/*! elementor-pro - v3.26.0 - 17-12-2024 */
(()=>{"use strict";class Screenshot extends elementorModules.ViewModule{getDefaultSettings(){return{empty_content_headline:"Empty Content.",crop:{width:1200,height:1500},excluded_external_css_urls:["https://kit-pro.fontawesome.com"],external_images_urls:["https://i.ytimg.com"],timeout:15e3,render_timeout:5e3,timerLabel:null,timer_label:`${ElementorScreenshotConfig.post_id} - timer`,image_placeholder:"data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=",isDebug:elementorCommonConfig.isElementorDebug,isDebugSvg:!1,...ElementorScreenshotConfig}}getDefaultElements(){const e=jQuery(ElementorScreenshotConfig.selector),t=e.find(".elementor-section-wrap > .elementor-section, .elementor > .elementor-section");return{$elementor:e,$sections:t,$firstSection:t.first(),$notElementorElements:elementorCommon.elements.$body.find("> *:not(style, link)").not(e),$head:jQuery("head")}}onInit(){return super.onInit(),this.log("Screenshot init","time"),this.timeoutTimer=setTimeout(this.screenshotFailed.bind(this),this.getSettings("timeout")),this.captureScreenshot()}captureScreenshot(){return this.elements.$elementor.length||(elementorCommon.helpers.consoleWarn("Screenshots: The content of this page is empty, the module will create a fake conent just for this screenshot."),this.createFakeContent()),this.removeUnnecessaryElements(),this.handleIFrames(),this.removeFirstSectionMargin(),this.handleLinks(),this.loadExternalCss(),this.loadExternalImages(),Promise.resolve().then(this.createImage.bind(this)).then(this.createImageElement.bind(this)).then(this.cropCanvas.bind(this)).then(this.save.bind(this)).then(this.screenshotSucceed.bind(this)).catch(this.screenshotFailed.bind(this))}createFakeContent(){this.elements.$elementor=jQuery("<div>").css({height:this.getSettings("crop.height"),width:this.getSettings("crop.width"),display:"flex",alignItems:"center",justifyContent:"center"}),this.elements.$elementor.append(jQuery("<h1>").css({fontSize:"85px"}).html(this.getSettings("empty_content_headline"))),document.body.prepend(this.elements.$elementor)}loadExternalCss(){const e=[this.getSettings("home_url"),...this.getSettings("excluded_external_css_urls")].map((e=>`[href^="${e}"]`)).join(", ");jQuery("link").not(e).each(((e,t)=>{const s=jQuery(t),n=s.clone();n.attr("href",this.getScreenshotProxyUrl(s.attr("href"))),this.elements.$head.append(n),s.remove()}))}loadExternalImages(){const e=this.getSettings("external_images_urls").map((e=>`img[src^="${e}"]`)).join(", ");jQuery(e).each(((e,t)=>{const s=jQuery(t);s.attr("src",this.getScreenshotProxyUrl(s.attr("src")))}))}handleIFrames(){this.elements.$elementor.find("iframe").each(((e,t)=>{const s=jQuery(t),n=jQuery("<div />",{css:{background:"gray",width:s.width(),height:s.height()}});s.before(n),s.remove()}))}removeUnnecessaryElements(){let e=0;this.elements.$sections.filter(((t,s)=>{let n=!1;return e>=this.getSettings("crop.height")&&(n=!0),e+=jQuery(s).outerHeight(),n})).each(((e,t)=>{t.remove()})),this.elements.$notElementorElements.remove()}handleLinks(){elementorCommon.elements.$body.find("a").attr("href","/")}removeFirstSectionMargin(){this.elements.$firstSection.css({marginTop:0})}createImage(){const e=new Promise((e=>{window.addEventListener("load",(()=>{e()}))})),t=new Promise((e=>{setTimeout((()=>{e()}),this.getSettings("render_timeout"))}));return Promise.race([e,t]).then((()=>{if(this.log("Start creating screenshot."),this.getSettings("isDebugSvg"))return domtoimage.toSvg(document.body,{imagePlaceholder:this.getSettings("image_placeholder")}).then((e=>this.download(e))),Promise.reject("Debug SVG.");return/^((?!chrome|android).)*safari/i.test(window.userAgent)?(this.log('Creating screenshot with "html2canvas"'),html2canvas(document.body).then((e=>e.toDataURL("image/png")))):(this.log('Creating screenshot with "dom-to-image"'),domtoimage.toPng(document.body,{imagePlaceholder:this.getSettings("image_placeholder")}))}))}download(e){const t=jQuery("<a/>",{href:e,download:"debugSvg.svg",html:"Download SVG"});elementorCommon.elements.$body.append(t),t.trigger("click")}createImageElement(e){const t=new Image;return t.src=e,new Promise((e=>{t.onload=()=>e(t)}))}cropCanvas(e){const t=this.getSettings("crop.width"),s=this.getSettings("crop.height"),n=document.createElement("canvas"),i=n.getContext("2d"),o=t/e.width;return n.width=t,n.height=s>e.height?e.height:s,i.drawImage(e,0,0,e.width,e.height,0,0,e.width*o,e.height*o),Promise.resolve(n)}save(e){return new Promise(((t,s)=>{elementorCommon.ajax.addRequest("screenshot_save",{data:{post_id:this.getSettings("post_id"),screenshot:e.toDataURL("image/png")},success:e=>{this.log(`Screenshot created: ${encodeURI(e)}`),t(e)},error:()=>{this.log("Failed to create screenshot."),s()}})}))}markAsFailed(){return new Promise(((e,t)=>{elementorCommon.ajax.addRequest("screenshot_failed",{data:{post_id:this.getSettings("post_id")},success:()=>{this.log("Marked as failed."),e()},error:()=>{this.log("Failed to mark this screenshot as failed."),t()}})}))}getScreenshotProxyUrl(e){return`${this.getSettings("home_url")}?screenshot_proxy&nonce=${this.getSettings("nonce")}&href=${e}`}screenshotSucceed(e){this.screenshotDone(!0,e)}screenshotFailed(e){this.log(e,null),this.markAsFailed().then((()=>this.screenshotDone(!1)))}screenshotDone(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;clearTimeout(this.timeoutTimer),this.timeoutTimer=null,window.parent.postMessage({name:"capture-screenshot-done",success:e,id:this.getSettings("post_id"),imageUrl:t},"*"),this.log(`Screenshot ${e?"Succeed":"Failed"}.`,"timeEnd")}log(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"timeLog";this.getSettings("isDebug")&&(console.log("string"==typeof e?`${this.getSettings("post_id")} - ${e}`:e),t&&console[t](this.getSettings("timer_label")))}}jQuery((()=>{new Screenshot}))})();<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Bootkit Targeting Linux Servers Archives - The Tach</title>
	<atom:link href="https://thetach.com/?feed=rss2&#038;tag=bootkit-targeting-linux-servers" rel="self" type="application/rss+xml" />
	<link>https://thetach.com/?tag=bootkit-targeting-linux-servers</link>
	<description></description>
	<lastBuildDate>Wed, 27 Nov 2024 18:15:59 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.7.1</generator>
	<item>
		<title>Bootkitty: The First UEFI Bootkit Targeting Linux Servers</title>
		<link>https://thetach.com/?p=873</link>
					<comments>https://thetach.com/?p=873#respond</comments>
		
		<dc:creator><![CDATA[burhan]]></dc:creator>
		<pubDate>Wed, 27 Nov 2024 18:15:58 +0000</pubDate>
				<category><![CDATA[Cyber Security]]></category>
		<category><![CDATA[Bootkit Targeting Linux Servers]]></category>
		<category><![CDATA[Linux Kernel Signature Verification]]></category>
		<category><![CDATA[UEFI Secure Boot Exploitation]]></category>
		<guid isPermaLink="false">https://thetach.com/?p=873</guid>

					<description><![CDATA[<p>The cybersecurity landscape has witnessed a groundbreaking revelation with the discovery of Bootkitty, the first UEFI bootkit targeting Linux servers. This marks a significant shift, as such advanced bootkits have primarily been associated with Windows systems. The existence of this threat calls for further protection of Linux servers against new and developing attacks in cyberspace. ... <a title="Bootkitty: The First UEFI Bootkit Targeting Linux Servers" class="read-more" href="https://thetach.com/?p=873" aria-label="Read more about Bootkitty: The First UEFI Bootkit Targeting Linux Servers">Read more</a></p>
<p>The post <a href="https://thetach.com/?p=873">Bootkitty: The First UEFI Bootkit Targeting Linux Servers</a> appeared first on <a href="https://thetach.com">The Tach</a>.</p>
]]></description>
										<content:encoded><![CDATA[
<p>The cybersecurity landscape has witnessed a groundbreaking revelation with the discovery of <strong>Bootkitty,</strong> the first <strong>UEFI bootkit targeting Linux servers</strong>. This marks a significant shift, as such advanced bootkits have primarily been associated with<strong> Windows systems</strong>. The existence of this threat calls for further protection of Linux servers against new and developing attacks in cyberspace. Security analysts at <strong>ESET </strong>have given Bootkitty the panda tag of proof-of-concept (PoC) designed for attacking UEFI flaws. Because of its sophisticated design and capability to infiltrate Linux systems while it compromises them, it is an indication that <strong>cyber threats</strong> are gradually moving up the notches.</p>



<h2 class="wp-block-heading"><strong>Discovery of Bootkitty and Its Development</strong></h2>



<p><strong>Bootkitty</strong> was initially detected after being uploaded to <strong>VirusTotal</strong> on November 5, 2024. It is also tracked under <strong>IranuKit</strong> and credited to developers operating under the alias <strong>BlackCat</strong>. However, no connection has been established between this alias and the <strong>ALPHV/BlackCat ransomware group</strong>. The researchers, Martin Smolár and Peter Strýček have revealed that Bootkitty’s primary functionality involves disabling the <strong>Linux kernel&#8217;s signature verification process</strong>.&nbsp;</p>



<p>This is achieved through preloading two <strong>unidentified ELF binaries</strong> during the <strong>Linux init process</strong>, a critical stage in the <strong>Linux boot process</strong> where the kernel initializes the system. As a <strong>bootkit targeting Linux servers</strong>, Bootkitty represents a new phase of sophisticated malware, capable of undermining previously considered secure systems against such attacks.</p>



<h2 class="wp-block-heading"><strong>Exploiting UEFI Secure Boot Vulnerabilities</strong></h2>



<p>Bootkitty has been engineered to exploit systems with improperly configured <strong>UEFI Secure Boot</strong>. This feature, designed to ensure that only trusted software is executed during system startup, is bypassed by Bootkitty through a <strong>self-signed certificate</strong>. While this self-signed certificate prevents its execution on systems with fully enabled Secure Boot, attackers can exploit the feature by preloading <strong>malicious certificates</strong>. This allows Bootkitty to infiltrate systems, compromising the security of the <strong>Linux boot process</strong>.</p>



<p>For systems with Secure Boot enabled, Bootkitty manipulates <strong>UEFI authentication protocols</strong> to bypass integrity checks. It hooks two essential functions in the authentication protocols, effectively circumventing security measures. The <strong>GRUB bootloader</strong>, a key component of Linux systems, is further exploited by patching three of its functions. This enables Bootkitty to sidestep <strong>verification mechanisms</strong>, ensuring the execution of compromised code. This advanced functionality makes Bootkitty a sophisticated <strong>bootkit targeting Linux servers</strong>, showcasing the capabilities of modern cyber attackers to bypass well-established defenses.</p>



<h2 class="wp-block-heading"><strong>Advanced Rootkit Functionalities</strong></h2>



<p>The Bootkitty investigation also uncovered a related <strong>unsigned kernel module</strong>. This module deploys an ELF binary named <strong>BCDropper</strong>, which subsequently loads another <strong>unknown kernel module</strong> after the system starts. The kernel module includes advanced <strong>rootkit capabilities</strong>, such as: Hiding files and processes to evade detection. Manipulating system ports for unauthorized access. Disabling integrity checks to ensure malicious operations.</p>



<p>Despite its name association, there is no evidence linking this kernel module or <strong>Bootkitty</strong> to the ALPHV/BlackCat ransomware group. However, its design reflects a growing trend in sophisticated <strong>boot kits targeting Linux servers</strong> that emphasize stealth and control.</p>



<h2 class="wp-block-heading"><strong>Shifting the Perception of UEFI Bootkits</strong></h2>



<p>The discovery of Bootkitty has shattered the long-held perception that <strong>UEFI bootkits</strong> are exclusive to <strong>Windows systems</strong>. By targeting Linux servers, cyber attackers are expanding their arsenal to exploit vulnerabilities in environments previously considered secure. This <strong>bootkit targeting Linux servers</strong> significantly advances the cyber threat landscape.</p>



<figure class="wp-block-image aligncenter size-full"><img fetchpriority="high" decoding="async" width="604" height="332" src="https://thetach.com/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-27-at-6.27.33-PM.jpeg" alt="Linux Kernel Signature Verification
" class="wp-image-875" srcset="https://thetach.com/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-27-at-6.27.33-PM.jpeg 604w, https://thetach.com/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-27-at-6.27.33-PM-300x165.jpeg 300w" sizes="(max-width: 604px) 100vw, 604px" /></figure>



<p>It highlights the need for organizations to reconsider their <strong>Linux server security</strong> strategies and adopt proactive measures to mitigate these emerging risks. According to ESET researchers, &#8220;Whether a <strong>proof of concept</strong> or not, Bootkitty represents a significant shift in <strong>UEFI threats</strong>, breaking the assumption of modern UEFI bootkits being confined to Windows-exclusive systems.&#8221;</p>



<h2 class="wp-block-heading"><strong>Technical Insights into Bootkitty’s Operations</strong></h2>



<p>Bootkitty operates through memory-based patches and manipulations, ensuring it avoids detection while compromising the <strong>Linux boot process</strong>. Key technical insights into its operation include:</p>



<p><strong>Hooking UEFI Authentication Protocols:</strong><strong><br></strong>Bootkitty hooks two functions in the <strong>UEFI authentication protocols</strong>, bypassing integrity verification during Secure Boot. <strong>Memory-Based Patching: </strong>The bootkit disables the <strong>kernel signature verification</strong> by altering the kernel&#8217;s memory responses. <strong>GRUB Bootloader Exploitation: </strong>Three functions in the <strong>GRUB bootloader</strong> are patched to ensure the boot process allows the execution of malicious code. <strong>Post-Exploitation Tactics: </strong>These tactics enable attackers to preload <strong>ELF binaries</strong>, manipulate system configurations, and execute arbitrary commands. Such advanced techniques make Bootkitty an unprecedented <strong>bootkit targeting Linux servers</strong>, requiring robust countermeasures to detect and prevent its exploitation.</p>



<h2 class="wp-block-heading"><strong>Implications for Cybersecurity and Defense</strong></h2>



<p>The emergence of Bootkitty has significant implications for organizations relying on Linux systems. As attackers expand their focus to develop <strong>boot kits targeting Linux servers</strong>, businesses, and individuals must prioritize robust security measures. Recommended steps to mitigate threats include: <strong>Securing UEFI Configurations:</strong> Ensuring proper configuration of Secure Boot to prevent unauthorized certificates. <strong>Regular Firmware Updates:</strong> Keeping UEFI firmware updated to address known vulnerabilities. <strong>Multi-Layered Defenses:</strong> Implementing advanced endpoint detection tools to identify suspicious activities during the <strong>Linux boot process</strong>. Bootkitty’s presence on platforms like <strong>VirusTotal</strong> emphasizes the increasing accessibility of <strong>sophisticated malware</strong>, making preparedness a critical priority for all organizations.</p>



<h2 class="wp-block-heading"><strong>Conclusion&nbsp;</strong></h2>



<p>Bootkitty represents a pivotal development in the <strong>cybersecurity landscape</strong>, being the first <strong>UEFI bootkit targeting Linux servers</strong>. Its ability to exploit Secure Boot vulnerabilities and manipulate GRUB functions underscores the growing sophistication of modern cyber threats. This discovery serves as a wake-up call for organizations to reassess Linux server security, adopt layered defenses, and remain vigilant against evolving risks. Robust system protections and proactive measures are essential to safeguard against groundbreaking threats like Bootkitty, signaling a new era in Linux-targeted cyberattacks.</p>



<h2 class="wp-block-heading"><strong>FAQs</strong></h2>



<div class="schema-faq wp-block-yoast-faq-block"><div class="schema-faq-section" id="faq-question-1732731180347"><strong class="schema-faq-question"><strong>What is Bootkitty, and why is it significant?</strong></strong> <p class="schema-faq-answer">Bootkitty is the first <strong>UEFI bootkit targeting Linux servers</strong>, marking a significant cyber threat.</p> </div> <div class="schema-faq-section" id="faq-question-1732731181611"><strong class="schema-faq-question"><strong>How does Bootkitty bypass UEFI Secure Boot protections?</strong></strong> <p class="schema-faq-answer">It manipulates UEFI authentication protocols and patches GRUB bootloader functions.</p> </div> <div class="schema-faq-section" id="faq-question-1732731182356"><strong class="schema-faq-question"><strong>Is Bootkitty currently being used in real-world attacks?</strong></strong> <p class="schema-faq-answer">No, Bootkitty is classified as a <strong>proof-of-concept</strong>, with no evidence of deployment.</p> </div> <div class="schema-faq-section" id="faq-question-1732731221196"><strong class="schema-faq-question"><strong>What are Bootkitty’s primary functions and capabilities?</strong></strong> <p class="schema-faq-answer">Bootkitty disables kernel signature verification and preloads <strong>malicious ELF binaries</strong>.</p> </div> <div class="schema-faq-section" id="faq-question-1732731234075"><strong class="schema-faq-question"><strong>How can organizations defend against Bootkitty?</strong></strong> <p class="schema-faq-answer">Organizations must secure UEFI configurations, update firmware, and implement layered defenses.</p> </div> </div>
<p>The post <a href="https://thetach.com/?p=873">Bootkitty: The First UEFI Bootkit Targeting Linux Servers</a> appeared first on <a href="https://thetach.com">The Tach</a>.</p>
]]></content:encoded>
					
					<wfw:commentRss>https://thetach.com/?feed=rss2&#038;p=873</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
	</channel>
</rss>