Breaking the Chain of Trust
summary
Shows a real exploit chain: a GRUB parsing bug (BootHole) lets attackers overflow a flex-generated structure to get a write primitive in the bootloader, and GRUB lacks modern mitigations so the bug is fully exploitable. Notes that hundreds of signed shim binaries (~200+) exist, SPI/NVRAM limits (SPI ~16MB, NVRAM ~1MB, ~650 dbx entries) force revocation strategies like sbat slicing, and safe mitigation requires updating bootloaders before pushing dbx. Forensics uses the EFI partition (mount, hash PE files, use dbxtool) to detect compromises.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:10Eclipse
- 1:27Hardware
- 2:37Attack Surface
- 3:51Secure Update
- 5:25Real Attacks
- 6:51Secure Boot
- 10:32Trust Implementation
- 12:17Hardware Implementation
- 13:09Previous Research
- 16:53Architecture Weaknesses
- 18:22Bootloader
- 19:10Flex Bug
- 21:14Config File
- 22:24Architecture
- 24:55Mitigation
- 25:35Relocation
- 26:09UEFI Partition
- 26:48dbx tool
related talks
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
33mThe Various Shades of Supply Chain: SBOM, N-Days and Zero Trust
25mBootStomp: On the Security of Bootloaders in Mobile Devices
44mLogoFAIL: Security Implications of Image Parsing During System Boot
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints