Firmware Vulnerability Assessment

BIOS Necromancy: Utilizing “Dead Code” for BIOS Attacks

During our work towards trying to help secure firmware, we have begun to discover a trend. There are situations where unused “dead …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Thunderstrike 2: Sith Strike
In this work we teamed up with Trammell Hudson to improve upon his previous Thunderstrike proof of concept. Previously it required …
Trammell Hudson, Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video Demo Video 1 - Thunderstrike 2 'firmworm' propagation video Demo Video 2 - Bricking MacMini without a need for an exploit
Are You Giving Firmware Attackers a Free Pass?
Yes. Yes you are. Because you’re not patching away the vulnerabilities we and others have found and disclosed, and you’re not …
Xeno Kovah, Corey Kallenberg
Cite Slides (PDF)
How Many Million BIOSes Would you Like to Infect?
Because people don’t ever patch their BIOSes, it is extremely likely that the vast majority of systems in the wild are vulnerable to at …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Demo Video 1 - Infecting ASUS Demo Video 2 - Infecting HP Demo Video 3 - Attacking TAILS Demo Video 4 - Bricking a Gigabyte motherboard with “DualUEFI” backup BIOS, which is supposed to prevent bricking
What Would it Take to Enable Global Firmware Vulnerability Checking & Integrity Checking?
A Microsoft-targeted discussion of what they could do to improve the state of firmware security, e.g. by performing vulnerability and …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Into the Unknown: How to Detect BIOS Attackers
Talks targeted at encouraging Anti-Virus vendors to start checking for malware at the BIOS level, and to encourage Mandiant customers …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (VirusBulletin - PDF) Slides (MIRCon - PDF)
Copernicus 2: SENTER the Dragon!
Discussion of how a SMM MitM attacker (“Smite’em”) can subvert all software-based BIOS capture utilities (including our own …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Smiteem defeating BIOS reading tools demo video Copernicus 2 demo video
Copernicus: Question your assumptions about BIOS security
Discussion of how Copernicus could be used for enterprise-wide assessment of BIOS vulnerabilities, and integrity checking BIOSes to …
Xeno Kovah, Corey Kallenberg, John Butterworth, Amy Herzog
Cite Code