RESEARCHERS DISCOVER FIRST UEFI BOOTKIT MALWARE FOR LINUX

Summary from the TLDR InfoSec newsletter

Researchers at ESET discovered the first-ever UEFI bootkit (titled Bootkitty) targeting Linux devices when it was uploaded to VirusTotal. Bootkitty hooks UEFI security authentication protocols. It then hooks various GRUB functions to turn off kernel signature verification and intercepts the Linux kernel's decompression process to allow for loading malicious kernel modules. Bootkitty replaces the first environment variable to always load the malicious library at process startup. The bootkit relies on self-signed certificates, specific byte-pattern matching, and hardcoded offsets, so it will only work on specific GRUB and kernel versions. It is still likely in development.