Presented at
Black Hat USA 2021,
Aug. 4, 2021, 11:20 a.m.
(40 minutes).
The UEFI ecosystem is very complicated in terms of supply chain security where we have multiple parties involved in the firmware code development like Intel/AMD with its reference code, or AMI, Phoenix and Insyde with its core frameworks for system firmware development. The hardware platform vendor contributes less than 10% to the UEFI system firmware code base from all the code shipped to the customers. The reality is vulnerabilities can be discovered not just in the platform vendor codebase, but inside the reference code. This impact can be worse reflecting on the whole ecosystem. The patch cycles are different across vendors and these vulnerabilities can stay unpatched to endpoints for 6-9 months. Moreover, they can be patched differently between vendors making fix verification difficult and expensive.
This research resulted from an internal security review for some of the NVIDIA hardware and few edge computing platforms provided by partners. We found several issues. Some issues related to Intel EDKII (reported to Intel in September 2020). Additional issues for legacy protocols like SmiFlash, which is sometimes still available even on relatively new hardware. These are subject to attacker influence through NVRAM or SPI flash, allowing attackers to gain persistence. One issue particularly exciting to us due to its sustainable path of exploitation and impact of arbitrary code execution in the PEI phase. Our researchers developed a PoC where arbitrary code execution on PEI phase transfers a payload to SMM and survives the DXE phase. This powerful exploit path can be used to install a persistent implant in the system firmware compromising all Secure Boots.
Presenters:
-
Alexander Tereshkin
- Principal Offensive Security Researcher, Nvidia
Alex Tereshkin is an experienced reverse engineer and an expert in UEFI security, Windows kernel and hardware virtualization, specializing in rootkit technologies and kernel exploitation. He has been involved in the BIOS and SMM security research since 2008. He is currently working as a Principal Offensive Security Researcher at NVIDIA. He has done significant work in the field of virtualization-based malware and Windows kernel security. He is a co-author of a few courses taught at major security conferences and a co-author of the first UEFI BIOS and Intel ME exploits. Alex holds a master's degree in Applied Mathematics and a PhD degree in Information Security from Southern Federal University in Russia.
-
Alexander Matrosov
- Chief Offensive Security Researcher, Nvidia
Alex Matrosov is a well-recognized offensive security researcher. He has more than two decades of experience with reverse engineering, advanced malware analysis, firmware security, and exploitation techniques. Alex served as Chief Offensive Security Researcher at Nvidia, Intel Security Center of Excellence (SeCoE), spent more than six years in the Intel Advanced Threat Research team, and was Senior Security Researcher at ESET. Alex has authored and co-authored numerous research papers and is a frequent speaker at security conferences, including REcon, Zeronigths, Black Hat, DEF CON, and others. Additionally, he was awarded by Hex-Rays for open-source plugin efiXplorer and HexRaysCodeXplorer which has been developed and supported since 2013 by REhint's team.
-
Adam Zabrocki / pi3
- Principal Offensive Security Researcher, Nvidia
as Adam Zabrocki
Adam Zabrocki is a computer security researcher, pentester and bughunter, currently working as a Principal Offensive Security Researcher at NVIDIA. He is a creator and a developer of Linux Kernel Runtime Guard (LKRG) - his moonlight project defended by Openwall. Among others, he used to work in Microsoft, European Organization for Nuclear Research (CERN), HISPASEC Sistemas (known from the virustotal.com project), and Wroclaw Center for Networking and Supercomputing, Cigital. The main area of his research interest is a low-level security (CPU architecture, uCode, FW, hypervisor, kernel, OS). As a hobby, he was a developer in The ERESI Reverse Engineering Software Interface project, a bughunter (discovered vulnerabilities in Hyper-V hypervisor, Intel/NVIDIA vGPU, Linux kernel, OpenSSH, gcc SSP/ProPolice, Apache, Adobe Acrobat Reader, Xpdf, Torque GRID server, FreeBSD, and more) and studied exploitation and mitigation techniques, publishing results of his research in Phrack Magazine.
Links:
Similar Presentations: