The first UEFI bootkit designed for Linux systems (named Bootkitty by its creators) has been discovered.
UEFI (which stands for Unified Extensible Firmware Interface) is a modern replacement for the BIOS, the first code that runs when a computer is turned on. It's job is to load the operating system. Starting from version 2 of UEFI, cryptography is incorporated to enforce security on this whole bootstrap process.
A rootkit is a piece of malware that infects and replaces part of the operating system in such a way as to conceal itself. If that rootkit is in the boot record that the BIOS or now UEFI system uses to bootstrap the operating system, it's called a bootkit. Such bootkits can do things like defeat disk encryption because they are bootstrapped before the disk encryption system is bootstrapped and running. When the full OS is bootstrapped the bootkit can run in kernel mode with full OS privileges. In this position it can intercept anything including encryption keys and passwords.
"The bootkit's main goal is to disable the kernel's signature verification feature and to preload two as yet unknown ELF binaries via the Linux init process (which is the first process executed by the Linux kernel during system startup). During our analysis, we discovered a possibly related unsigned kernel module -- with signs suggesting that it could have been developed by the same author(s) as the bootkit -- that deploys an ELF binary responsible for loading yet another kernel module unknown during our analysis."
ELF stands for Executable and Linkable Format and is a file format for executable code on Linux systems.
"Bootkitty is signed by a self-signed certificate, thus is not capable of running on systems with UEFI Secure Boot enabled unless the attackers certificates have been installed."
"Bootkitty is designed to boot the Linux kernel seamlessly, whether UEFI Secure Boot is enabled or not, as it patches, in memory, the necessary functions responsible for integrity verification before GRUB is executed."
"bootkit.efi contains many artifacts suggesting this is more like a proof of concept than the work of an active threat actor."
