Breaking Firmware for Fun and Profit… and Security

Firmware has become more popular in the world of computer security research. Attacks operating at the firmware level can be difficult to discover and have the potential to persist across platform recovery. Fortunately, there are methods for detecting and defending against such attacks, which Intel shares through open source projects and advanced training.

Intel Software has a team dedicated to understanding firmware exploits and their mitigations. Platform Armoring and Resiliency (PAR) is an integral part of the group that develops CHIPSECTianoCore, and other critical UEFI components. PAR engineers recently presented primers on firmware security at the Spring 2018 UEFI Plugfest in Seattle. By actively studying firmware-based attacks, and working directly with top security researchers, PAR helps Intel bring more secure platforms to market.

Maggie Jauregui (PAR, Intel Software). Spring 2018 UEFI Plugfest.
Maggie Jauregui (PAR, Intel Software). Spring 2018 UEFI Plugfest.

 

Intel and Eclypsium are offering “System Firmware Attack and Defense for the Enterprise” training at Black Hat 2018. This training presents a structured approach to system firmware security analysis and mitigations through lecture and hands-on exercises to test system firmware for vulnerabilities. Students can apply this knowledge to identify firmware vulnerabilities and perform forensic analysis. This includes assessments of UEFI/BIOS attacks and basic forensics in enterprise environments.

Understanding firmware attack methods is a critical step in maintaining a secure compute ecosystem. This applies to firmware developers, security researchers, IoT device manufacturers, and IT professionals maintaining enterprise infrastructure. Classes like the one Intel and Eclypsium have developed for Black Hat are a valuable for defending against modern firmware attacks.

Black Hat 2018

System Firmware Attack and Defense for the Enterprise (Aug 4-7, 2018)
Please register before May 25, 2018 for a $600 discount.

For more complete information about compiler optimizations, see our Optimization Notice.