Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240511112123.GA2064@openwall.com>
Date: Sat, 11 May 2024 13:21:23 +0200
From: Solar Designer <solar@...nwall.com>
To: Corey Lopez <Corey.lopez09160587@...mail.com>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory

Hi,

Corey's message is confused and there's no indication in it whether the
system was compromised, so that part doesn't need further discussion,
but as a moderator I don't mind someone explaining Linux's (and other
systems') exposure of the EFI variables and DFCI and what it means for
security as well as what it does not.

On Fri, May 10, 2024 at 01:19:35PM +0000, Corey Lopez wrote:
> investigate other files on my system with the immutable attribute set by running this
> command as root:
> 
> # find / -type f -exec lsattr {} + 2>/dev/null > immutable-list-find.txt
> 
> This led me the directory /sys/firmware/efi/efivars/ where I discovered efi variables

That's normal.

> Microsoft advertises DFCI as a defense mechanism against rootkits, however it seems that it
> is being used as a UEFI bootkit.

No reason to think so.

> I did discover loop devices on my system that I could not remove with the 
> losetup command.

That's probably because they were in use.  That's normal.

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.