Windows 10: Has anyone ever heard of "logoFAIL"? How do we deal with it?

AJ Marquez II · Aug 20, 2024

As revealed by Alex Matrosov, founder of Binarly, it's a sort of rootkit firmware malware that hijacks the execution flow of UEFI firmware.https://www.binarly.io/blog/finding-logofail-the-dangers-of-image-parsing-during-system-boot

:)

Brink · Aug 20, 2024

Windows and Linux devices vulnerable to new LogoFAIL firmware attack

Hundreds of Windows and Linux computer models from virtually all hardware makers are vulnerable to a new attack that executes malicious firmware early in the boot-up sequence, a feat that allows infections that are nearly impossible to detect or remove using current defense mechanisms. The attack—dubbed LogoFAIL by the researchers who devised it—is notable for the relative ease in carrying it out, the breadth of both consumer- and enterprise-grade models that are susceptible, and the high level of control it gains over them. In many cases, LogoFAIL can be remotely executed in post-exploit situations using techniques that can’t be spotted by traditional endpoint security products. And because exploits run during the earliest stages of the boot process, they are able to bypass a host of defenses, including the industry-wide Secure Boot, Intel’s Secure Boot, and similar protections from other companies that are devised to prevent so-called bootkit infections. Game over for platform security LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a year’s worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware. The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs. The researchers unveiled the attack on Wednesday at the Black Hat Security Conference in London. The affected parties are releasing advisories that disclose which of their products are vulnerable and where to obtain security patches. Links to advisories and a list of vulnerability designations appears at the end of this article. As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment. “Once arbitrary code execution is achieved during the DXE phase, it’s game over for platform security,” researchers from Binarly, the security firm that discovered the vulnerabilities, wrote in a whitepaper. “From this stage, we have full control over the memory and the disk of the target device, thus including the operating system that will be started.” From there, LogoFAIL can deliver a second-stage payload that drops an executable onto the hard drive before the main OS has even started. The following video demonstrates a proof-of-concept exploit created by the researchers. The infected device—a Gen 2 Lenovo ThinkCentre M70s running an 11th-Gen Intel Core with a UEFI released in June—runs standard firmware defenses, including Secure Boot and Intel Boot Guard.
Click to expand...

Read more: Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack | Ars Technica

magibeg · Aug 20, 2024

Video Card Woes

that x800xt is by far the best deal you listed there. I would suggest that one *Smile

reddwarf4ever · Aug 20, 2024

AMD A10-6800K 4.1GHz Quad Core Overclocking possibility

Thanks, have heard this before...is their a step by step procedure to OC using the bios settings you suggest.
i don’t intend pushing this to its limit...but some increase would be great, any suggestions on a good air cooler ?

thanks

Windows 10: Has anyone ever heard of "logoFAIL"? How do we deal with it?

Has anyone ever heard of "logoFAIL"? How do we deal with it?

Has anyone ever heard of "logoFAIL"? How do we deal with it?

Has anyone ever heard of "logoFAIL"? How do we deal with it?

Has anyone ever heard of "logoFAIL"? How do we deal with it? - Similar Threads - Has anyone ever

Has anyone ever heard of "logoFAIL"? How do we deal with it?

has anyone ever heard of external speakers functioning through one speaker only when...

has anyone ever heard of external speakers functioning through one speaker only when...

has anyone ever heard of external speakers functioning through one speaker only when...

Ever Heard Of Windows 12?

Ever Heard Of Windows 12?

Has anyone heard of Hotspot Shield

Anyone ever heard of walliant?

Has anyone heard of EasyUEFI? Is it safe?