Firmware Supply Chain Security BoF
summary
Discussion documents concrete failures: UEFI and BMC firmware carry exploitable code (examples BlackLotus and Ring Hopper) that can persist past OS reimages, Microsoft’s signing model prevents easy revocation, and a fix chain can take over a year to reach end customers. Coordinated disclosure stalled on multi‑vendor validation, an event potentially affecting 100 million machines prompted delayed fixes and a Microsoft roadmap toward dual‑certificate revocation finishing in 2024–2025; tooling, SBOMs for firmware, and end‑to‑end supply‑chain coordination are missing.
AI-written summary · about
chapters (26)
- 0:00Firmware supply chain security intro
- 1:05Why security matters now
- 2:30Ring Hopper vulnerability timeline
- 4:15Multi-vendor firmware issues
- 6:45Intel delays Black Hat talk
- 8:51BMC firmware attack surfaces
- 10:17Black Lotus and UEFI risks
- 13:52Microsoft’s delayed Black Lotus fix
- 15:39Firmware prime target for threats
- 17:03Audience participation call
- 19:32Safe space for collaboration
- 21:40Firmware CVEs and SBOM ecosystems
- 24:50Regulatory pressures ahead
- 28:02SBOM adoption in firmware
- 30:35Supply chain transparency gaps
- 33:25Firmware update tooling
- 34:51Software patterns for firmware
- 37:42Proposing FIRST firmware SIG
- 41:19Defining SIG scope
- 43:04Microsoft’s Black Lotus challenges
- 45:13Incident coordination priorities
- 47:00EO 14028 and SBOM progress
- 49:11Shifting left on firmware
- 50:56SIG needed before regulation
- 52:00Firmware scope for SIG
- 53:05Next steps and closing
related talks
33mThe Various Shades of Supply Chain: SBOM, N-Days and Zero Trust
37mThe Firmware Supply-Chain Security Is Broken: Can We Fix It?
40mHardware Security Is Hard: How Hardware Boundaries Define Platform Security
30mWhy Open Source Firmware is Important
15mDevice Security Matters More Than Ever
39mSoftware Supply Chain Security
21mIndustrial IoT security issues and countermeasures
42mUEFI Bootkits and Where UEFI Security Fails