High-Stakes Updates: BIOS RCE in Dell BiosConnect
Eclypsium researchers disclose critical vulnerabilities in Dell BiosConnect, demonstrating TLS certificate verification bypasses to execute RCE during UEFI updates.
Summary
Cloud-Connected UEFI Firmware Update Platforms
Modern enterprise PCs feature automated BIOS update mechanisms (such as Dell BiosConnect) that connect directly to vendor cloud servers over HTTPS to download firmware updates.
Discovering Flaws in UEFI TLS Stack Implementations
Mickey Shkatov and Jesse Michael audit the UEFI networking stack, discovering that BiosConnect accepts invalid and self-signed TLS certificates due to broken verification logic.
Executing Arbitrary Code Before OS Boot
By executing a machine-in-the-middle attack on the update traffic, an attacker injects malicious UEFI payloads that execute with Ring 0/SMM privileges, bypassing Secure Boot completely.
Coordinated Disclosure and Firmware Remediation
The researchers discuss coordinated fixes affecting 129 Dell models (over 30 million devices) and present firmware verification guidelines.
Related talks
Main Stage·52 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.
Main Stage·49 min
Jesse Michael
Demonstrates persistent firmware-level implants that survive OS reinstalls by exploiting UEFI driver loading and Secure Boot bypass vulnerabilities.
Main Stage·43 min
XlogicX · chap0
XlogicX and chap0 explores abuse of blind automation in security tools at DEF CON 22, examining uefi-security and practical defenses.