Found in the wild: The world’s first unkillable UEFI bootkit for Linux
Over the past decade, a new class of infections has threatened Windows users. By infecting the firmware that runs immediately before the operating system loads, these UEFI bootkits continue to run even when the hard drive is replaced or reformatted. Now the same type of chip-dwelling malware has been found in the wild for backdooring Linux machines.
Researchers at security firm ESET said Wednesday that Bootkitty—the name unknown threat actors gave to their Linux bootkit—was uploaded to VirusTotal earlier this month. Compared to its Windows cousins, Bootkitty is still relatively rudimentary, containing imperfections in key under-the-hood functionality and lacking the means to infect all Linux distributions other than Ubuntu. That has led the company researchers to suspect the new bootkit is likely a proof-of-concept release. To date, ESET has found no evidence of actual infections in the wild.
The ASCII logo that Bootkitty is capable of rendering.
Credit:
ESET
Be prepared
Still, Bootkitty suggests threat actors may be actively developing a Linux version of the same sort of unkillable bootkit that previously was found only targeting Windows machines.
Related Knowledge Center: ENERGY BASICS: energy efficiency
The energy price spikes of the 1970s drove consumers, businesses and government to calculate opportunities for energy efficiency — investments, practices, and regulations to avoid some of the energy costs associated with particular products or services. Those calculations ran counter to a lot of engrained practices, and the friction between business and government is a feature of energy and environment policy discussions. Now, energy efficiency decisions — whether involving building practices, appliance efficiency, or vehicle mileage and emissions standards — are a complex mix of government regulation and market behavior.