Lessons learned: with a dynamic and reactive opponent with development resources and ops staff, a focus onstatic IOCs is an ancient philosophy stuck in the last decade. An attentive opponent will fix them before you can deploy detection.
-
This Tweet is unavailable.
-
Actual conclusion: there was never any evidence of compromise or actual implant code published. Had it been, it would've been big news. The BIOS image that was publicly posted was normal and had no malicious code. See https://en.m.wikipedia.org/wiki/BadBIOS
I would very much like to see a BadBIOS-like implant. Alas, no such thing was ever found. I'm sure nation state level APTs have such capabilities, but nothing like that was on Dragos' computer.