Vulnerability in popular bootloader puts locked-down Linux computers at risk

CSO Online ^ | 16 December 2015 | Lucian Constantin

[ShadowAce]

[so_real]

Doesn't this exploit require physical access to the hardware?

[ShadowAce]

Yeah, pretty much. However, GRUB comes before the kernel startup, so what's going on here is that GRUB can impose a password before it even chooses which kernel to boot (and which mode to boot into).

Having to input a GRUB password was considered a way around the "physical access means single user mode" exploit. This vulnerability puts the lie to that concept.

However, there is already a fix for this. We don't have to wait forever, or the next service pack, for a fix to be available.

[so_real]

However, there is already a fix for this. We don't have to wait forever, or the next service pack, for a fix to be available.

I do like that, very much :-) Thanks for the info.

[Scrambler Bob]

Doesn’t this exploit require physical access to the hardware?

---

Beware if your cat gets ‘radicalized’ and then wanders over to your keyboard, backspacing 28 times.

See.

Don’t be scared, but be vigilant.

[LimitedPowers]

Beware if your cat gets 'radicalized' and then wanders over to your keyboard, backspacing 28 times.

Fortunately, my cats can only count to 3.

[so_real]

I've had my eye on the little devil ... I see him practicing ctrl + alt + del. Of course with systemd he'll need to manage it eight times to trigger a reboot. I wonder if the systemd developers are owners of "radicalized" cats ...

[Scrambler Bob]

There was a Dilbert episode where they had a monkey ‘coding’, and other employees complained he could use his tail.

Dilbert says: “You should see him do Ctl-Alt-Del”