ESPecter: Showing the Future of UEFI Threats
summary
The talk explains UEFI bootloader compromise by the ESPecter bootkit and contrasts that approach with SPI flash implants like LoJax and MosaicRegressor. It describes why attackers target the bootloader for persistence and how to defend UEFI/bootloader-level threats.
AI-written summary · about
chapters (21)
- 0:00Intro
- 3:47Hacking Team Uses UEFI BIOS Rootkit
- 5:23LoJax SPI Flash writing decision tree
- 9:57Complexity of threat versus added benefit
- 13:17EFI System Partition (ESP)
- 15:30ESPecter persistence
- 16:13ESPecter overview
- 17:38Typical Windows boot flow
- 18:14Compromised Windows boot flow
- 18:55Disable Boot Manager's self integrity check
- 19:48Driver signature enforcement disable
- 20:29ESPecter espionage
- 24:31Verified & Measured Boot
- 27:26Our latest discovery - Lenovo UEFI Vulnerabilities
- 28:58UEFI firmware vulnerabilities
- 29:34Vulnerable bootloaders - bypassing Secure Boot
- 30:26The human element - SPI flash vs ESP implants
- 31:47The human element - ESP implants
- 32:33UEFI Bootkits-future of the UEFI threats?
- 35:53Defenders - ESP integrity monitoring
- 40:29Takeaways
related talks
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
42mUEFI Bootkits and Where UEFI Security Fails
01h 13mIs there an EFI monster inside your apple?
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
27mBreaking the Chain of Trust
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
27mProtecting Data In-Use from Firmware and Physical Attacks
22mBoot Requirements and Strategies for the Edge