What happens when you analyze over 100k firmware images? Firmware that lives inside your PCs, servers, and laptops often flies beneath the radar of IT and security teams. Looking at just one type of firmware on your computer, UEFI (the replacement for BIOS), offers a wide range of attack surfaces. I was curious about the available protections for UEFI, and specifically the SPI flash it is stored on. In this presentation, you’ll learn what’s stored here, how it’s often not protected correctly, and how to protect it. We will not just theorize, data for this presentation is backed by the analysis of thousands of UEFI firmware images. Inside this data, we will be able to determine the most common misconfigurations. Some may say that the manufacturer should provide properly configured firmware, and this presentation will prove this does not happen as often as it should. The solutions are complex, as your computer is made up of hardware and software from multiple manufacturers participating in an even more confusing supply chain.