Is Your Computer at Risk from the Logo Fail Exploit?

[WWGD]

How bad serious is the Logo Fail exploit, where malware is spread through images?
Is there a way of booting up in a way that images/logos are not displayed?

 

[jedishrfu]

Didn't know this was a thing.

https://arstechnica.com/security/20...e-vulnerable-to-new-logofail-firmware-attack/

Tom's hardware has something on it:

https://www.tomshardware.com/pc-com...-and-is-nearly-impossible-to-detect-or-remove

 

[jedishrfu]

Forgot to say YIKES!

This exploit is truly scary.

 

[pbuk]

1. Calling LogoFAIL an 'exploit' is misleading (I know it's not your term @WWGD): it is a (series of) vulnerabilities.
2. No evidence of any attempted exploit involving LogoFAIL has been published.
3. The vulnerability was discovered by a benign research group sometime in 2023 and disclosed confidentially to vendors: when the discovery was made public on 6 December 2023, BIOS patches were published by all vendors (except Phoenix who in an appalling move jumped the gun on 28 November).
4. In order to exploit the vulnerability an attacker requires administrator access. Once an attacker has administrator access it is 'game over' as far as security is concerned anyway.

If you follow these two rules you don't need to be afraid of any kind of technical attack on your personal Windows or Mac system*:

• Keep your system up to date with the latest patches of supported software.
• Never allow untrusted software to gain administrator access e.g. by saying 'yes' to the "Do you want to allow this app to make changes to your device" dialog unless you are sure that you can trust the relevant app.

* (or Linux if you can be sure of what is 'untrusted software' in this context, and unless you are running a commercial distribution this is very difficult).

This exploit is truly scary.

Only in the sense that if you lend someone the keys to your house they can take a copy and then they can let themselves in whenever they want that is 'truly scary' - but if you lend someone the keys to your house they can do whatever they want while they are there anyway.

Much more dangerous and scary, and something you do need to be constantly cautious of because there is very little by way of automatic defence that can be put in place are social engineering attacks.

Scary headlines about technical attack surfaces distract the attention of the public from the real threat.

 

[WWGD]

Isn't there

1. Calling LogoFAIL an 'exploit' is misleading (I know it's not your term @WWGD): it is a (series of) vulnerabilities.
2. No evidence of any attempted exploit involving LogoFAIL has been published.
3. The vulnerability was discovered by a benign research group sometime in 2023 and disclosed confidentially to vendors: when the discovery was made public on 6 December 2023, BIOS patches were published by all vendors (except Phoenix who in an appalling move jumped the gun on 28 November).
4. In order to exploit the vulnerability an attacker requires administrator access. Once an attacker has administrator access it is 'game over' as far as security is concerned anyway.

If you follow these two rules you don't need to be afraid of any kind of technical attack on your personal Windows or Mac system*:

• Keep your system up to date with the latest patches of supported software.
• Never allow untrusted software to gain administrator access e.g. by saying 'yes' to the "Do you want to allow this app to make changes to your device" dialog unless you are sure that you can trust the relevant app.

* (or Linux if you can be sure of what is 'untrusted software' in this context, and unless you are running a commercial distribution this is very difficult).


Only in the sense that if you lend someone the keys to your house they can take a copy and then they can let themselves in whenever they want that is 'truly scary' - but if you lend someone the keys to your house they can do whatever they want while they are there anyway.

Much more dangerous and scary, and something you do need to be constantly cautious of because there is very little by way of automatic defence that can be put in place are social engineering attacks.

Scary headlines about technical attack surfaces distract the attention of the public from the real threat.

Fair-enough; I may have jumped the gun. But Jedi's articles refer to it as a vulnerability only:
"LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years...."

 

[WWGD]

I'm still puzzled at how image files can transmit malware.

 

[JamalGross]

Malicious actors can embed malware code or instructions within the pixels of an image file without visibly altering the image's appearance. This technique is called steganography. The malware may be hidden within the least significant bits of the image's pixels, making it difficult to detect without specialized tools.