The Firmware Supply-Chain Security Is Broken: Can We Fix It?
summary
Firmware supply-chain problems are concrete: analysis finds 43 high-severity firmware CVEs from repeated code patterns (USBRT, SMM, IBV) and supply-chain collisions where fixes take months to reach users. A public service ships over 51 million updates total, ~2M/month, yet LVFS scans 9,000 updates across 800 models and shows many devices still run years-old microcode. Practical fixes used include FirmwareHunt/EFI Explorer binary rules and lvfs/fwupd distribution to detect silent fixes, speed patch delivery, and track which components actually change.
AI-written summary · about
chapters (6)
- 0:00Introduction to speakers
- 1:07Firmware supply chain issues
- 4:05Vulnerability assessment
- 7:47Case studies and findings
- 24:12LVFS and remediation
- 30:00Collaboration and conclusion
related talks
56mFirmware Supply Chain Security BoF
45mFirmware.RE: Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service
33mThe Various Shades of Supply Chain: SBOM, N-Days and Zero Trust
30mWhy Open Source Firmware is Important
40mHardware Security Is Hard: How Hardware Boundaries Define Platform Security
15mDevice Security Matters More Than Ever
52mAnatomy of a Vulnerability Response - A View from the Inside
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk