UEFI exploitation for the masses

Presented at DEF CON 26 (2018), Aug. 10, 2018, 2 p.m. (45 minutes)

So how do you debug bios and triage a vulnerability for exploitability with no stack trace or error log? How do BIOS developers do it? Do not worry! We will explain how anyone can have debug capabilities on modern Intel platforms and show you how this massively simplifies exploit dev. Developing an exploit for a BIOS vulnerability is a different experience than other types of exploit dev. Your available code base to draw from is unlike what you would expect when running at the operating system level and you have no gdb you can use.

In this talk we will summarize BIOS exploitation techniques and dive deeper into the specifics of an exploit we developed to provide reliable arbitrary code execution for an"over-the-internet" bios update vulnerability we found and responsibly disclosed. We will explain the relevant parts of UEFI and talk more about the exploit mitigations that exist there. We will also explain how to explore System Management Mode (SMM) in an Intel based platform, utilizing Intel hardware debug capabilities on an Intel 8th gen platform to obtain SMRAM content, analyze its contents, and search for vulnerable code.

Presenters:

• Jesse Michael / @jessemichael - Hacker   as Jesse Michael
  Jesse Michael is an experienced security researcher focused on vulnerability detection and mitigation who has worked at all layers of modern computing environments from exploiting worldwide corporate network infrastructure down to hunting vulnerabilities inside processors at the hardware design level. His primary areas of expertise include reverse engineering embedded firmware and exploit development. He has also presented multiple times at DEF CON, PacSec, Hackito Ergo Sum, and BSides Portland. @JesseMichael
• Mickey Shkatov - Hacker
  Mickey Shkatov, a principal researcher at Eclypsium, has been performing security research and product security validation since 2010, He has also presented multiple times at DEF CON A and BlackHat, PacSec, CanSecWest, BruCon, Hackito Ergo Sum, and BSides Portland. @HackingThings

Links:

• https://defcon.org/html/defcon-26/dc-26-speakers.html#Shkatov
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Shkatov and Michael - UEFI Exploitation for the Masses.mp4
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Shkatov and Michael - UEFI Exploitation for the Masses.srt (subtitles)
• https://www.youtube.com/watch?v=CxqNgjMZAbk

Similar Presentations:

• VB2017 / Have you scanned your BIOS recently?
• 31C3 (2014) / Attacks on UEFI security, inspired by Darth Venamis's misery and Speed Racer
• DEF CON 22 (2014) / Extreme Privilege Escalation On Windows 8/UEFI Systems