Vulnerability in popular bootloader puts locked-down Linux computers at risk

onebuck · 12-18-2015, 12:34 PM

Hi,

From http://www.csoonline.com/article/301...s-at-risk.html

Quote:

The flaw can allow attackers to modify password-protected boot entries and deploy malware

Pressing the backspace key 28 times can bypass the Grub2 bootloader's password protection and allow a hacker to install malware on a locked-down Linux system.
GRUB, which stands for the Grand Unified Bootloader, is used by most Linux distributions to initialize the operating system when the computer starts. It has a password feature that can restrict access to boot entries, for example on computers with multiple operating systems installed.
This protection is particularly important within organizations, where it is also common to disable CD-ROM, USB and network boot options and to set a password for the BIOS/UEFI firmware in order to secure computers from attackers who might gain physical access to the machines.
Without these boot options secured, attackers or malicious employees could simply boot from an alternative OS -- like a live Linux installation stored on a USB drive or CD/DVD -- and access files on a computer's hard drive

Hope this helps!

sgosnell · 12-18-2015, 04:30 PM

If you're relying on a grub password to protect your system, you probably believe in the tooth fairy.

jefro · 12-18-2015, 07:44 PM

The problem has ways been a physical access issue.

rokytnji · 12-18-2015, 07:59 PM

My 5 dogs say come on and try it

My shop stays gaurded and secure. The Harleys are worth more to me than my computers.
I don't expect a geek to show up knowing the grub flaw and bringing a .45 to just hack into my computer.

Besides. Debian already pushed out a fix for this I am pretty sure.

onebuck · 12-18-2015, 10:07 PM

Hi,

Yes, look at;
http://cve.mitre.org/cgi-bin/cvename...=CVE-2015-8370

I posted the article to inform others that may not know anything about the problem.

Habitual · 12-19-2015, 07:03 AM

Grub2, you heartless bitch.

ondoho · 12-20-2015, 05:52 AM

it's mostly FUD against linux.

the grub manual itself kind of states that its inbuilt authentication system is neither very useful nor very secure:
https://www.gnu.org/software/grub/ma....html#Security

it's a grub bug and has been solved in recent version:
https://security-tracker.debian.org/.../CVE-2015-8370

also see here:
https://forums.bunsenlabs.org/viewtopic.php?id=880