Analyzing UEFI BIOSes from Attacker & Defender Viewpoints
summary
Shows that UEFI makes firmware analyzable but also easier to exploit, reports finding real exploitable memory bugs in the Intel reference code within weeks, and demonstrates an unsigned firmware update capsule leading to early-boot code execution. Provides free tooling: Copernicus to dump BIOS, a biosdiff.py integrity check (still manual) and crowdsourced parsing on subzero.io. Emphasizes that compromise of SMM or flash-write access defeats signature checks, so tools help triage but full manual reverse engineering remains necessary.
AI-written summary · about
chapters (19)
- 0:00Introduction 2
- 3:34BIOS is dead, long live UEFI!
- 7:59About UEFI
- 11:11UEFI Differences: Boot Phases
- 11:50Legacy BIOS Firmware Storage
- 16:20Firmware Files
- 18:35Yay Standardization!
- 19:34Security (SEC) Phase
- 21:07SEC Responsibilities 1 of 2
- 22:10Quick ACPI Note: Sleep Modes
- 23:36SEC Responsibilities 2 of 2
- 25:23SEC Hand-off to PEI Entry Point
- 27:04Components of PEI
- 41:33UEFI Non-Volatile Variables
- 44:07EFI Variable Attributes Combinations
- 45:08Authenticate how Keys and Key Stores
- 47:25UEFI Variables (Keys and Key Stores) 2
- 50:24Boot Device Selection (BDS)
- 52:01Transient System Load (TSL)
related talks
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
01h 13mIs there an EFI monster inside your apple?
47mExposing Bootkits with BIOS Emulation
44mImpact of Platform Firmware on Linux Kernel
44mLogoFAIL: Security Implications of Image Parsing During System Boot
27mBreaking the Chain of Trust