BOOTKITTY: A Stealthy Bootkit-Rootkit Against Modern Operating Systems
summary
BOOTKITTY is a hybrid bootkit-rootkit that successfully compromises Windows Linux and Android by exploiting firmware and bootloader flaws to break the chain of trust and persist in the boot partition. It uses an out-of-bounds write in the pre-boot stage to bypass Secure Boot, installs via USB or network, escalates to root, and hooks shim and GRUB to inject into the kernel decompression path disabling lockdown and module signing. Demos validate Linux and Android implants; Windows details and full mitigation analysis are in the paper.
AI-written summary · about
chapters (12)
- 0:00BootKitty introduction
- 1:15Bootkit evasion and persistence
- 2:43BootKitty hybrid design
- 3:48Linux boot process attack points
- 5:35Exploiting GRUB in Linux
- 6:40Linux vulnerability exploitation
- 7:44Linux boot compromise demo
- 9:17Android boot process security
- 11:04Hijacking Android bootloader
- 12:52Android vulnerability exploitation
- 14:19Android boot compromise demo
- 15:23Summary boot process hardening
related talks
28mBOOTKITTY: Multi-OS Trust Chain compromise from Bootkit to Rootkit
42mUEFI Bootkits and Where UEFI Security Fails
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
25mBootStomp: On the Security of Bootloaders in Mobile Devices
40mAndroid Rootkits: Analysis from Userland and Kernelland
47mExposing Bootkits with BIOS Emulation
49mHorse Pill: A New Type of Linux Rootkit
50mMalware Buried Deep Down the SPI Flash: Sednit's First UEFI Rootkit Found in the Wild