John Loucaides

SVP of Strategy at Eclypsium. Device security. Researcher. Borg. Views expressed here are my own.

[John Loucaides @JohnLoucaides]

This one was instrumental for getting me interested in the space as well. Lots of stuff happened after this...

[Xeno Kovah @XenoKovah]

I'm trying to start a positive security trend of #ResearchRespect wherein we give shoutouts to researchers whose work we really respect and describe why. I'll go first (in no particular order) with "Attacking Intel BIOS" by Rafal Wojtczuk and @AlexTereshkin at BlackHat 2009

[Xeno Kovah @XenoKovah]

I'm trying to start a positive security trend of #ResearchRespect wherein we give shoutouts to researchers whose work we really respect and describe why. I'll go first (in no particular order) with "Attacking Intel BIOS" by Rafal Wojtczuk and @AlexTereshkin at BlackHat 2009

[Xeno Kovah @XenoKovah]

I’m glad this mentioned explicitly that it’s for the threat model of “Harvest Now, Decrypt Later”. Because until all the SecureBoot infrastructure is also post-quantum, the “attacker can sign arbitrary code for bootloader” attack assumption would still allow realtime coms capture

[Daniel Walsh @rhatdan]

Lots of noise about `CVE-2024-21626 runc container escape`. As long as you have SELinux enabled, the container processes are blocked from reading sensitive data and writing all data. Podman enables SELinux by default and defaults to rootless mode.

[Nikolaj Schlej @NikolajSchlej]

If any random UEFI vendor wants to learn something from #LogoFAIL other than demanding 300+ days of embargoe that then gets broken by the very same vendor, let it be "we need to invest in exploitation prevention and hardening, because securing 10M+ LOC of C and ASL is impossible"

[John Loucaides @JohnLoucaides]

@dragosr @ryanaraine Standardization of system firmware has made attack reuse easier. (To be fair it made patching easier too) There are complications, sure, but for attackers, I would argue that system firmware attacks are actuality easier than many common attacks on browsers, OS components, etc.

[John Loucaides @JohnLoucaides]

@dragosr @ryanaraine We have definitely completed coordinated disclosure with patch and publication in 90 days for uefi. It's possible. Depending on how much the dependencies cascade, that can become too aggressive.

In my experience, 180 days is usually enough for these. 300 seems excessive.

[Eclypsium @eclypsium]

We're excited to announce our collaboration w/@Intel to provide enhanced visibility into supply chains by integrating key supply chain & vulnerability insights from Intel’s Endpoint Cloud Services into Eclypsium's Infrastructure #SupplyChainSecurity suite! https://t.co/jLiyCOtsQk

[Security Weekly Podcast Network @SecWeekly]

.@JohnLoucaides, SVP Strategy at Eclypsium, joins us on the show to discuss protecting the federal supply chain! #vulnerability #DoDs #firmware
https://t.co/apsosAWoqz

[Jrod @Jr0dR87]

How does this make you feel?

[John Loucaides @JohnLoucaides]

I hope @vincentzimmer and friends are going to celebrate!

[UEFI Forum @UEFIForum]

A #UEFI Forum webinar presented by @Intel focused on the changes made to the #EDK2 version of the #Python interpreter that were necessary to run @CHIPSEC. The presenters provide an overview of the Chipsec framework and why it’s useful: https://t.co/X7oykUqSzN

[John Loucaides @JohnLoucaides]

Like BIOSdisconnect before it, this allows attack code to download and run from the unmodified, legitimate updater. With so many update apps doing different things, it's very hard to be sure what to trust. Are you more secure updating frequently or tightly controlling updates?

[John Loucaides @JohnLoucaides]

This malware appears to target dell machines and hide with the dell update app (command).

[The Hacker News @TheHackersNews]

🚨 Experts expose a year-long cyber operation targeting an East Asian IT firm, deploying custom #malware called RDStealer to compromise data and steal credentials.

Learn more: https://t.co/PJg0IUupxi

#cyberattack #hacking #cybersecurity #infosec

[John Loucaides @JohnLoucaides]

@eclypsium (and many others) has published about a lot of attacks targeting update apps. The recent issue with gigabyte is a different variation, though. This update app is installed by firmware and fails to secure what it downloads and runs.

[Xeno Kovah @XenoKovah]

I talked with @securityweekly recently about firmware security and #OST2. Thankfully Paul asked questions about how OST2 helps teach fwsec, when I went off into the weeds on fwsec, since it's something I like talking about
https://t.co/TcVjz9pf9f

[Jerry Bryant @jerry_Intel]

@JohnLoucaides @guido_bertoni @KirkBrannock @securityweekly @eclypsium Good reference to learn more about Intel debug technology: https://t.co/kAIzGkLxo2

[John Loucaides @JohnLoucaides]

@guido_bertoni @jerry_Intel @KirkBrannock @securityweekly @eclypsium Reading tianocore and coreboot code also help, but not for everyone... ;-)

[John Loucaides @JohnLoucaides]

This is an extremely important fact relative to the recent breach and leak at MSI.

[Jerry Bryant @jerry_Intel]

To be clear, Intel Boot Guard signing keys are generated/managed by each OEM independently.

[John Loucaides @JohnLoucaides]

@guido_bertoni Yeah. This is hard to piece together. This paper is a good start: https://t.co/GoKRsKPnHr

@jerry_Intel or @KirkBrannock may have other ideas.

@securityweekly has some episodes on it and @eclypsium will be publishing more about it too.