Infecting the Boot to Own the Kernel
Demonstrates how boot-level vulnerabilities and flawed UEFI implementations bypass Secure Boot to execute persistent kernel-level bootkits.
Summary
The Critical Role of Secure Boot
UEFI Secure Boot is designed to establish a cryptographic chain of trust from the hardware bootloader through the operating system kernel, blocking unsigned code execution.
Exploiting Vulnerabilities in UEFI Bootloaders
Alejandro Vazquez and Maria San Jose analyze implementation flaws in third-party signed UEFI binaries and bootloader components that allow attackers to bypass signature validation.
Installing Persistent Ring-0 Bootkits
Manipulating boot configuration parameters and exploiting memory corruption flaws during early boot allows attackers to patch kernel memory, disable Driver Signature Enforcement, and achieve persistent ring-0 execution.
Defensive Architecture and Firmware Revocation
Mitigating bootkits requires maintaining updated Secure Boot Forbidden Signature Databases (DBX), deploying Hardware Root of Trust, and enforcing firmware integrity monitoring.
Related talks
Main Stage·52 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.
Main Stage·49 min
Jesse Michael
Demonstrates persistent firmware-level implants that survive OS reinstalls by exploiting UEFI driver loading and Secure Boot bypass vulnerabilities.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.