Alexander Ermolov

Security researcher, team lead & speaker. Low-level design, firmware and system software. Fuzzing & testing automation for CI/CD pipelines.

[Nikolaj Schlej @NikolajSchlej]

Wrote a blog post (in Russian) about the current state of BootGuard and adjacent vendor continuations of it, typical configuration errors and how they look from UEFITool NE GUI.
Will write an English version later and put it on https://t.co/7tSLk0m3dE.
https://t.co/OVRiw4nmRS

[domas @xoreaxeaxeax]

New exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

https://t.co/sgAfneFSsf

[ESET Research @ESETresearch]

#ESETresearch discovered and reported to @certcc 11 old Microsoft-signed UEFI shim bootloaders that allow bypassing UEFI Secure Boot on most UEFI systems. Read about it at https://t.co/S9GawER5S6 @smolar_m 1/5

[BINARLY🔬 @binarly_io]

🚨 We broke U-Boot's FIT Signature Verification.

The Binarly REsearch team uncovered 6 previously unknown vulnerabilities affecting one of the world's most widely used bootloaders—including two that can potentially lead to arbitrary code execution while parsing an untrusted boot image.

Technical deep dive:

https://t.co/HxegWhvs8p

#FirmwareSecurity #UBoot #EmbeddedSystems #CyberSecurity

[Paolo Stagno (VoidSec) @Void_Sec]

Bug count != exploitable bug. Finding != chaining.
LLMs are exceptional at pattern recognition on known bug classes. They are not reasoning about novel failure modes in complex multi-component systems.
The hard bugs still require humans. https://t.co/RISinVDT3d

[FuzzingLabs @FuzzingLabs]

New blog post: exploring NVIDIA’s open-source GPU drivers.

Kernel modules, IOCTL attack surface, mmap primitives, UVM internals, and CPU↔GPU interactions (pushbuffers → firmware).

Not just graphics: a large, exposed kernel surface.

https://t.co/2LO5vVXdM0

[Nikolaj Schlej @NikolajSchlej]

Don't want to cry wolf just yet, but this magenta-boxed part of LOTS of Insyde H2O-based UEFI FWs is highly suspicious, even if they are currently empty.

Neither BootGuard nor FlashDeviceMap covers those volumes, and presence of PEI deps section suggests they are processed.

[Mark Ermolov @_markel___]

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

[BINARLY🔬 @binarly_io]

Slides and demos for our @REverseConf talk by @francesco_ev and @xorpse are up! If you missed the conference, now's you're opportunity to take a look at the talk content and demos.

Slides & demos: https://t.co/B97vstMQEZ
VulHunt framework: https://t.co/L6vwhyR9kH

[Rodrigo Branco @bsdaemon]

Vulhunt is now open-source, this is a game changer: https://t.co/kTLFiaktkV @binarly_io @vulhuntdev

[Sam Thomas @xorpse]

We @binarly_io just open-sourced our VulHunt framework at @REverseConf!

GitHub: https://t.co/G7bRkP81Gu
Documentation: https://t.co/LSNxpHXGNj
Slack: https://t.co/RMFggNV9sM

https://t.co/recuxjHJZh

[Sam Thomas @xorpse]

I'm pleased to announce a new release of the Rust bindings for @HexRaysSA IDA SDK! This release includes v9.3 compatibility.
Code: https://t.co/4wnfZvRXIH
Docs: https://t.co/nrIyNLv0Kg
Thank you to @yeggorv who contributed to this release, and to @HexRaysSA for their support.

[Nikolaj Schlej @NikolajSchlej]

Published my OFFZONE 2025 presentation slides (in Russian) on GitHub: https://t.co/xoPNdCgKv8

Had a great time at the conf, kudos to https://t.co/JH7qp0fcCW and other sponsors and crew members for organizing and running it.

[Yongdae Kim ([email protected]) @yongdaek]

🔍 Full paper:
📄 https://t.co/DqAeEiBzhr
💻 https://t.co/wvliSHIDvx (coming soon)
📢 USENIX Security 2025
Authors: @hdtuanss , @ohtaekk_ , @cheoljun_p, @insu_yun , @yongdaek
#LLFuzz #BasebandSecurity #Fuzzing #CyberSecurity #USENIXSecurity

[ZeroNights @ZeroNights]

ZeroNights CFP is open 🔥

Long time no see. ZN will take place on Nov 26, 2025 https://t.co/eU1fKt0H0V

The program committee is accepting talks in Offensive and SecOps tracks, rewarding exclusive in-person presentations

Submit https://t.co/jsjBKJ1wJI
@cfptime

[Nikolaj Schlej @NikolajSchlej]

Published the third part of my blog series about Hydroph0bia (CVE-2025-4275) vulnerability, this one is about the fix as Insyde applied it, and my thoughts on improvements for it.
https://t.co/vEIkUNH3Ey

[Nikolaj Schlej @NikolajSchlej]

Preliminary analysis shows that Insyde fixed Hydroph0bia (CVE-2025-4275) by forcefully removing the NVRAM vars that lead to exploitation during SecureFlashDxe driver startup, and setting a restrictive variable policy for them, so such vars can't be set from the OS anymore.

[Nikolaj Schlej @NikolajSchlej]

Published, go check it out, it is a fun ride indeed:
https://t.co/nkk0WkIzFt

Part 3 will be done when I see how Insyde fixed the vulnerability and if we could do something about that fix.

[BINARLY🔬 @binarly_io]

🚨Binarly is documenting the discovery of CVE-2025-3052, a memory-corruption flaw in a Microsoft-signed UEFI module that lets attackers bypass Secure Boot and run unsigned code before the OS starts.

🔗 Full details: https://t.co/mFUeMjEhhr
🛡️ Advisory: https://t.co/dMpzoYgyIr

[Nikolaj Schlej @NikolajSchlej]

The embargo (12:00 UTC 2025-06-10) is over, let's start a thread on Hydroph0bia (CVE-2025-4275), a trivial SecureBoot and FW updater signature bypass in almost any Insyde H2O-based UEFI firmware used since 2012 and still in use today.

English writeup: https://t.co/DYLj3oBDkg