UEFI Secure Boot Failing, as Expected for Nearly 15 Years Already (Techrights Said This Since 2012)
Today in the media:
-
HybridPetya: More proof that Secure Boot bypasses are not just an urban legend
A new ransomware strain dubbed HybridPetya was able to exploit a patched vulnerability to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot on unrevoked Windows systems, making it the fourth publicly known bootkit capable of punching through the feature and hijacking a PC before the operating system loads.
ESET researchers discovered the ransomware-bootkit combo after samples were uploaded to VirusTotal in February, and named it HybridPetya because of its similarities to the infamous Petya and NotPetya malware strains.
-
New HybridPetya ransomware can bypass UEFI Secure Boot
A recently discovered ransomware strain called HybridPetya can bypass the UEFI Secure Boot feature to install a malicious application on the EFI System Partition.
-
HybridPetya Crypto-Locker Outsmarts UEFI Secure Boot
No telemetry exists to suggest HybridPetya has been deployed in the wild yet and it certainly lacks the aggressive propagation properties of NotPetya, which in 2017 spiraled into a global infection causing $10 billion in damage.
It also differs in one key respect: It can compromise the secure boot feature of Unified Extensible Firmware Interface by installing a malicious application. It joins a list of real or proof of concept UEFI bootkits including BlackLotus, Bootkitty and the Hyper-V Backdoor proof of concept.
