BIOS Attack

BIOS Necromancy: Utilizing “Dead Code” for BIOS Attacks

During our work towards trying to help secure firmware, we have begun to discover a trend. There are situations where unused “dead …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Thunderstrike 2: Sith Strike
In this work we teamed up with Trammell Hudson to improve upon his previous Thunderstrike proof of concept. Previously it required …
Trammell Hudson, Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video Demo Video 1 - Thunderstrike 2 'firmworm' propagation video Demo Video 2 - Bricking MacMini without a need for an exploit
How Many Million BIOSes Would you Like to Infect?
Because people don’t ever patch their BIOSes, it is extremely likely that the vast majority of systems in the wild are vulnerable to at …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Demo Video 1 - Infecting ASUS Demo Video 2 - Infecting HP Demo Video 3 - Attacking TAILS Demo Video 4 - Bricking a Gigabyte motherboard with “DualUEFI” backup BIOS, which is supposed to prevent bricking
Betting BIOS Bugs Won’t Bite Y’er Butt?
Survey of some of the many BIOS level vulnerabilities that have come out in the past few years, for those who were not following the …
Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video
Analyzing UEFI BIOS from Attacker and Defender Viewpoints
In 2013, MITRE released Copernicus 1, a best-effort system to capture a raw dump of the BIOS and whether it appears to be possible for …
Xeno Kovah, John Butterworth, Corey Kallenberg, Sam Cornwell
Cite Slides (PDF) Conference Presentation Video
Extreme Privilege Escalation on Windows 8/UEFI Systems
Public disclosure of two vulnerabilities (VU#552286) that allow a ring 3 attacker to feed a UEFI system a fake BIOS update, cause a …
Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
SENTER Sandman: Using Intel TXT to Attack BIOSes
A description of how Intel TXT’s SMI suppression behavior can be used to subvert a BIOS protection mechanism. Also a discussion of on …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Setup For Failure: Defeating Secure Boot
Disclosure of a vulnerability (VU#758382) with the “Setup” UEFI non-volatile variable on some systems. Manipulation of this variable …
Corey Kallenberg, Sam Cornwell, Xeno Kovah, John Butterworth
Cite Slides (Merged with Intel, PDF) Slides (Unmerged with Intel, PDF) Whitepaper (PDF) Conference Presentation Video
Copernicus 2: SENTER the Dragon!
Discussion of how a SMM MitM attacker (“Smite’em”) can subvert all software-based BIOS capture utilities (including our own …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Smiteem defeating BIOS reading tools demo video Copernicus 2 demo video
Defeating Signed BIOS Enforcement
While there had been previous attacks, against BIOS, they often relied on having a BIOS that was wide open. Only a single previous …
Corey Kallenberg, John Butterworth, Xeno Kovah, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
BIOS Chronomancy: Fixing the Core Root of Trust for Measurement
(The first appearance at NoSuchCon in May 2013 did not include a discussion of VU#912156, but subsequent talks did.) Discussed how the …
John Butterworth, Corey Kallenberg, Xeno Kovah, Amy Herzog
Cite Slides (PDF) Whitepaper (PDF) Copernicus Binary Executable (ZIP) Conference Presentation Video
Copernicus: Question your assumptions about BIOS security
Discussion of how Copernicus could be used for enterprise-wide assessment of BIOS vulnerabilities, and integrity checking BIOSes to …
Xeno Kovah, Corey Kallenberg, John Butterworth, Amy Herzog
Cite Code