https://github.com/ufrisk/pcileech

Gavin Xue has created UefiTool:

A simple UEFI tool for debugging.

Print (L”Help info:\n”);
Print (L” UefiTool.efi -H\n\n”);
Print (L”Read MSR register:\n”);
Print (L” UefiTool.efi RDMSR [MSRIndex] [OPTION: -A | -P]\n\n”);
Print (L”Write MSR register:\n”);
Print (L” UefiTool.efi WRMSR [MSRIndex] [MSRValue]\n\n”);
Print (L”Read CPUID:\n”);
Print (L” UefiTool.efi CPUID [CPUID_Index] [CPUID_SubIndex]\n\n”);
Print (L”Read GDTR resister:\n”);
Print (L” UefiTool.efi -SGDT\n\n”);
Print (L”Read CR resister:\n”);
Print (L” UefiTool.efi -CR\n\n”);

https://github.com/vinxue/UefiTool

Not to be confused with UEFITool:

https://github.com/LongSoft/UEFITool

https://arxiv.org/abs/1903.01843

http://nebelwelt.net/blog/20190306-SMoTherSpectre.html

https://github.com/HexHive/SMoTherSpectre

Phoronix has a new article with some stats on Spectre/Meltdown mitigation performance impact on Linux 5.0, using their test suite:

[…]Of 57 benchmarks tested on these three systems with the Linux 5.0 kernel, the Core i9 7980XE performance was down by about 13% based upon the geometric mean of all the test results. The Intel Core i7 8086K performance was down by 17% with these out-of-the-box protections for Spectre and Meltdown. The AMD Ryzen 7 2700X performance with its default Spectre mitigations was lower by just 3%. Should you choose to go against the security assessment and wish to recover from these performance losses, reverting the mitigations as tested can easily be done by some boot parameters albeit no single switch. Now with Microsoft shipping Retpolines for revising their Spectre V2 mitigation, some additional Spectre/Meltdown tests will be coming up soon on Phoronix.

https://www.phoronix.com/scan.php?page=article&item=linux50-spectre-meltdown&num=1

https://www.phoronix-test-suite.com/

https://twitter.com/hughsient/status/1102610276577431553

It looks like the Linux firmware update service is about to get some new tools that’ll help enterprise sysadmins!

[…]We’ve started working on some functionality in fwupd to install an optional “agent” that reports the versions of firmware installed to a central internal web service daily, so that the site admin can see what computers are not up-to-date with the latest firmware updates. I’d expect there the admin could also approve updates after in-house QA testing, and also rate-limit the flow of updates to hardware of the same type. The reference web app would visually look like some kind of dashboard, although I’d be happy to also plug this information into existing system management systems like Lenovo XClarity or even Red Hat Satellite. The deliverable here would be to provide the information and the mechanism that can be used to implement whatever policy the management console defines.[…]

https://blog.mehl.mx/2019/protect-freedom-on-radio-devices-raise-your-voice-today/

https://eclypsium.com/2019/03/04/announcing-general-availability-of-eclypsium-platform-1-0/

VeraCrypt has been updated, with multiple UEFI fixes and a few security features:

* Erase system encryption keys from memory during shutdown/reboot to help mitigate some cold boot attacks
* Add option when system encryption is used to erase all encryption keys from memory when a new device is connected to the system.
* Several enhancements and fixes for EFI bootloader:
* Implement timeout mechanism for password input. Set default timeout value to 3 minutes and default timeout action to “shutdown”.
* Implement new actions “shutdown” and “reboot” for EFI DcsProp config file.
* MBR Bootloader: dynamically determine boot loader memory segment instead of hardcoded values (proposed by neos6464)
* MBR Bootloader: workaround for issue affecting creation of hidden OS on some SSD drives.
* Fix issue related to Windows Update breaking VeraCrypt UEFI bootloader.

https://www.veracrypt.fr/en/Release%20Notes.html

Exploitation from malicious PCI Express peripherals
Colin L. Rothwell
February 2019, 108 pages

The thesis of this dissertation is that, despite widespread belief in the security community, systems are still vulnerable to attacks from malicious peripherals delivered over the PCI Express (PCIe) protocol. Malicious peripherals can be plugged directly into internal PCIe slots, or connected via an external Thunderbolt connection.[…]

https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-934.html

This appears more than just adding a new compiler to the default EDK2 Build command, and different from Alex’s VisualUEFI. Windows-centric.

Allow building official TianoCore EDK2 with Visual Studio 2017

https://github.com/dung11112003/VisualEDK2