The UEFI Threat Or How I Can Permanently Brick Your Computer

Paul Asadoorian opens by pointing out that most people never update or customize the UEFI firmware on their computers, even though it sits at the highest privilege level and loads before the operating system. He explains how that firmware lives on an SPI flash chip split into regions, such as the flash descriptor, the BIOS region, Intel ME, and embedded controller data, and how access controls on each region decide what can be rewritten.

The middle of the talk covers research from Eclipsium's firmware database and live system scans. Using open tools such as Chipsec, the team found widespread missing write protections, a frequent buffer overflow problem in firmware, and many machines lacking microcode, DBX revocation, and BMC updates. Vendor mistakes, such as a leftover manufacturing mode and a disabled secure boot check, show how the supply chain between chip makers and OEMs adds risk. The speaker also explains how overwriting the flash descriptor or NVRAM variables could leave a system unbootable.

For takeaways, he urges people to apply firmware updates, run firmware security checks on Linux through fwupd, and keep DBX revocation lists current. He also calls for a community repository of firmware dumps to help spot bad updates before they spread, and notes that TPM measurement cannot catch problems that happen before it starts.