The Various Shades of Supply Chain: SBOM, N-Days and Zero Trust
summary
Campaigns expose OEM signing keys (notably MSI and LCFC leaks), enabling authenticated bootloader installs; an Intel OEM debug key also appears leaked. Binary analysis from Binarly and LVFS telemetry show hundreds of firmware flaws (now >300) and systemic deployment failures: most machines lack proper secure-boot/enforcement, ~60% lack flash write-protection, ~30% permit key replacement, and only about 7 million dbx installs occurred (a tiny fraction of fleets). SBOMs, reproducible builds and measured-boot telemetry prove incomplete in practice and updating dbx relies on slow firmware rolls.
AI-written summary · about
chapters (12)
- 0:00Supply chain security intro
- 2:54Firmware supply chain risks
- 8:52Secure Boot limitations
- 11:42Measured Boot and TPM issues
- 15:51Firmware exploit trends
- 20:012023 signing key breaches
- 23:12Modern firmware complexity
- 26:21Vendor patching failures
- 28:53Firmware vulnerability scale
- 30:19ARM and x86 risks
- 31:42Firmware misconfigurations
- 32:03Summary and Q&A
related talks
56mFirmware Supply Chain Security BoF
30mWhy Open Source Firmware is Important
27mBreaking the Chain of Trust
37mThe Firmware Supply-Chain Security Is Broken: Can We Fix It?
37mSecuring OSS across the whole supply chain and beyond
45mUsing Secure Boot for the powers of good
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page