BOOTKITTY: Multi-OS Trust Chain compromise from Bootkit to Rootkit

on YouTube ↗28m

" summary

A hybrid bootkit called BootKitty runs on Windows, Linux and Android and demonstrates end-to-end compromise: it bypasses Secure Boot via an out‑of‑bounds "log_fail" exploit and Odin/auth bypass, installs into the EFI partition, hooks start_image and shim/grub stages, hooks kernel decompression, forces kernel module signature checks to return zero and then uses LD_PRELOAD rootkit loading to persist; installers include a BadUSB demo and network variant, Linux/Windows test VM images are published and Android attack only works on specific hardware, verified in live demos using signature‑based function discovery.

AI-written summary · about

" chapters (25)

1. 0:00BOOTKITTY overview and speakers
2. 0:49Bootkit threats and landscape
3. 2:17UEFI boot process and bootkit points
4. 3:40DXE phase role in boot
5. 4:25BDS phase and bootloader hijack
6. 5:50Secure Boot limits and bypasses
7. 6:32BOOTKITTY hybrid bootkit
8. 7:35Linux boot stages and Shim vulns
9. 8:42Machine Owner Key in Shim exploit
10. 9:43GRUB StartImage hooking
11. 11:09Kernel decompression bypass
12. 12:36Rootkit via LD_PRELOAD and init
13. 14:03Logfail arbitrary code exec
14. 14:48USB attack and infection
15. 16:37Linux demo of BOOTKITTY
16. 17:21Android boot process and levels
17. 18:25ROM stage attack surface
18. 19:09Little Kernel verified boot bypass
19. 20:15Odin auth bypass and code exec
20. 21:16Kernel Launch protections bypass
21. 22:39Android attack and rootkit
22. 24:48Android demo of BOOTKITTY
23. 25:30BOOTKITTY across OS summary
24. 26:56Conclusion and research resources
25. 27:37Q&A

" related talks

• 17mBOOTKITTY: A Stealthy Bootkit-Rootkit Against Modern Operating SystemsJunho Lee, HyunA Seo, Jihoon Kwon, Myeongyeol Lee, Hyungyu Seo, Jinho Jung, Hyungjoon Koo · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 42mUEFI Bootkits and Where UEFI Security FailsMartin Smolar · RSA Conference 2024
• 38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-ExploitationRuben Boonen, Valentina Palmiotti · Black Hat USA 2023
• 40mAndroid Rootkits: Analysis from Userland and KernellandDinesh Venkatesan, Aditi Bhatnagar · RSAC 2021
• 27mBreaking the Chain of TrustJesse Michael, Mickey Shkatov, Alex Bazhaniuk · FIRSTCON21 Virtual Edition 2.0
• 25mBootStomp: On the Security of Bootloaders in Mobile DevicesChristopher Kruegel, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry, Giovanni Vigna, Yanick Fratantonio, Nilo Redini, Dipanjan Das, Eric Gustafson · 26th USENIX Security Symposium (USENIX Security '17)
• 47mExposing Bootkits with BIOS EmulationLars Haukli · Black Hat USA 2014
• 49mHorse Pill: A New Type of Linux RootkitMichael Leibowitz · Black Hat USA 2016