The New BIOS Hack That Bypasses Every Antivirus

Summary

LogoFail is a recently discovered collection of exploits targeting computer BIOS firmware, making traditional malware removal methods like hard drive wiping ineffective. It exploits vulnerabilities in the image parsers used by BIOS software companies to load manufacturer logos, allowing malware to embed itself into the firmware. This firmware-level malware can reinstall malicious files or run processes invisible to the operating system. While Macs and certain Dell and MSI devices are immune, most PCs are potentially vulnerable. The only surefire solution is to update the BIOS with the latest firmware from the manufacturer. The exploit has not been used actively yet, but the risk is real, prompting users to consider BIOS updates to safeguard against this threat.

Takeaways

• 💻 A new exploit called LogoFail targets computer's BIOS firmware, making it extremely difficult to remove.
• 🚨 Firmware-level malware is like the 'final boss' of malware because it's embedded within hardware and not stored on the drive.
• 🛑 LogoFail allows malware to infect firmware, leading to potential undetectable and persistent malicious activity.
• 🖼️ The exploit involves manipulating the image parsers used by BIOS to display manufacturer logos during startup.
• 🔍 Secure Boot technologies typically do not check image files, allowing this exploit to bypass security measures.
• 🔗 The malicious code can be introduced through various attack vectors, including remote hacking and physical access.
• 🍎 Macs, certain Dell devices with Intel Boot Guard, and some MSI motherboards are not vulnerable to LogoFail.
• 🆘 Updating BIOS to the latest firmware is the recommended solution to protect against LogoFail, if available from the manufacturer.
• 🛠️ BIOS updates should be performed with caution to avoid causing severe system issues.
• 📢 As of the knowledge cutoff, there have been no active uses of LogoFail, but vigilance is advised.

Q & A

What is the main vulnerability discussed in the transcript?

The main vulnerability discussed is LogoFail, a collection of exploits related to computer's BIOS firmware that allows malware to infect the firmware itself.

How does firmware-level malware differ from regular malware?

Firmware-level malware is embedded within the hardware itself and is not stored on the drive, making it more difficult to detect and remove compared to regular malware, which typically installs itself in the operating system or files.

What is the role of BIOS in the context of malware?

BIOS, or Basic Input/Output System, is stored on a physical chip on the motherboard and runs before any other software, including the operating system. If the BIOS firmware is infected by malware, it can execute malicious code before any security measures are in place.

How does the LogoFail exploit work?

LogoFail exploits involve the manipulation of the image parsers used by BIOS software to load manufacturer logos during startup. Malicious image files can trick the BIOS into executing additional code, leading to firmware infection with malware.

What is Secure Boot and how does it relate to LogoFail?

Secure Boot is a technology designed to ensure that BIOS data is not manipulated during startup. However, it does not typically check image files, which is how the LogoFail exploit is able to bypass these security measures.

What are the three main attack vectors for LogoFail?

The three main attack vectors are: 1) Replacing the logo file in the EFI System Partition, 2) Using a malicious BIOS update file, and 3) Physically accessing the computer with a SPI Flash Programmer to replace the file directly in the hardware.

Which types of computers are not vulnerable to LogoFail?

Apple Silicon Macs and Intel-based Macs are not vulnerable because they either do not use UEFI or have the image hard-coded with checks. Some Dell devices with Intel Boot Guard configured to check the image are also safe, as are MSI motherboards that do not allow user changes to the logo.

How can you protect yourself from the LogoFail exploit?

The primary method of protection is to update your BIOS to the latest firmware version, which should include patches for the LogoFail exploit. Users should check their system manufacturer's website for updates and follow instructions carefully to avoid issues during the update process.

What is the significance of the LogoFail exploit in terms of cybersecurity?

The LogoFail exploit is significant because it represents a fundamental vulnerability at the firmware level, which is difficult to detect and remove. It highlights the need for constant vigilance and the importance of keeping system firmware up-to-date to counter emerging threats.

Are there any known active uses of the LogoFail exploit?

As of the knowledge in the transcript, there have not been any reported instances of the LogoFail exploit being actively used in the wild. However, the potential for such attacks exists, and users are advised to take preventative measures.

What is the role of the sponsor, Aura, in the context of the video?

Aura is a sponsor of the video, offering a suite of cybersecurity services including antivirus, VPN, password management, and identity theft insurance. The video suggests using Aura to protect personal data, which can be a target for hackers alongside system vulnerabilities like LogoFail.

Outlines

00:00

💻 The Emergence of Firmware-Level Malware: LogoFail

This paragraph introduces the concept of firmware-level malware, specifically the LogoFail exploit, which targets the BIOS firmware of computers. It explains that unlike regular malware, firmware-level malware is extremely difficult to remove because it is embedded within the hardware itself. The paragraph also provides a brief overview of how traditional malware operates compared to the more insidious nature of firmware-level attacks, which can reinstall malicious files or go undetected by the operating system.

05:00

🔍 Exploring the Attack Vectors of LogoFail

This section delves into the three main methods by which the LogoFail exploit can infect a computer's firmware. It discusses how malware can replace the logo file through the EFI System Partition, a malicious BIOS update file, or physically with a SPI Flash Programmer. The paragraph emphasizes that only Macs and certain Dell devices with specific security configurations are immune to this exploit, while most other systems are potentially vulnerable.

10:02

🛠️ Protecting Against LogoFail: Updates and Precautions

The final paragraph focuses on the steps users can take to protect their computers from the LogoFail exploit. It suggests updating the BIOS to the latest firmware as the most effective solution, provided by the system or motherboard manufacturers. The paragraph also cautions about the risks of BIOS updates and advises users to follow manufacturer instructions or seek help from knowledgeable individuals. It concludes with a call to action for viewers to share their thoughts on the matter and to utilize the sponsor's services for data protection.

Keywords

💡LogoFail

LogoFail is a term used to describe a collection of exploits related to computer BIOS firmware. It is a significant security concern because it allows malware to infect the firmware, which is embedded code within hardware and is not stored on the drive. This makes it incredibly difficult to remove the malware, as traditional methods like wiping the hard drive are ineffective. The exploit was discovered by the company Binarly, and it leverages vulnerabilities in the image parsers used by BIOS software companies to load manufacturer logos during system startup.

💡BIOS firmware

BIOS (Basic Input/Output System) firmware is the embedded code stored on a physical chip on the motherboard that initializes the hardware components of a computer during startup. It is a crucial part of the system as it runs before the operating system, making it a prime target for malware. In the context of the video, the BIOS firmware is vulnerable to the LogoFail exploit, which can lead to persistent and hard-to-remove malware infections.

💡Firmware-level malware

Firmware-level malware is a type of malicious software that infects the firmware of a device, such as a computer's BIOS or UEFI (Unified Extensible Firmware Interface). This type of malware is particularly dangerous because it operates at a level below the operating system, making it invisible to most security measures and difficult to remove. It can persist even after the hard drive is wiped clean, as it is not stored on the drive but in the hardware's firmware.

💡Secure Boot

Secure Boot is a security feature designed to ensure that the BIOS data is not manipulated during startup. It verifies that the firmware and other system software components are loaded from trusted sources by checking their digital signatures. However, the video points out that Secure Boot may not check all parts of the EFI partition, such as the logo image files, which can be exploited by malware like LogoFail.

💡EFI System Partition

The EFI System Partition (ESP) is a small partition on a hard drive that stores firmware-related data, including boot loaders for multiple operating systems and, in some cases, manufacturer logos. It is used by systems with UEFI firmware, which is an advanced version of the traditional BIOS. The video explains that malware can exploit vulnerabilities in the EFI partition to replace the logo with a malicious version, leading to a firmware infection.

💡Malware

Malware, short for malicious software, is any software intentionally designed to cause damage, collect sensitive information, or disrupt system operations. In the context of the video, malware refers to the threats posed by the LogoFail exploit, which allows for the installation of persistent firmware-level malware that cannot be removed by simply wiping the hard drive.

💡Rootkits

A rootkit is a type of malicious software that provides the attacker with unauthorized access to a computer or network by masking its existence and the activities conducted by the intruder. Rootkits are particularly dangerous because they can hide deep within the operating system and are difficult to detect and remove. They often load before the operating system, allowing them to control system functions and cover their tracks.

💡Fileless malware

Fileless malware is a type of malicious software that resides in the computer's memory rather than on the hard drive. It executes directly in RAM and typically runs as a script or process that starts with the operating system. Because it does not leave files on the disk, it is harder to detect with traditional antivirus software and can be more persistent even after system reboots.

💡Aura

Aura is a cybersecurity software suite mentioned as a sponsor in the video. It offers a range of features designed to protect personal data and secure online activities, including antivirus protection, VPN services, password management, and identity theft insurance. The software aims to safeguard users from data breaches and cyber threats by providing a comprehensive security solution.

💡Intel Boot Guard

Intel Boot Guard is a security technology designed to protect the integrity of the BIOS firmware during the boot process. It ensures that only trusted and verified firmware updates are applied to the system. Some Dell computers use a special configuration of Intel Boot Guard that also checks the image portion of the firmware, making them less vulnerable to certain types of firmware-level malware, like the LogoFail exploit.

💡Binarly

Binarly is a company that specializes in firmware security research. In the context of the video, Binarly discovered the LogoFail exploit, which highlights vulnerabilities in the image parsers used by BIOS software companies. This discovery has significant implications for computer security, as it exposes a new way for malware to infect firmware that is difficult to detect and remove.

Highlights

A new exploit called LogoFail has been discovered that affects computer's BIOS firmware.

LogoFail is a collection of exploits related to BIOS firmware, making traditional virus removal methods ineffective.

Firmware-level malware is like the 'final boss' of malware because it's embedded within hardware and not stored on the drive.

Malware can reinstall malicious files or start processes invisible to the operating system, if it infects the firmware.

The LogoFail exploit allows malware to infect firmware by manipulating the BIOS chip on the motherboard.

Binarly, a company, discovered that image parsers used by BIOS software companies have many exploits.

Malware can trick the BIOS into loading an image file that contains malicious code, leading to firmware infection.

Secure Boot technology, designed to prevent BIOS data manipulation, often does not check image files, allowing this exploit to occur.

Personal data is vulnerable to exploitation, which is where the sponsor, Aura, steps in to protect user information.

Aura helps protect personal data, reduce spam, and guard against hackers using personal information for phishing attacks.

Malware can replace the logo file in the EFI System Partition, which is usually protected but has unsigned blocks that can be exploited.

Two of the three main attack vectors for LogoFail do not require physical access to the computer, unlike the third method which involves a SPI Flash Programmer.

Macs, certain Dell devices with Intel Boot Guard, and some MSI motherboards are not vulnerable to LogoFail.

The best way to protect against LogoFail is to update the BIOS to the latest firmware, which should patch the exploit.

BIOS updates should be done carefully to avoid causing severe system issues.

ASUS and Gigabyte have released BIOS updates specifically mentioning the patch for the LogoFail exploit.

There have been no known active uses of LogoFail, but it's important to be aware and take preventative measures.

Users are encouraged to update their BIOS or seek help from someone knowledgeable to mitigate the risk of LogoFail.

Transcripts

Imagine a computer virus that you cannot remove even by wiping a hard drive completely or

removing it all together.

Surely that can't be possible, right?

Well, you might want to sit down for this one.

There is a recently discovered exploit, it was discovered a couple months ago, that your

computer is very likely to be vulnerable to.

It's being called LogoFail, and it actually is a collection of several exploits having

to do with your computer's BIOS firmware.

To understand what the big deal is, let me give you a quick primer on firmware-level

malware, which is kind of like the big final boss of malware.

You see, regular malware and viruses, we kind of all know how they work.

They usually install themselves and embed themselves in the operating system or in some

files, that gets autorun when the computer starts up, and then does whatever, tracking

or stealing.

If there's different levels of ways these viruses hide themselves, for example, rootkits

might literally be starting up before anything else in the operating system, so it can't

really be detected.

Or fileless malware is another example where it doesn't even have any files themselves

on the drive, it kind of runs as a script that starts a process along with the operating

system.

But at the end of the day, you could wipe the drive and get rid of these.

But the firmware, which is like embedded code within hardware itself, that is not stored

on the drive anywhere.

For example, we've all probably heard of the BIOS.

These days, it's technically the UEFI, but everyone calls it the BIOS, that's what I'm

gonna call it.

Anyway, that is gonna be stored on a physical BIOS chip on the motherboard, and that's why

it can run even if there's no drive installed on the computer.

So in cases where the firmware is infected by malware, because that firmware code gets

loaded before any other software, the operating system, drivers, anything else, then there's

literally nothing that can stop it.

It can do anything from reinstalling malicious files onto the drive repeatedly every time

at boot up, or starting a process that is malicious that the operating system can't

even see it all, therefore you can never detect it.

And unfortunately, this LogoFail set of exploits does allow malware to infect the firmware

itself.

So first, let me give you a quick overview of how this LogoFail thing works and why it's

so bad, and then I can go into a bit more details.

So you know when you boot up your computer, you're usually gonna see a logo of some kind.

Maybe it's the manufacturer of the motherboard, or if it's a branded computer, you'll see

the computer manufacturer logo comes up.

And also, oftentimes, the BIOS may allow a user to actually customize what logo shows

up, what image does.

Well turns out, a company called Binarly discovered that the image parsers, which is like the

bits of software that loads these images, they apparently have lots of exploits, and

they're used by basically all the BIOS software companies.

And the big takeaway is that a bad actor could create image files, regular image files, that

are encoded in such a way that when the bits of software load the image onto the BIOS,

it can trick it into doing a lot more stuff, including just rewriting the firmware to have

malicious code in there and doing whatever they want.

And the reason this is especially bad is because, yes, there are actually technologies, such

as Secure Boot, that are specifically designed to ensure that BIOS data is not manipulated

on startup.

But apparently, they do not usually check the image files, which is how this is allowed

to get through.

So what would happen is you'd get infected with malware one way or the other, usually

the typical way you download a file unknowingly.

And instead of running a stealer or installing pop-ups or whatever, it will replace the image

that gets loaded by the BIOS, and then your firmware is hacked.

And then literally nothing will be able to detect it.

Before I get into the details though, something else that's vulnerable is your personal data,

which is where today's sponsor comes in, Aura.

Sketchy data brokers out there collect and sell your information to scammers, spammers,

and anyone else who may want to target you.

I'm talking about your full name, email, home address, health records, your relatives.

It's all out there.

But that's where Aura comes in.

For example, it can show me which data brokers are selling my info, and automatically submit

opt-out requests for me.

Cleaning up all this info not only reduces the amount of spam coming my way, but protects

me from hackers who might leverage this info to try and access my accounts, or even send

personalized phishing attacks.

I was even surprised when it showed me that the collected public info out there even included

what kind of car I drive.

I was not expecting that.

But Aura also has a ton of other features, such as antivirus, a VPN, password management,

parental controls, even identity theft insurance, all in one place, instead of needing a bunch

of separate apps.

And even if you have one or two of these tools already, you could be still leaving doors

open to bad actors.

But Aura is always on, so you can have peace of mind and focus on the other important stuff.

To get started and protect your info, you can go to Aura.com/ThioJoe to start your two-week

free trial.

Link is also in the description.

And with all that being said, let's continue.

So in terms of more details about how the malware actually replaces the logo file, there's

three main attack vectors that they could choose to use.

And importantly, for two of these, it does not require the attacker to have physical

access to your computer.

It can be remotely hacked, like any other virus.

So I've seen people say, "Oh well don't worry, they have to have physical access to your

computer."

No, they do not.

The first strategy they can use is to replace the file in the so-called EFI System Partition.

You see, these days, the UEFI, which is basically like an advanced version of the old BIOS,

but people still call it the BIOS.

Anyway, in addition to having the firmware, which boots up and can do stuff, they also

usually load supplemental data onto the hard drive in a special EFI partition.

It's very small, about a hundred megabytes.

And this will contain info about how to boot individual operating systems.

So if you have a multi-boot system, usually it's all going to be stored in one place.

And this EFI partition will have stuff like the boot loaders for the operating systems,

but may also contain those logos.

So what happens is you get some kind of malware that infects your computer, and either by

tricking you into running it as admin, or it does a privilege escalation attack, it

gets the ability to simply write the malicious image file to this EFI partition.

So it's literally just a matter of copying a file over.

So what happens is the BIOS on startup will see that logo and load it, and try to display

it, but it has that malicious code, and then it'll manipulate the BIOS firmware, so it

doesn't even need that logo again to run.

It'll already be embedded in the firmware, and that's why if you erase the drive, it

doesn't help anymore.

Now, typically this EFI system partition is protected by something like Secure Boot.

That's what it does.

It makes sure that none of these files are manipulated, different than the officially

signed versions.

But apparently it turns out that there are sections of the EFI partition that are not

checked.

They're part of unsigned blocks.

So it doesn't check everything.

Apparently the logo is part of that oftentimes.

Next, the second attack vector would be through a malicious BIOS update file.

So usually a computer is going to have a way where the user can update a BIOS file one

way or another.

And sometimes this even includes a tool that allows you to take a firmware update file,

and run it from within the operating system.

As it's already running, you don't even have to reboot, and it'll update the firmware directly

from within the OS.

And usually this isn't really a problem security-wise, because the existing BIOS will check that

the new BIOS file is signed correctly, and hasn't been tampered with, and then only will

it install.

But again, apparently part of these files are not actually checked, and don't have to

be signed, including a logo file.

So what malware could do is take a legitimate BIOS update file, and replace the part that

doesn't get checked, and replace that image file only in that part.

So the actual code part, which used to be assumed to be the only part that matters security-wise,

it won't be changed, and the BIOS will load everything from that file, including the image,

and then that's when it'll get infected.

Now there is a third attack vector that does actually require using physical access.

And in that case, we'd use something called a SPI Flash Programmer, where you literally

connect pins and stuff.

That is pretty advanced.

In that case, you'd go directly to the hardware level and replace the file in there.

That's probably not going to happen usually.

And if someone has physical access to your computer, you're kind of screwed anyway.

But it is an option nonetheless.

Now I'm sure at this point most of you are wondering how you can tell if your computer

is vulnerable, and what you can do to protect yourself.

And first of all, it's probably easier to go over who is not vulnerable.

First of all, Macs are not vulnerable.

Even Intel-based Macs are not.

That's because the Apple Silicon Macs don't use UEFI at all, and the Intel-based Macs

have the image hard-coded in such a way that there is a check including on the image, so

you can't replace it.

Next, there are some Dell devices that are apparently not vulnerable because they use

an additional type of technology, not Secure Boot, but it's called Intel Boot Guard.

Which actually is supported on most computers, but Dell has it configured in a special way

where it also checks the image portion, whereas for a lot of computers, even if it does have

Intel Boot Guard, they don't check the image.

So apparently a lot of Dell computers are safe because it is covering the image.

Next, from what I've read, MSI motherboards are also not vulnerable because they don't

allow the user to change the logo, and the logo is included as part of the signed block

of Intel Boot Guard.

Although I haven't been able to find any official confirmation from MSI about this.

And then again, MSI did have their Intel Boot Guard hardware keys leaked last year.

So I mean, it's still better than nothing I guess.

In any other cases besides those though, it is probably good to assume that you are vulnerable.

The good news is that as far as I know and have read, there haven't been any instances

of this being actively used yet, but that doesn't mean that it won't be.

And as for how to protect yourself, well, really the only true solution is to update

your BIOS to the latest firmware, assuming that your system manufacturer created a BIOS

update to cover this.

By now, most motherboard and system manufacturers should have released a BIOS update if they

were going to on more recent software.

They said typically by early Q1 2024.

Though again, for older systems, they might take longer if they're going to do it at all.

For example, if you look at recent BIOS updates from ASUS and Gigabyte, they specifically

mention these BIOS updates as patching the LogoFail exploit.

So that's something you would want to look for for your system.

Although you always do have to be cautious when updating the BIOS, if you screw it up

like turning off the computer in the middle of it, it could really mess up your system.

So if you really don't know what you're doing, maybe just look on the manufacturer's website,

see if they have any detailed instructions on how to do it, or maybe ask one of your

friends who's good with computers to do it.

It's not super tough, but it's just that if it does go wrong, it can go really wrong.

So yeah, it's pretty scary and especially that not a lot of people probably know about

this, but at least now you do and you can potentially address it.

So I would be curious to know what you guys think.

Are you going to bother updating the BIOS or just take the risk?

We can just talk about that down in the comments.

Thanks again to Aura for sponsoring this video.

If you want to protect your data and take advantage of all the other features it has,

go to Aura.com/ThioJoe for a two-week free trial, link in the description.

So if you enjoyed this video, be sure to give it a big giant thumbs up for the YouTube algorithm.

And if you want to keep watching, I made a video recently about some very tricky malware

techniques hackers are using to even target programmers and Linux users.

Usually you think they're pretty safe, but no.

So I'll put that link right there you can click on.

Thanks so much for watching and I'll see you in the next one.