Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not sure, outside of my expertise, but I think it might not help.

The attack takes place after boot, so maybe at best UEFI secureboot could prevent persistence of the malware, but I don't think it'd even achieve that, as the malware adds popular Linux utilities that were modified to serve as user land rootkits, and runs them by modifying the ~/.profile script. That script is ran when the user logs in (it starts the malware first, and then everything that's supposed to run on the server after), and I don't believe UEFI secureboot has any protections against ~/.profile script modifications or rootkits ran after boot.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: