Extreme Privilege Escalation on Windows 8/UEFI Systems

Abstract

Public disclosure of two vulnerabilities (VU#552286) that allow a ring 3 attacker to feed a UEFI system a fake BIOS update, cause a memory corruption while it’s being parsed, and execute arbitrary code in the context of SMM, before signature checks or any other protection mechanisms are in play. These vulnerabilities affected hundreds of PC models. This talk also introduced “The Watcher”, a PoC SMM agent that can perform arbitrary code execution on behalf of an attacker.