firmWar: An Imminent Threat to the Foundation of Computing
summary
Leaked AMI firmware for AMI MegaRAC SP‑X yields a post‑auth Redfish command injection that leads to reliable remote code execution and persistence, plus a default u0 root account and weak password hashing — in total five distinct vulnerabilities. Exploit chain is reproducible with a short script using URL payload tricks and can produce working implants within hours. Coordinated disclosure touches about 20 vendors and ~15 hardware families, potentially affecting millions of devices while only thousands are externally reachable.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:32Who is Vladislav
- 3:31What is firmWar
- 6:23Supply chain
- 9:10High Privileges
- 11:41Are these attacks practical
- 13:54Whats new
- 17:09How it all started
- 22:01The vulnerability
- 24:10The exploit
- 28:45Other vulnerabilities
- 31:06The Fallout
- 33:50Lonic
- 36:02Supply Chain Attacks
related talks
45mOutside the box: pwning IoT devices through their applications
39mNight of the living vulnerabilities
50mPwnie Awards 2016
44mExposing Critical Threats In Millions Of Connected Devices
27mWIFI-Important Remote Attack Surface: Threat is Expanding
40mSomething Rotten in the State of Data Centers
45mFirmware.RE: Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service
01h 08mAutomated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web Interfaces