Breaking Secure Bootloaders
Christopher Wade details actionable exploitation techniques to bypass signature verification in modern Android and embedded bootloaders, deploying unsigned firmware.
Summary
The Architecture of Secure Boot Verification
Secure boot chains rely on cryptographic signature verification inside primary bootloaders to ensure embedded hardware only executes authenticated operating system images.
Auditing Fastboot and OEM Bootloader Implementations
Christopher Wade investigates parsing routines, USB descriptor handlers, and memory layout constraints within commercial smartphone bootloaders.
Exploiting Parser Vulnerabilities to Deploy Unsigned Code
Wade reveals memory corruption and logic bugs that allow an attacker to bypass signature validation and flash custom, unsigned kernels onto locked devices.
Hardening Bootloader Verification Pipelines
The author outlines defensive firmware programming practices, hardware root of trust implementations, and bootloader fuzzing techniques.
Related talks
Main Stage·52 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.
Main Stage·37 min
Christopher Wade
Christopher Wade details physical hardware attacks on Android smartphones, exploiting custom Recovery modes and Secondary Bootloader USB flaws for root code execution.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.