First in-the-wild UEFI bootkit bypassing UEFI Secure Boot

• tor-relay-docker

  357 39 0.0 Shell

  Tor relay Docker images for x86-64, armhf & arm64 (from source)

• CVE-2022-21894

  5 276 2.4 C

  baton drop (CVE-2022-21894): Secure Boot Security Feature Bypass Vulnerability

The write-up I saw suggests that revoking the Windows bootloader would cause existing install and restore images to fail to boot even with Secure Boot disabled because it checks its own signature, which would be pretty amazing if true: https://github.com/Wack0/CVE-2022-21894

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• shim

  20 791 7.3 C

  UEFI shim loader

  

A new mechanism called SBAT (https://github.com/rhboot/shim/blob/main/SBAT.md) is now used to allow revocation of groups of bootloaders rather than individual hashes in order to mitigate the resource consumption

• bootkit-samples

  15 231 3.0

  Bootkit sample for firmware attack

  

https://github.com/hardenedvault/bootkit-samples

The short-term solution for workaround is to protect the OS runtime. Otherwise you'd have to build the defense-in-depth at very infrastructure level from scratch with hardware, firmware and OS with attestation service not only based on the "confidential computing" but typically TCG's trusted computing.

Suggest a related project