BootKitty Malware: Firmware-Level Persistence via LogoFAIL
BootKitty is a sophisticated piece of malware designed to compromise Linux systems at the most fundamental level. Unlike traditional malware that resides within the operating system, BootKitty targets the system firmware, allowing it to maintain a presence that survives even the most drastic recovery efforts, such as reinstalling the OS or replacing the hard drive.
How BootKitty Operates
The attack begins when the BootKitty ELF (Executable and Linkable Format) program is executed. Its primary objective is to disable the kernel signing feature—a security mechanism that ensures only trusted, digitally signed code can run in the Linux kernel. Once this protection is neutralized, the malware preloads two loaders, one of which is executed by the Linux kernel during the boot process via the Linux init system.
To achieve long-term persistence, BootKitty leverages a vulnerability known as LogoFAIL. This exploit allows the malware to embed malicious shellcode into two BMP image files used during the boot sequence. By doing so, it can bypass Secure Boot protections by injecting rogue certifications into the MokList (Machine Owner Key list), which is a database of keys used to verify boot loaders.
[ไม่มีภาพประกอบ]
Technical Capabilities and Targets
Although the EFI (Extensible Firmware Interface) file used by BootKitty is self-signed—which would typically be blocked by UEFI protections—the malware is capable of bypassing these safeguards. Once active, it can replace the legitimate boot loader and patch the kernel before it even begins execution.
BootKitty is specifically engineered to target Ubuntu and related Linux distributions. However, its effectiveness is limited to specific hardware and software configurations. The BMP image files and assembler code are tailored specifically for Lenovo devices and are only compatible with certain versions of the Linux kernel and GNU GRUB (the Grand Unified Bootloader).
Due to its ability to compromise the boot process and bypass Secure Boot, security researchers have compared BootKitty's behavior and impact to the BlackLotus malware.
Key Facts
- Primary Exploit: Uses LogoFAIL to gain firmware-level persistence.
- Persistence Level: Survives system reboots, OS reinstallations, and hard drive replacements.
- Target Systems: Primarily Ubuntu and related Linux distributions.
- Hardware Specificity: Specifically designed for Lenovo devices.
- Mechanism: Injects rogue certifications into the MokList via BMP image files.
- Kernel Impact: Disables kernel signing and patches the kernel prior to execution.
BootKitty Technical Summary
| Feature | Detail |
|---|---|
| Target OS | Ubuntu and related Linux distributions |
| Target Hardware | Specific Lenovo devices |
| Core Vulnerability | LogoFAIL |
| Persistence Method | Firmware-level (UEFI/MokList injection) |
| Software Dependencies | Specific GNU GRUB and Linux kernel versions |
| Comparison | Similar to BlackLotus malware |
Frequently Asked Questions
What makes BootKitty different from standard malware?
BootKitty operates at the firmware level rather than the OS level. This allows it to persist even if the user replaces the hard drive or reinstalls the entire operating system.
What is LogoFAIL and how does BootKitty use it?
LogoFAIL is a vulnerability related to how systems process boot logos. BootKitty uses it to embed shellcode into BMP images, allowing it to bypass Secure Boot by injecting rogue certifications into the MokList.
Can any Linux computer be infected by BootKitty?
No. BootKitty is primarily designed for Ubuntu-based systems and specifically requires certain versions of the Linux kernel and GNU GRUB, as well as specific Lenovo hardware.
How does BootKitty handle UEFI protections?
Despite using a self-signed EFI file that should be blocked, BootKitty uses its exploits to bypass UEFI protections, enabling it to replace the boot loader and patch the kernel before execution.
What is the MokList?
The MokList (Machine Owner Key list) is a variant of the key database used by the system to verify the signatures of boot loaders and kernels during the boot process.