{"id":1604,"date":"2025-01-16T11:00:00","date_gmt":"2025-01-16T11:00:00","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/16\/trusted-apps-compromise-uefi-boot-process\/"},"modified":"2025-01-16T11:00:00","modified_gmt":"2025-01-16T11:00:00","slug":"trusted-apps-compromise-uefi-boot-process","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/trusted-apps-compromise-uefi-boot-process\/","title":{"rendered":"Trusted Apps Compromise UEFI Boot Process"},"content":{"rendered":"\n<\/p>\n<p><strong>Vulnerability in Trusted System Recovery Programs<\/strong><\/p>\n<p>A vulnerability in trusted system recovery programs could allow privileged attackers to inject malware directly into the system startup process in Unified Extensible Firmware Interface (UEFI) devices.<\/p>\n<p><strong>Affected Recovery Products<\/strong><\/p>\n<p>Seven real-time recovery products \u2014 Howyar SysReturn, Greenware GreenGuard, Radix SmartRecovery, Sanfong EZ-back System, WASAY eRecoveryRX, CES NeoImpact, and SignalComputer HDD King \u2014 all make use of &quot;reloader.efi,&quot; the Microsoft-signed Extensible Firmware Interface (EFI) file at issue.<\/p>\n<p><strong>The Problem<\/strong><\/p>\n<p>The problem, ESET explains in a new report, is that reloader.efi uses a custom loader that enables the application to load even unsigned binaries during the boot process. In essence, it&#8217;s a backdoor for sneaking any kind of file into a system&#8217;s startup.<\/p>\n<p><strong>UEFI Signing Requirements<\/strong><\/p>\n<p>Microsoft maintains a list of requirements for signing UEFI binaries, but the process is a bit obscure, according to Smol\u00e1r. &quot;I don&#8217;t know if it involves only running through this list of requirements, or if there are some other activities involved, like manual binary reviews where they look for not necessarily malicious, but insecure behavior,&quot; he says. Microsoft has previously alluded to UEFI binaries being &quot;approved through manual review.&quot; Dark Reading has reached out to the company for more clarity on this point.<\/p>\n<p><strong>CVE-2024-7344 Discovery and Fix<\/strong><\/p>\n<p>ESET first discovered CVE-2024-7344 in July 2024. Since then, all vulnerable applications have been fixed, and Microsoft revoked the old, vulnerable binaries in its January 14, 2025, Patch Tuesday update.<\/p>\n\n<br \/><a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/trusted-apps-bug-uefi-boot-process\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Vulnerability in Trusted System Recovery Programs A vulnerability in trusted system recovery programs could allow privileged attackers to inject malware directly into the system startup process in Unified Extensible Firmware&#8230;<\/p>\n","protected":false},"author":19,"featured_media":1605,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"class_list":["post-1604","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/01\/Bootkit-Ognyan_Yosifov-Alamy.jpg","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=1604"}],"version-history":[{"count":0,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/1605"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=1604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=1604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=1604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}