezano.
pOz

Branimir Maksimovic
Nije baš jasno, da li se radi o bug-u u firmware-u ili grubu...

In the course of Eclypsium’s analysis, we have identified a buffer overflow vulnerability in the way that GRUB2 parses content from the GRUB2 config file (grub.cfg). Of note: The GRUB2 config file is a text file and typically is not signed like other files and executables. This vulnerability enables arbitrary code execution within GRUB2 and thus control over the booting of the operating system. As a result, an attacker could modify the contents of the GRUB2 configuration file to ensure that attack code is run before the operating system is loaded. In this way, attackers gain persistence on the device.

Ivan Dimkovic:
Inace bug je fantasticni buffer overflow dok GRUB cita config file.



Brate mili, bootloader jbt - upada u komu citajuci config fajl i dozvoljava "arbitrary execution"... 2020: 1999 zvala i hoce svoj String I/O nazad :-)

"Krivica" UEFI konzorcijuma je sto su uopste prihvatili ovako idiotsku ideju (da jedan kljuc bude koriscen za sve 3rd party bootloadere, sto ga efektivno cini "too big to fail" tj. "too big to revocate").

A, da, UEFI nema ni mehanizam automatske revokacije kljuceva. Revokacija postoji, ali ce da se desi kad neko apgrejduje firmware (mislim...).

Mada, sta ce im uopste automatska revokacija kad imaju jedan kljuc za pola sveta :-)

Plus, sta god dodatno da su ubacili imali bi Richarda Stallmana za petama. "Bloody murder!".

After Eclypsium disclosed BootHole to multiple vendors, Canonical’s security team did their own research into potential new vulnerabilities in GRUB2, and discovered the following flaws: