Researchers found a good ole fashion cheat code for Linux operating systems that use the Grub2 bootloader. Tapping the backspace key 28 times precisely unlocks all of the content on the other side of Linux login screens, but there are no trophies or achievements to have here.
The vulnerability was discovered by a pair of researchers from Polytechnic University of Valencia's Cybersecurity Group. The backspace backdoor is left open in versions of Linux's Grub2 bootloader from 1.98 to 2.02, or from the year 2009 to 2015.
"To quickly check if your system is vulnerable, when the Grub ask you the username, press the Backspace 28 times," states a report from the researchers. "If your machine reboots or you get a rescue shell then your Grub is affected."
Those who exploit the vulnerability can raise the privilege level of people or programs, and they can, in a few steps, clone the victims' hard drives and install spyware on them. They can also flat out and shut out administrators from their systems.
"The attacker is able to destroy any data including the grub itself," the report states. "Even in the case that the disk is ciphered the attacker can overwrite it, causing a [denial of service]."
As a proof of concept, the researchers used the cheat code to deliver a custom bit of malicious code. They learned that 55 antivirus utilities were unable to detect the malware that walked right through the backspace backdoor.
The pair modified a Firefox library to use as their malware. They loaded it on a USB drive and then replaced the original library.
"Obviously, this is a simple example, and a real malware will exfiltrate the information much more stealthily," the report states.
The researchers have already released an emergency patch to address the security flaw. Meanwhile Linux distributors Ubuntu, Debian and Red Hat have released patches to seal the backdoor shut.
Adding to the good news of the patches is the fact that this exploit must be carried out in person.
