Bootkitty: First UEFI Bootkit Malware Targets Linux Systems

A new exploit, dubbed LogoFAIL, allows attackers to bypass Secure Boot protections on certain Linux machines by injecting malicious code into a bitmap image during the boot process. This code installs a cryptographic key that tricks the UEFI into treating a backdoored GRUB and Linux kernel as trusted, effectively creating a bootkit. The exploit targets devices with Insyde UEFI firmware, affecting models from Acer, HP, Fujitsu, and Lenovo. Insyde has released a patch, but unpatched devices remain vulnerable.