LogoFAIL attack: using image files to attack computers

When you turn on a computer, the manufacturer’s logo is displayed on the screen before the operating system boots. This logo can actually be changed — a function intended to be used by laptop and desktop manufacturers. But there’s nothing stopping an ordinary user from using it and replacing the default logo with a different image.

The logo is stored in the code that runs immediately after the computer is turned on, in the so-called UEFI (Unified Extensible Firmware Interface) firmware. It turns out that this logo replacement function opens the way for the device to be seriously compromised — attackers can hack it and subsequently seize control of the system, and this can even be done remotely. The possibility of such an attack — named LogoFAIL — was recently discussed by experts at Binarly. In this article, we’ll try to explain it in simple terms, but let’s first recall the dangers of so-called UEFI bootkits.

UEFI bootkits: malware loaded before the operating system is

Historically, the program run upon turning on a PC was called BIOS (Basic Input/Output System). It was extremely limited in its capabilities, but nevertheless essential — tasked as it was with initializing the computer’s hardware and then transferring control to the operating system loader. Since the late 2000s, BIOS gradually began to be replaced by UEFI — a more sophisticated version of the same basic program but with additional capabilities, including protection against the execution of malicious code.

In particular, UEFI implements the Secure Boot feature, which employs cryptographic algorithms to check the code at each stage of the computer’s booting — from turning it on to loading the operating system. This makes it much more difficult to replace the real OS code with malicious code, for example. But, alas, even these security technologies haven’t completely eliminated the possibility of loading malicious code at an early stage. And if attackers manage to “smuggle” malware or a so-called bootkit into UEFI, the consequences can be extremely serious.

The issue with UEFI bootkits is that they’re extremely difficult to detect from within the operating system. A bootkit can modify system files and run malicious code in an OS with maximum privileges. And the main problem is that it can survive not only a complete reinstall of the operating system, but also replacement of the hard drive. Stashed in the UEFI firmware, a bootkit isn’t dependent on the data stored on the system drive. As a result, bootkits are often used in complex targeted attacks. An example of such an attack is described in this study published by our experts.

So, what do images have to do with it?

Since UEFI has fairly robust protection against the running of malicious code, introducing a Trojan into the boot process isn’t simple. However, as it turns out, it is possible to exploit flaws in UEFI code to execute arbitrary code at this early stage. There was good reason for the Binarly experts to pay attention to the mechanism that allows replacing the factory logo. To display the logo, a program is launched that reads data from the graphic image file and displays this image on the screen. What if we try make this program misbehave?

There are three major UEFI software developers: AMI, Insyde, and Phoenix. Each of them approaches logo processing differently. For example, Insyde has separate image processing programs for different formats — from JPEG to BMP. AMI and Phoenix consolidate the handling of all formats into a single program. Vulnerabilities were discovered in each of them, with a total of twenty-four critical errors. The final result of exploiting one of these errors is shown in this video:

LogoFAIL attack demonstration. Source

It’s all fairly straightforward: attackers can modify the image of the new logo as they please. This includes, for example, setting the logo resolution so that this parameter ends up beyond the limits defined in the handling code. This leads to a calculation error and ultimately results in data being written from the image file into the area for executable data. This data will then be executed with maximum privileges. The video above shows the seemingly harmless result of such a bootkit: a text file is saved to the Windows desktop. However, if malicious code has this level of access, the attacker can perform almost any action in the operating system.

Notably, some computer models from major manufacturers were not susceptible to this attack, and for a very simple reason: replacing the logo in their UEFI is essentially blocked. Among these models are a number of Apple laptops and Dell devices.

Dangerous implications for businesses

Theoretically, this attack can even be carried out remotely: in some cases, it would be enough to inject a specially prepared image into the EFI system partition on the system disk, and it would be processed on the next reboot. The catch is that performing such an operation already requires complete access to the system; that is, any data on the computer should already be available to the attackers. You might wonder then: what’s the point of implementing the LogoFAIL attack? The answer: to ensure that the malicious code survives even if the OS is reinstalled. This kind of persistence is usually highly desired by APT attack operators.

This problem will be resolved gradually by updated UEFI versions that fix errors in the image handlers. However, since not all companies diligently keep up with firmware updates, a huge number of devices will likely remain unprotected. And the list of vulnerable devices includes not only laptops but also some server motherboards. This means that Binarly’s research should be taken very seriously.