Noise Security Bit

нерегулярный подкаст о жизни ресечеров по обе стороны океана

[Noise Security Bit @N0iSeBit]

Новый эпизод #NoiSeBit в эфире! https://t.co/x8xRPnmFAh

[BINARLY🔬 @binarly_io]

📺Our REsearch: "A Dark Side of UEFI: Cross-Silicon Exploitation" recording is available!

🎙️@matrosov and @flothrone at #OffensiveCon23 stage talking about the new ARM and TrustZone attacks exposed from recent UEFI adoption.

https://t.co/Ti7DOhYkUH

[BINARLY🔬 @binarly_io]

⛓️The widespread use of UEFI on ARM devices notably expands the attack surfaces within TrustZone and beyond, raising security concerns

💥REsearch: "A Dark Side of UEFI: Cross-Silicon Exploitation" presented the new ARM attacks at @offensive_con

🔬Slides: https://t.co/c7MR1YmSSa

[J. A. Guerrero-Saade @juanandres_gs]

The LABScon CFP is upon us and it’s already got some amazing submissions. Got cool, new, never-before-seen research? We’d love to have you with us!

[Alex Matrosov @matrosov]

Supply Chain security is not only about detecting known threats. It's about eliminating the blind spots and gaining more transparency and explainability. Some companies attempt to adapt their traditional methods to fit into newer paradigms, which proves ineffective in practice.

[BINARLY🔬 @binarly_io]

🔥At @offensive_con, we showcased three different attack scenarios on ARM UEFI and beyond:

1️⃣CWE-125: OOB (memory leak) with GetVariable/SetVariable pattern.

2️⃣BRLY-2022-033: GetVariable Stack overflow (UsbConfigDxe).

3️⃣LPE to SMM from DXE by design.

https://t.co/9F0P3uPhN3

[Nemesis | Adversarial Exposure Validation @Persistent_Psi]

During @offensive_con our @marver presented his research on security aspects of embedded SIM cards.
We are releasing SMShell, an SMS based implant proof of concept for Red Teaming that can evade out of band.

Blogpost: https://t.co/3i4SieWUEm

GitHub: https://t.co/71QbSKwxYZ

[Alex Matrosov @matrosov]

UEFI ARM code contains a lot of blindspots with mitigation coverage. Not all functions are covered by canary checking (only functions with potentially unsafe calls to MemLib/PrintLib are protected).

But even partial coverage bumps FW security to the next level compared to x86.

[Ryan Naraine @ryanaraine]

Leak of MSI UEFI signing keys stokes fears of “doomsday” supply chain attack <- reporting by ⁦@dangoodin001⁩ https://t.co/MNlF8NrxrP

[Alex Matrosov @matrosov]

⛓️Design issues are the worst!

🔥Given the current revocation architecture, we are facing the serious challenges of accommodating over 2300+ bootmgr binaries within DBX Revocation List (limited space left in EFI Variable storage).

[hardwear.io @hardwear_io]

😎We are excited to Welcome Alex @matrosov @binarly_io for the📡CXO panel!

🧠Learn, network & collaborate with the #hardwaresecurity geniuses➡️https://t.co/gUZqsYR158

#hw_ioUSA2023 #Conference

[Alex Matrosov @matrosov]

Heading to the Qualcomm Product Security Summit and @Offensive_con this week

🔥A Dark Side of UEFI: Cross-Silicon Exploitation

@Binarly_io REsearch going to present new ways of exploiting Qualcomm Snapdragon 8 devices with UEFI-specific flavor. Stay tuned!

@flothrone @yeggorv

[offensivecon @offensive_con]

A Dark Side of UEFI: Cross-Silicon Exploitation by @matrosov and @flothrone now #OffensiveCon23

[BINARLY🔬 @binarly_io]

Binarly adventures at #RSAC2023🤟

https://t.co/xLkZGHuvZR

[Gal Diskin @gal_diskin]

Damn! That was one of the doomsday scenarios we always thought of at Intel. How did this happen?
haven't dived into the detail yet but will soon. I trust @matrosov

[Alex Matrosov @matrosov]

🎙️Join us tomorrow for the #BHASIA talk: "The Various Shades of Supply Chain: SBOM, N-Days, and Zero Trust." /cc @hughsient @immune_gmbh

⛓️We have some fascinating data insights regarding firmware supply chain security.

https://t.co/TRRAR8xFNh

[BINARLY🔬 @binarly_io]

💥HP: https://t.co/4pzZ8l1OaH
💥Lenovo: https://t.co/a7hGbireYD

🔥NVD CVSS score: 8.8 High (CWE-78)
https://t.co/vEzuYsow3U

[Alex Matrosov @matrosov]

🔥New finding! We have confirmed that previously leaked Intel BootGuard private keys from Lenovo/LCFC in September 2022 are still relevant for numerous devices in the field (Lenovo, Supermicro, Intel ...).

⛓️https://t.co/WfyIYgLBmD

🔬FwHunt: https://t.co/PHvxAdXzOL

[BINARLY🔬 @binarly_io]

⛓️Thank you @IntelSecurity for fixing the incomplete RSB stuffing SMM mitigation (#FirmwareBleed/CVE-2022-38087).

💥BRLY: https://t.co/PENSbKRzAW
💥Intel: https://t.co/1dsNMr7z3g
💥IBM:
https://t.co/5cMAMKMXQ4
💥Dell: https://t.co/tt2Wd8HDQV

🔬Details: https://t.co/XfzS1768Xu

[Dennis @DennisF]

Intel BootGuard, Firmware Signing Keys Found in MSI Data Leak https://t.co/YLFPu5yDJP #decipher #deciphersec

[The Register @TheRegister]

FYI: Intel BootGuard OEM private keys leak from MSI cyber-heist https://t.co/BTx4enx4Hc