topic Re: Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack in Threats

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

Caute_cautim — Thu, 07 Dec 2023 21:38:13 GMT

Hi All

An interesting technique which affects Windows and Linux devices due to LogoFAIL firmware attack.

https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/

A nice comprehensive explanation.

Regards

Caute_Cautim

Re: Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

JoePete — Fri, 08 Dec 2023 13:17:04 GMT

A good example of the double-edge sword of "softening" firmware through UEFI. Sure, you can update/patch it easily, which means, so too can malware. What UEFI has essentially done is to set standard procedure for malware recovery to "buy a new laptop."

That said, to pull off this other other attacks would require an initial compromise of the OS (so that it could then update UEFI). Granted that is not a huge hurdle given the range of vulnerabilities.