awesome-uefi-security
đź‘“A collection of papers/tools/exploits for UEFI security.
https://github.com/river-li/awesome-uefi-security
Last synced: 22 days ago
JSON representation
Blogs :newspaper:
- Binarly-IO
- OpenSSL Usage In UEFI Firmware Exposes Weakness In SBOMs
- The Firmware Supply-Chain Security Is Broken: Can We Fix It?
- Leaked Intel Boot Guard Keys: What Happened? How Does It Affect The Software Supply Chain?
- New Attacks To Disable And Bypass Windows Management Instrumentation
- Binarly Discloses High-Impact Firmware Vulnerabilities In Insyde-Based Devices
- Binarly Discovers Multiple High-Severity Vulnerabilities In AMI-Based Devices
- Binarly Finds Six High Severity Firmware Vulnerabilities In HP Enterprise Devices
- The Intel PPAM Attack Story
- Blasting Event-Driven Cornucopia
- FirmwareBleed: The Industry Fails To Adopt Return Stack Buffer Mitigations In SMM
- FwHunt The Next Chapter: Firmware Threat Detection At Scale
- A Deeper UEFI Dive Into MoonBounce
- Repeatable Failures: AMI UsbRt - Six Years Later, Firmware Attack Vector Still Affect Millions Of Enterprise Devices
- Repeatable Firmware Security Failures: 16 High Impact Vulnerabilities Discovered In HP Devices
- An In-Depth Look At The 23 High-Impact Vulnerabilities
- Why Firmware Integrity Is Insufficient For Effective Threat Detection And Hunting
- Cr4sh
- Exploiting AMI Aptio firmware on example of Intel NUC
- Exploring and exploiting Lenovo firmware secrets
- Exploiting SMM callout vulnerabilities in Lenovo firmware
- Breaking UEFI security with software DMA attacks
- Building reliable SMM backdoor for UEFI based platforms
- Exploiting UEFI boot script table vulnerability
- eclypsium
- FIRMWARE ATTACKS: AN ENDPOINT TIMELINE
- ONE BOOTLOADER TO LOAD THEM ALL
- FIRMWARE SECURITY REALIZATIONS – PART 2 – START YOUR MANAGEMENT ENGINE
- FIRMWARE SECURITY REALIZATIONS – PART 1 – SECURE BOOT AND DBX
- YET ANOTHER UEFI BOOTKIT DISCOVERED: MEET COSMICSTRAND
- THE ILOBLEED IMPLANT: LIGHTS OUT MANAGEMENT LIKE YOU WOULDN’T BELIEVE
- “EVIL MAID” FIRMWARE ATTACKS USING USB DEBUG
- When “secure” isn’t secure at all: High‑impact UEFI vulnerabilities discovered in Lenovo consumer laptops
- Needles in a haystack: Picking unwanted UEFI components out of millions of samples
- A machine‑learning method to explore the UEFI landscape
- UEFI malware: How to exploit a false sense of security
- Bootkit Threat Evolution in 2011
- Moving From Common-Sense Knowledge About UEFI To Actually Dumping UEFI Firmware
- Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware
- Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware
- Adventures From UEFI Land: the Hunt For the S3 Boot Script
- Zen and the Art of SMM Bug Hunting | Finding, Mitigating and Detecting UEFI Vulnerabilities
- Another Brick in the Wall: Uncovering SMM Vulnerabilities in HP Firmware
- SYNACKTIV
- Code Check(Mate) in SMM
- Through The SMM-Glass And a Vulnerability Found There.
- A Journey in Reversing UEFI Lenovo Passwords Management
- S3 Sleep, Resume and Handling Them with Type-1 Hypervisor
- Introductory Study of IOMMU (VT-d) and Kernel DMA Protection on Intel Processors
- Debugging System with DCI and Windbg
- Reverse engineering (Absolute) UEFI modules for beginners
- Experiment in extracting runtime drivers on Windows
- BIOS Based Rootkits
- Understanding modern UEFI-based platform boot
- Using an Unimpressive Bug in EDK II to Do Some Fun Exploitation
- Multiple Vulnerabilities In Qualcomm And Lenovo ARM-Based Devices
- Detecting Firmware Vulnerabilities At Scale: Intel BSSA DFT Case Study
- Cr4sh
- Exploiting AMI Aptio firmware on example of Intel NUC
- Exploring and exploiting Lenovo firmware secrets
- Exploiting SMM callout vulnerabilities in Lenovo firmware
- Breaking UEFI security with software DMA attacks
- Building reliable SMM backdoor for UEFI based platforms
- Exploiting UEFI boot script table vulnerability
- BIOS Based Rootkits
- Multiple Vulnerabilities In Qualcomm And Lenovo ARM-Based Devices
- OpenSSL Usage In UEFI Firmware Exposes Weakness In SBOMs
- The Firmware Supply-Chain Security Is Broken: Can We Fix It?
- Leaked Intel Boot Guard Keys: What Happened? How Does It Affect The Software Supply Chain?
- New Attacks To Disable And Bypass Windows Management Instrumentation
- Binarly Discloses High-Impact Firmware Vulnerabilities In Insyde-Based Devices
- Binarly Discovers Multiple High-Severity Vulnerabilities In AMI-Based Devices
- Binarly Finds Six High Severity Firmware Vulnerabilities In HP Enterprise Devices
- The Intel PPAM Attack Story
- Blasting Event-Driven Cornucopia
- FirmwareBleed: The Industry Fails To Adopt Return Stack Buffer Mitigations In SMM
- A Deeper UEFI Dive Into MoonBounce
- Repeatable Failures: AMI UsbRt - Six Years Later, Firmware Attack Vector Still Affect Millions Of Enterprise Devices
- Repeatable Firmware Security Failures: 16 High Impact Vulnerabilities Discovered In HP Devices
- Detecting Firmware Vulnerabilities At Scale: Intel BSSA DFT Case Study
- Why Firmware Integrity Is Insufficient For Effective Threat Detection And Hunting
- Firmware Supply Chain Is Hard(Coded)
- Attacking (Pre)EFI Ecosystem
- eclypsium
- SYNACKTIV
Bootkits :bomb:
CTF-Challenges
Development :computer:
Documentations :book:
- UEFI Forum
- UEFI Specification v2.10
- UEFI Platform Initialization Specification v1.7a
- UEFI Shell Specification V2.2
- UEFI Platform Initialization Distribution Packaging Specification v1.1
- ACPI Specification v6.5
- UEFI Platform Initialization Distribution Packaging Specification v1.1
- UEFI Shell Specification V2.2
- UEFI Shell Specification V2.2
- UEFI Platform Initialization Distribution Packaging Specification v1.1
Papers :page_with_curl:
- RSFUZZER: Discovering Deep SMI Handler Vulnerabilities in UEFI Firmware with Hybrid Fuzzing
- A Survey on the Evolution of Bootkits Attack and Defense Techniques
- Symbolic execution for BIOS security
- Bootkits: Past, Present & Future
- Attacking Intel TXT® via SINIT code execution hijacking
- Speed Racer: Exploiting an Intel Flash Protection Race Condition
- SoK: Security Below the OS – A Security Analysis of UEFI
- UEFI Vulnerability Signature Generation using Static and Symbolic Analysis
- UEFI Memory Forensics: A Framework for UEFI Threat Analysis
- FUZZUER: Enabling Fuzzing of UEFI Interfaces on EDK-2
- STASE: Static Analysis Guided Symbolic Execution for UEFI Vulnerability Signature Generation
- A Survey on the Evolution of Bootkits Attack and Defense Techniques
- Hidden in Plain Sight - Persistent Alternative Mass Storage Data Streams as a Means for Data Hiding With the Help of UEFI NVRAM and Implications for IT Forensics
- Thunderstrike:EFI firmware bootkits for Apple MacBooks
- SoK: Security Below the OS – A Security Analysis of UEFI
- Finding SMM Privilege-Escalation Vulnerabilities in UEFI Firmware with Protocol-Centric Static Analysis
- UEFI Firmware Fuzzing with Simics Virtual Platform
Talks :speaker:
- The Various Shades of Supply Chain: SBOM, N-Days and Zero Trust
- The Evolution of Threat Actors: Firmware is the Next Frontier
- Breaking Firmware Trust From Pre-EFI: Exploiting Early Boot Phases
- The Firmware Supply-Chain Security Is Broken: Can We Fix It?
- Safeguarding UEFI Ecosystem: Firmware Supply Chain is Hard(coded)
- Breaking Secure Bootloaders
- efiXplorer: Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis
- Firmware Cartography: Charting the Course for Modern Server Compromise
- MODERN SECURE BOOT ATTACKS: Presenter’s Name Presenter's Position BYPASSING HARDWARE ROOT OF TRUST FROM SOFTWARE
- Finally, I Can Sleep Tonight: Catching Sleep Mode Vulnerabilities of the TPM with Napper
- Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
- Remotely Attacking System Firmware
- Malware Buried Deep Down the SPI Flash: Sednit's First UEFI Rootkit Found in the Wild
- I Don't Want to Sleep Subverting Intel TXT with S3 Sleep
- INTEL AMT. STEALTH BREAKTHROUGH
- Firmware is the New Black - Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities
- Betraying the BIOS: Where the Guardians of the BIOS are Failing
- Taking DMA Attacks to the Next Level
- The UEFI Firmware Rootkits: Myths and Reality
- Fractured Backbone: Breaking Modern OS Defenses with Firmware Attacks
- Analyzing UEFI BIOSes from Attacker & Defender Viewpoints
- Extreme Privilege Escalation on Windows 8/UEFI Systems
- Protecting Data In-Use from Firmware and Physical Attacks
- Exposing Bootkits with BIOS Emulation
- A Tale of One Software Bypass of Windows 8 Secure Boot
- BIOS Chronamancy: Fixing the Core Root of Trust for Measurement
- Funderbolt Adventures in Thunderbolt DMA Attacks
- Battery Firmware Hacking
- Attacking Intel® BIOS
- Reversing and Exploiting an Apple Firmware Update
- Attacking Intel® Trusted Execution Technology
- Introducing Ring -3 Rootkits
- Preventing and Detecting Xen Hypervisor Subversions
- TPM Genie Attacking the Hardware Root of Trust For Less Than $50
- Attacks on UEFI Security
- ALL YOUR BOOT ARE BELONG TO US
- Getting into the SMRAM: SMM Reloaded
- The COW Container On Windows Who Escaped the Silo
- One Bootloader to Load Them All
- High Stakes Updates: BIOS RCE OMG WTF BBQ
- UEFI Exploitation for the Masses
- Ring 0 Ring 2 Rootkits Bypassing Defenses
- EDR is Coming Hide Yo Sh!t
- Safeguarding rootkits: IntelBootGuard
- Disabling Intel ME in Firmware
- Extreme Privilege Escalation On Windows 8/UEFI Systems
- Hacking Measured Boot and UEFI
- OuterHaven UEFI Memory Space
- Bypassing pre-boot authentication passwords by instrumenting the BIOS keyboard buffer(pratical low level attacks against x86 authentication software)
- Hacking the Extensible Firmware Interface
- Data-only Attacks Against UEFI BIOS
- UEFI Firmware Vulnerabilities: Past, Present and Future
- BARing the System New vulnerabilities in Coreboot & UEFI based systems
- LogoFAIL: Security implications of image parsing during system boot