Connect with us

Published

on

MORE FUN WITH FIRMWARE — Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack UEFIs booting Windows and Linux devices can be hacked by malicious logo images.

Dan Goodin – Dec 6, 2023 3:02 pm UTC EnlargeGetty Images reader comments 195

Hundreds of Windows and Linux computer models from virtually all hardware makers are vulnerable to a new attack that executes malicious firmware early in the boot-up sequence, a feat that allows infections that are nearly impossible to detect or remove using current defense mechanisms.

The attackdubbed LogoFAIL by the researchers who devised itis notable for the relative ease in carrying it out, the breadth of both consumer- and enterprise-grade models that are susceptible, and the high level of control it gains over them. In many cases, LogoFAIL can be remotely executed in post-exploit situations using techniques that cant be spotted by traditional endpoint security products. And because exploits run during the earliest stages of the boot process, they are able to bypass a host of defenses, including the industry-wide Secure Boot, Intels Secure Boot, and similar protections from other companies that are devised to prevent so-called bootkit infections. Game over for platform security

LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a years worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware.

The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs. The researchers unveiled the attack on Wednesday at the Black Hat Security Conference in London. Advertisement

The affected parties are releasing advisories that disclose which of their products are vulnerable and where to obtain security patches. Links to advisories and a list of vulnerability designations appears at the end of this article.

As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.

Once arbitrary code execution is achieved during the DXE phase, its game over for platform security, researchers from Binarly, the security firm that discovered the vulnerabilities, wrote in a whitepaper. From this stage, we have full control over the memory and the disk of the target device, thus including the operating system that will be started.

From there, LogoFAIL can deliver a second-stage payload that drops an executable onto the hard drive before the main OS has even started. The following video demonstrates a proof-of-concept exploit created by the researchers. The infected devicea Gen 2 Lenovo ThinkCentre M70s running an 11th-Gen Intel Core with a UEFI released in Juneruns standard firmware defenses, including Secure Boot and Intel Boot Guard. LogoFAIL.

In an email, Binarly founder and CEO Alex Matrosov wrote:

LogoFAIL is a newly discovered set of high-impact security vulnerabilities affecting different image parsing libraries used in the system firmware by various vendors during the device boot process. These vulnerabilities are present in most cases inside reference code, impacting not a single vendor but the entire ecosystem across this code and device vendors where it is used. This attack can give a threat actor an advantage in bypassing most endpoint security solutions and delivering a stealth firmware bootkit that will persist in a firmware capsule with a modified logo image. Page: 1 2 3 4 Next → reader comments 195 Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars

Continue Reading

Politics

Wes Streeting denies Labour has made ‘mistakes’ with ‘unpopular’ policies despite poor local election results

Published

on

By

Wes Streeting denies Labour has made 'mistakes' with 'unpopular' policies despite poor local election results

Health Secretary Wes Streeting has defended “unpopular” policies such as the cut to the winter fuel allowance despite Labour’s poor performance at the local elections.

Mr Streeting denied the government had made any mistakes when asked whether the policy was partly to blame for the party losing 189 council seats less than a year since the General Election.

Since coming into government last July, Labour has enacted a number of policies that were not in its manifesto.

These include means-testing winter fuel payments for pensioners, increasing employers’ national insurance contributions and slashing £5bn from the welfare bill.

Asked what mistakes his government had made so far that had led to its drubbing at the ballot box, Mr Streeting told Sunday Morning with Trevor Phillips: “Well, we will make plenty of mistakes.”

Politics latest: Lucy Powell ‘right’ to apologise for grooming gangs comments

Pressed again on whether he believed “mistakes” had been made, the health secretary replied: “No. When we made those choices, we knew they would be unpopular. And we knew that they would be opposed.

“The reason we made those choices is because we genuinely believe they’re the right choices to get the country out of the massive hole it was left in. And right across the board. Whether it’s the NHS, whether it’s schools, whether it’s prisons, whether it’s our defence and security, whether it’s crime and policing, there were enormous challenges facing this country when we came in.

“And we’ve had to make big and sometimes unpopular decisions so that we can face those challenges and deal with them. People might thank us if we just kind of go for the easy but we want to make the right choices.”

Some Labour MPs have urged the government to change direction, with one telling Sky News the cut to winter fuel was a “catastrophic error” that must be “remedied” if the party is to see any improvement in public opinion.

Others have warned that in courting Reform voters, the party risks fracturing its coalition of voters on the left who may be tempted by the Liberal Democrats and Green Party.

However, in the aftermath of the local elections, Sir Keir Starmer suggested the poor results meant he needed to go “further and faster” in delivering his existing agenda.

Please use Chrome browser for a more accessible video player

Inside Reform’s election success

The real victor to emerge from Thursday’s local elections was Reform UK, which won control of 10 councils and picked up 677 council seats largely at the expense of the Conservatives in the south.

However, Reform also won the Runcorn by-election from Labour by just six votes, as well as control of Doncaster Council from Labour – the only local authority it had control of in this set of elections – in a significant win for Nigel Farage and his party.

The Reform UK leader declared that two-party politics was now “finished” and that his party was now the official “opposition” to Labour.

Asked whether the results meant that Labour would now treat Reform as “your most serious opposition”, Mr Streeting said: ” I certainly do treat them as a serious opposition force.”

“As I say, I don’t know whether it will be Reform or the Conservatives that emerge as the main threat,” he added.

“I don’t have a horse in that race, but like alien versus predator, I don’t really want either one to win.”

Read more:
Reform’s mission to ‘remoralise’ young people
Reform has put the two traditional parties on notice

Please use Chrome browser for a more accessible video player

Reform UK are ‘fighting force’

Tory Party chairman Nigel Huddleston said Reform UK was not just a protest party and that Mr Farage was “a force in British politics”.

He told Trevor Phillips: “But the one thing about Nigel Farage is, and we’re seeing this again and again and again, he is a populist.

“He is increasingly saying everything that anybody wants to hear. He’s trying to be all things to all men.”

“We are establishing ourselves as a credible alternative government based on sound conservative principles and values and our values and our principles, and therefore our policies, will define the future of our party,” he added.

Continue Reading

Environment

It’s back: Hyundai IONIQ 5 qualifies for $7,500 tax credit – again!

Published

on

By

It's back: Hyundai IONIQ 5 qualifies for ,500 tax credit – again!

The Hyundai IONIQ 5 got a raft of upgrades and sporty, rally-focused XRT trim level for 2025 – but the biggest upgrade for the Made in America Hyundai might be this: the 5 has regained eligibility for the full $7,500 federal EV tax credit!

Despite being assembled at Hyundai’s Georgia meta plant for the last four month, the 2025 Hyundai IONIQ 5 was nowhere to be found on the EPA’s list of rebate-eligible vehicles. But that was then – with a fresh updated to the list coming online May 1st, Hyundai’s new-age electric hot hatch is back in the rebate game.

It’s worth noting that lease customers had been able to access the incentive under some circumstances, but this latest update to the EPA list makes it possible for cash and payment buyers to take advantage of the full Federal incentive, too – as long as they earn less than $300,000 as a married couple filing jointly, less than $225,000 as a head of household, or less than $150,000 as an individual.

With the $7,500 federal tax credit in the equation, you can get a new 2025 IONIQ 5 for somewhere in between $36,575 and $49,475, well under the $80,000 Federal MSRP cap.

Advertisement – scroll for more content

Victory lap

As if to celebrate, Hyundai announced that it was taking on the celebrate One Lap of America road rayy and race event in a factory collaboration with the track-focused enthusiasts at Grassroots Motorsports this week with One Lap veterans Andy Hollis and Tom Suddard campaigning a stock, 601 hp 2025 Hyundai IONIQ 5 N in the Alternative Fuels class.

“After winning our class in a gutted, caged race car last year, we wanted to compete in the best-of-all worlds this year: A vehicle that’s incredibly fast, incredibly comfortable on a road trip, and incredibly capable on a racetrack,” explains Suddard. “Electrification means it’s finally possible to have huge power without huge compromises in a street car, and the IONIQ 5 N promises to pair that huge power with the durability and capability to survive a week of racing.”

One Lap is widely regarded as one of the toughest street-legal motorsports events in the world, pitting amateur and professional drivers alike compete in stock and heavily modified vehicles of every description, battling it out in a series of scored challenges, including timed events at road courses, drag strips, skid pads, and autocross courses.

In between tracks, competitors safely travel thousands of miles around the country, proving the mettle and durability of the vehicles and the teams that drive them. This year, 86 teams from all over the country will compete in 17 scored events over the course of eight days at tracks like Virginia International Raceway and NCM Motorsports Park.

The Tire Rack One Lap of America is currently underway – you can track the Hyundai’s progress here, then let us know what you think of this new tax development in the comments.

SOURCES | IMAGES: Hyundai, One Lap of America; FuelEconomy.gov.


Your personalized solar quotes are easy to compare online and you’ll get access to unbiased Energy Advisors to help you every step of the way. Best of all? Contractors won’t call you unless you give them your number. Get started here.

FTC: We use income earning auto affiliate links. More.

Continue Reading

Politics

It is ‘feasible’ Nigel Farage could be the next prime minister, says Kemi Badenoch

Published

on

By

It is 'feasible' Nigel Farage could be the next prime minister, says Kemi Badenoch

Kemi Badenoch has admitted it is “feasible” that Nigel Farage could become the next prime minister.

The Tory leader told the BBC’s Sunday With Laura Kuenssberg programme Mr Farage’s party was “expressing the feeling of frustration that a lot of people around the country are feeling” – but added it was her job to “come up with answers and solutions”.

Asked if it was feasible that Mr Farage could be the next prime minister, she cited how Australian Prime Minister Anthony Albanese had won re-election this weekend.

“As I said, anything is feasible,” she said. “Anthony Albanese: people were writing him off. He has just won a landslide, but my job is to make sure that he [Farage] does not become prime minister because he does not have the answers to the problems the country is facing.”

Politics latest: Lucy Powell ‘right’ to apologise for grooming gangs comments

Please use Chrome browser for a more accessible video player

Could Nigel Farage be prime minister?

Asked what Mr Farage was doing right, Ms Badenoch said: “He is expressing the feeling of frustration that a lot of people around the country are feeling.

“But he also doesn’t have a record in government like the two main parties do. Now he’s going to be running some councils. We’ll see how that goes.”

Mr Farage was the undoubted winner of Thursday’s local elections, in which 23 councils were up for grabs.

His party picked up 677 council seats and took control of 10 councils.

By contrast, the Conservatives lost 677 council seats as well as control of 18 councils in what was their worst local elections performance on record.

Mr Farage said the outcome spelt the end of two-party politics and that his party was now the official “opposition” to Labour – with the Tories having been rendered a “waste of space”.

Read more:
Reform has put the two traditional parties on notice

‘I get it’: Starmer responds after losing Runcorn by-election

Ms Badenoch said she believed the vote for Mr Farage on Thursday was partly down to “protest” but added: “That doesn’t mean we sit back. We are going to come out fighting.

“We are going to come out with the policies that people want to see, but what we are not going to do is rush out and tell the public things that are not true just so we can win votes.

“This is not about winning elections; this is about fixing our country. Yes, of course, you need to win elections to do that, but you also need a credible plan.”

Please use Chrome browser for a more accessible video player

‘Farage is a force in British politics’

Conservative co-chairman Nigel Huddleston sought to play down the threat from Reform UK, telling Sky News: “When they’re in a position of delivering things, that’s when the shine comes off.”

He told Sunday Morning with Trevor Phillips: “The one thing about Nigel Farage is, and we’re seeing this again and again and again, he is a populist.

“He is increasingly saying everything that anybody wants to hear. He’s trying to be all things to all men.”

“We are establishing ourselves as a credible alternative government based on sound conservative principles and values and our values and our principles, and therefore our policies, will define the future of our party,” he added.

Asked whether the results meant that Labour would now treat Reform as “your most serious opposition”, Health Secretary Wes Streeting told Trevor Phillips: ” I certainly do treat them as a serious opposition force.”

“As I say, I don’t know whether it will be Reform or the Conservatives that emerge as the main threat,” he added.

“I don’t have a horse in that race, but like alien versus predator, I don’t really want either one to win.”

Continue Reading

Trending