MORE FUN WITH FIRMWARE — Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack UEFIs booting Windows and Linux devices can be hacked by malicious logo images.
Dan Goodin – Dec 6, 2023 3:02 pm UTC EnlargeGetty Images reader comments 195
Hundreds of Windows and Linux computer models from virtually all hardware makers are vulnerable to a new attack that executes malicious firmware early in the boot-up sequence, a feat that allows infections that are nearly impossible to detect or remove using current defense mechanisms.
The attackdubbed LogoFAIL by the researchers who devised itis notable for the relative ease in carrying it out, the breadth of both consumer- and enterprise-grade models that are susceptible, and the high level of control it gains over them. In many cases, LogoFAIL can be remotely executed in post-exploit situations using techniques that cant be spotted by traditional endpoint security products. And because exploits run during the earliest stages of the boot process, they are able to bypass a host of defenses, including the industry-wide Secure Boot, Intels Secure Boot, and similar protections from other companies that are devised to prevent so-called bootkit infections. Game over for platform security
LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a years worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware.
The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs. The researchers unveiled the attack on Wednesday at the Black Hat Security Conference in London. Advertisement
The affected parties are releasing advisories that disclose which of their products are vulnerable and where to obtain security patches. Links to advisories and a list of vulnerability designations appears at the end of this article.
As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.
Once arbitrary code execution is achieved during the DXE phase, its game over for platform security, researchers from Binarly, the security firm that discovered the vulnerabilities, wrote in a whitepaper. From this stage, we have full control over the memory and the disk of the target device, thus including the operating system that will be started.
From there, LogoFAIL can deliver a second-stage payload that drops an executable onto the hard drive before the main OS has even started. The following video demonstrates a proof-of-concept exploit created by the researchers. The infected devicea Gen 2 Lenovo ThinkCentre M70s running an 11th-Gen Intel Core with a UEFI released in Juneruns standard firmware defenses, including Secure Boot and Intel Boot Guard. LogoFAIL.
In an email, Binarly founder and CEO Alex Matrosov wrote:
LogoFAIL is a newly discovered set of high-impact security vulnerabilities affecting different image parsing libraries used in the system firmware by various vendors during the device boot process. These vulnerabilities are present in most cases inside reference code, impacting not a single vendor but the entire ecosystem across this code and device vendors where it is used. This attack can give a threat actor an advantage in bypassing most endpoint security solutions and delivering a stealth firmware bootkit that will persist in a firmware capsule with a modified logo image. Page: 1 2 3 4 Next → reader comments 195 Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars
US House Speaker Mike Johnson has said he will “strongly request” a report into allegations of sex trafficking against Matt Gaetz, who is the president-elect’s choice of attorney general, should not be released.
Mr Johnson said he was against publishing the House Ethics Committee report on Mr Gaetz, 42, who if approved by the Senate will become the nation’s top prosecutor once Donald Trump is sworn in as president on 20 January.
That’s despite Mr Gaetz having previously faced a nearly three-year Justice Department investigation into sex trafficking allegations involving a 17-year-old girl. He denies the allegations and has not faced criminal charges.
Mr Gaetz has also never worked as a prosecutor and has only worked in law for a few years at a local level.
He stepped down from Congress after Mr Trump announced him as his attorney general pick.
His resignation brought the investigation by the House Ethics Committee to an end – two days before it had been expected to release its report into the trafficking claims.
Please use Chrome browser for a more accessible video player
1:27
Why is Matt Gaetz a controversial pick?
House Speaker Mr Johnson, a Louisiana Republican, said of the probe: “I’m going to strongly request that the Ethics Committee not issue the report, because that is not the way we do things in the House.”
Politicians of both parties on the Senate Judiciary Committee have said they want to see the report on Mr Gaetz, as part of a Senate confirmation process for cabinet nominees that would start next year with public hearings.
Democrats have described the MAGA loyalist as “a gonzo agent of chaos” and his appointment a “red alert moment for our democracy”, while some Republican senators have also raised doubts about his suitability for the role.
Mr Johnson said he planned to urge House Ethics Committee chairman Michael Guest not to provide the report to the Senate Judiciary Committee.
“The rules of the House have always been that a former member is beyond the jurisdiction of the Ethics Committee,” said Mr Johnson, who returned on Friday morning from meeting Mr Trump at the president-elect’s Mar-a-Lago resort in Florida.
“I think it’s a terrible breach of protocol and tradition and the spirit of the rule,” he added. “I think that would be a terrible precedent to set.”
Follow Sky News on WhatsApp
Keep up with all the latest news from the UK and around the world by following Sky News
YouTuber-turned-boxer Jake Paul is taking on one of boxing’s greatest-ever fighters tonight in former undisputed world champion Mike Tyson.
The heavyweight bout is being labelled by some as Paul’s toughest test yet, despite the 30-year age gap between him and Tyson.
The fight was originally scheduled for 20 July, but was delayed after Tyson fell ill on a flight due to an ulcer flare up in May.
It’s going to be a co-main event alongside a highly-anticipated rematch between undisputed super lightweight champion Katie Taylor and unified featherweight champion Amanda Serrano.
Here’s everything you need to know about the hotly anticipated fight and how to watch.
Who are the fighters?
Jake Paul, 27, is an American YouTube star who made a name for himself on social media platform Vine. He made his professional boxing debut in 2020.
“The Problem Child” has since defeated former UFC contender Nate Diaz, professional boxer Andre August, former Gold Gloves champion Ryan Bourland and most recently MMA fighter Mike Perry to earn himself a boxing record of 10-1.
Advertisement
“Iron Mike” Tyson, 58, retired from professional boxing in 2005 with a 50-6 record and as a former undisputed heavyweight champion.
The legendary fighter, who knocked out 44 opponents during his career, returned to the ring after 15 years in 2020 for a bout against fellow boxing icon Roy Jones, which ended in an unofficial draw.
Tyson’s fighting skills place him among the best heavyweight boxers of all time, but the age gap between him and Paul along with some potential ring rust are expected to level the playing field.
When is the fight and where will it be?
The bout is due to take place at the AT&T Stadium in Arlington, Texas, on Friday 15 November. The 80,000-seat capacity stadium is home of the Dallas Cowboys and is the biggest NFL stadium in the US.
The event is set to begin at 1am GMT on 16 November, with Taylor v Serrano scheduled for 3am GMT and Tyson v Paul at 4am GMT.
How can I watch it?
It will be aired on Netflix in what will be the first live fight ever on the streaming platform.
Jake Paul, who co-founded Most Valuable Promotions (MVP) in 2021, said his company signed with Netflix because it is “the biggest streaming platform in the world”.
Fellow MVP co-founder Nakisa Bidarian added: “Partnering with Netflix for this deal presents an unparalleled opportunity to bring Jake Paul v Mike Tyson to the world on an unprecedented scale.”
X
This content is provided by X, which may be using cookies and other technologies.
To show you this content, we need your permission to use cookies.
You can use the buttons below to amend your preferences to enable X cookies or to allow those cookies just once.
You can change your settings at any time via the Privacy Options.
Unfortunately we have been unable to verify if you have consented to X cookies.
To view this content you can use the button below to allow X cookies for this session only.
Some good news for Netflix users; there is no additional cost for the streaming platform’s subscribers.
It’s not a pay-per-view event, but you won’t be able to watch it unless you have a Netflix account, which costs between £4.99 and £17.99 depending on what sort of plan you subscribe to.
Can I buy tickets?
Tickets are still available throughout the stadium via SeatGeek, with prices for regular seats ranging from $60 (£47.32) to about $7,400 (£5,914).
What are the rules?
The Texas Athletic Commission has sanctioned it as a professional fight which will count on the pair’s boxing records, but it has put some sanctions in place due to Tyson’s age.
There will be eight rounds lasting a maximum of two minutes rather than three, and both boxers will wear 14-ounce gloves, heavier than the usual 10-ounce.
What you need to know about Taylor v Serrano
Taylor and Serrano produced an epic when they became the first ever women fighters to headline at Madison Square Garden back in 2022, with the former edging a split decision that could have arguably fallen either way after 10 rounds.
Now over two years on from one of the greatest fights in the history of female boxing, undisputed super-lightweight world champion Taylor, 38, will put her belts on the line against unified featherweight champion Serrano, 36.
The contest will mark a step in three weight classes from Serrano’s usual featherweight division as she seeks the biggest win of her glittering career.
Taylor will enter 23-1 having avenged her loss to Chantelle Cameron in May last year by winning November’s rematch via majority decision to become undisputed super-lightweight champion and a two-weight undisputed champion.
Serrano is meanwhile 46-2-1 having won all four of her fights since losing to Taylor, most recently beating Danila Ramos via unanimous decision after their 12-rounder in October.
Who is on the undercard?
There are five other fights on the bill besides the two co-main events – and two of them will see titles on the line. Here’s how it looks:
Mario Barrios v Abel Ramos – WBC welterweight title
Shadasia Green v Melinda Watpool – WBO super-middleweight title
Lucas Bahdi v Corey Marksman – lightweight
Bruce Carrington v Dana Coolwell – featherweight
Neeraj Goyat v Whindersson Nunes – middleweight
‘The fight of a lifetime’
Paul is not typically known for showing respect to his opponents. In the lead-up to his last fight against Tommy Fury, which he lost on points, Paul said Tyson Fury’s brother “boxes because he was told to do so by his dad”.
“He doesn’t have that real heart, that real fighter inside of him,” he added.
Few, however, would question Mike Tyson’s credentials, with Paul having adopted a more respectful approach to promoting the fight so far.
“My sights are set on becoming a world champion, and now I have a chance to prove myself against the greatest heavyweight champion ever – the baddest man on the planet and the most dangerous boxer of all time,” he said, adding: “This will be the fight of a lifetime.”
In a face-to-face posted on his YouTube channel on 10 November, Paul said winning would be “bittersweet” due to the respect he has for Tyson, but said it was “my time to shine”.
‘I plan to finish him’
Critics of the fight have said there is simply too big of an age gap between the two, with Tyson falling ill in May stoking talks over the fight being a mistake for the 58-year-old.
But the veteran has insisted he still has fuel left in the tank, claiming his body is “in better overall shape than it has been since the 1990s”.
“I’m very much looking forward to stepping into the ring with Jake Paul,” Tyson said – promising to “finish him” and his boxing career.
During the face-to-face, Tyson warned: “I’m not going to lose. I can’t even fathom losing.
“I think he thinks this is going to be a very easy night. It’s not going to be an easy night.”
BALTIMORE — The Orioles are ready to adjust their wall in left field again.
The team moved the wall at Camden Yards back and made it significantly taller before the 2022 season. General manager Mike Elias said Friday the team “overcorrected” and will try to find a “happier medium” before the 2025 season.
The team sent out a rendering of changes showing the wall moved farther in — particularly in left-center field near the bullpens — and reduced in height.