Intel ATR releases UEFI firmware training materials!

Good news: the Intel Advanced Threat Research (ATR) team has release some of their UEFI security training materials!

This repository contains materials for a hands-on training ‘Security of BIOS/UEFI System Firmware from Attacker and Defender Perspectives’. A variety of attacks targeting system firmware have been discussed publicly, drawing attention to the pre-boot and firmware components of the platform such as BIOS and SMM, OS loaders and secure booting. This training will detail and organize objectives, attack vectors, vulnerabilities and exploits against various types of system firmware such as legacy BIOS, SMI handlers and UEFI based firmware, mitigations as well as tools and methods available to analyze security of such firmware components. It will also detail protections available in hardware and in firmware such as Secure Boot implemented by modern operating systems against bootkits. The training includes theoretical material describing a structured approach to system firmware security analysis and mitigations as well as many hands-on exercises to test system firmware for vulnerabilities. After the training you should have basic understanding of platform hardware components and various types of system firmware, security objectives and attacks against system firmware, mitigations available in hardware and firmware. You should be able to apply this knowledge in practice to identify vulnerabilities in BIOS and perform forensic analysis of the firmware.

0 Introduction to Firmware Security
1 BIOS and UEFI Firmware Fundamentals
2 Bootkits and UEFI Secure Boot
3 Hands-On Platform Hardware and Firmware
4 System Firmware Attack Vectors
5 Hands-On EFI Environment
6 Mitigations
7 System Firmware Forensics
N Miscellaneous Materials



CHIPSEC 1.3.0 released

New/updated modules:
* tools.uefi.whitelist – The module can generate a list of EFI executables from (U)EFI firmware file or extracted from flash ROM, and then later check firmware image in flash ROM or file against this list of [expected/whitelisted] executables
* tools.uefi.blacklist – Improved search of blacklisted EFI binaries, added exclusion rules, enhanced blacklist.json config file
* tools.smm.rogue_mmio_bar – Experimental module that may help checking SMM firmware for MMIO BAR hijacking vulnerabilities described in “BARing the System: New vulnerabilities in Coreboot & UEFI based systems” (http://www.intelsecurity.com/advanced-threat-research/content/data/REConBrussels2017_BARing_the_system.pdf) by Intel Advanced Threat Research team at RECon Brussels 2017
* tools.uefi.uefivar_fuzz – The module is fuzzing UEFI Variable interface. The module is using UEFI SetVariable interface to write new UEFI variables to SPI flash NVRAM with randomized name/attributes/GUID/data/size.

New/updated functionality:
* Debian packaging support
* Compiling in setup.py and automated loading of chipsec.kext kernel module on macOS
* Internal Graphics Device support including software DMA via Graphics Aperture
* Improved parsing andsearch within UEFI images including update capsules
* Export of extracted EFI firmware tree in JSON format
* Export of CHIPSEC results in JSON format via –json command-line argument
* EFI (de-)compression ported from uefi-firmware-parser project
* Decompression to macOS helper to parse Mac EFI firmware images
* Support of command-line arguments in chipsec_util.py
* SMI count command
* Improved platform dependent Flash descriptor parsing
* ReadWriteEverything helper to work with RWE driver
* map_io_space to improve SPI read performance on Linux
* Native (OS based) access PCI, port I/O and CPU MSR to Linux helper
* Improved chipsec_util.py unit testing

See full announcement for list of bugfixes.




Slides for coreboot/UEFI talk from REcon available





Alex leaves Intel ATR!

Wow, Alex Matrosov is leaving Intel Advanced Threat Research (ATR).

As I understand it, he is one of the CHIPSEC team. I hope the project can handle his loss.

It is unclear what he’ll be doing next. Maybe he’ll be joining Apple?  They are hiring all the great researchers…)



CHIPSEC 1.2.3 released!

Excerpt of CHIPSEC 1.2.3 release notes:

New/updated modules:
* tools.vmm.vbox_crash_apicbase — test for CVE-2015-0377
* udated common.bios_ts, common.uefi.s3bootscript, remap
* added template config file smm_config.ini for tools.smm.smm_ptr SMI fuzzer
* added template config file te.cfg for tools.secureboot.te tool

New/improved functionality:
* Added basic TPM access and TPM 1.2 support
        hal/tpm.py and hal/tpm12_commands.py HAL components
* Added basic Embedded Controller (EC) support
        hal/ec.py HAL component and chipsec_util ec util
* Added processing of x86 paging hierarchy
        hal/paging.py and hal/cpu.py HAL components and chipsec_util cpu pt util
* Added processing of Second Level Address Translation paging hierarchy (EPT)
        hal/vmm.py HAL component and chipsec_util vmm pt util
* Added processing of IOMMU (VT-d) paging hierarchy
        hal/iommu.py HAL component and chipsec_util iommu pt util
* Basic support for hypervisor hypercall interfaces
        hal/vmm.py HAL component and chipsec_util vmm hypercall util
* Added message bus interface for Atom SoC (Linux)
        hal/msgbus.py HAL component and chipsec_util msgbus util
* CPUID functionality moved from hal/cpuid.py to hal/cpu.py HAL component
        Use chipsec_util cpu cpuid util
* Added parsing of RAW images in UEFI firmware volumes
* Updated smbus and SPD HAL components to use XML config
* Added qrk.xml configuration file for Quark CPUs, updated configuration for Haswell Server (hsx.xml)
* Fixed location of MMCFG in server platforms. Results from prior versions may need to be recollected on server platforms.

See full release notes for list of bugfixes.



DarkReading article on firmware protection

Yuriy and John of the Intel CHIPSEC team are quoted in a new Dark Reading article on firmware security.

[…] Yuriy Bulygin and John Loucaides, security researchers at Intel Security, point out that hackers attack firmware because they know many security and IT managers aren’t paying attention to it. They say security teams are so overwhelmed by the prevailing threat landscape, that they have their hands full just deploying the basics, like firewalls, intrusion prevention systems and sandboxes. […]