Alex Matrosov

@matrosov

IDAholic, , , "Rootkits and Bootkits" book co-author (), BIOS voodoo, and TEE exorcist. Chief Offensive REsearcher at

Portland, OR
medium.com/@matrosov
Vrijeme pridruživanja: srpanj 2008.

Medijski sadržaj

  1. 12. pro 2019.

    Our talk recording "Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller" is up! EC issue we found has a bigger impact from what we expected in the beginning

    29 proslijeđenih tweetova 78 korisnika označava da im se sviđa
  2. 5. pro 2019.

    Cool research, demonstrate the problem of infinite trust to TPM. OS bootloaders don't have direct access to TPM, hooking EFI_TCG_PROTOCOL from custom bootloader can intercept a lot of sensitive info. Btw impacted vendors by based on AMI code ;-)

    15 proslijeđenih tweetova 34 korisnika označavaju da im se sviđa
  3. 2. kol 2019.

    A lot of cool stuff coming in our talk "Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller" at Include interesting relations between EC and BIOS Guard. Also BG script interpreter located inside ACM module

    1 reply 14 proslijeđenih tweetova 63 korisnika označavaju da im se sviđa
  4. 1. srp 2019.

    My keynote slides "The Advanced Threats Evolution: REsearchers Arm Race" from released! The golden age of FW/HW implants is happening right now!! Honestly preparing these slides took more time than my usual research presentations :-)

    73 proslijeđena tweeta 180 korisnika označava da im se sviđa
  5. 4. lip 2019.

    Embedded Controller (EC) is simple microcontroller in every laptop. Its update verification (if exist) in most of the cases happens outside of EC but for update process (read/write/erase) responsible EC itself. Only I see this critical security design issue? Stay tuned!

    1 reply 23 proslijeđena tweeta 78 korisnika označava da im se sviđa
  6. 31. svi 2019.

    Just received my ”Bootkits and Rootkits” copy :-) Looked on Ch15 ”Contemporary UEFI Bootkits” and Ch16 ”UEFI Firmware Vulnerabilities” on paper. It’s really impressive how much valuable information we packed only in those two chapters. Stay tuned is up!

    6 replies 50 proslijeđenih tweetova 190 korisnika označava da im se sviđa
  7. 20. tra 2019.

    Slides "Modern Secure Boot Attacks: Bypassing Hardware Root of Trust from Software" from and released! Lenovo keeps manufacturing mode Boot Guard "backdoor" to unlock DXE volume for arbitrary modifications. It fully breaks Secure Boot!

    229 proslijeđenih tweetova 450 korisnika označava da im se sviđa
  8. 9. tra 2019.

    In 2012 and myself have been done REconstruction of Flame framework to represent it as object-oriented platform In the same time we figured out the relations between Stuxnet/Duqu/Flame as the unified development platform

    27 proslijeđenih tweetova 65 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  9. 23. ožu 2019.

    All Computrace options Enable/Disable/Permanent Disable implemented fully in software over SMM drivers with LenovoSecuritySmiDispatcher orchestration (presented on ) Basically "Permanent Disable" option is a joke and can be reactivated any time. Stay tuned!

    29 proslijeđenih tweetova 64 korisnika označavaju da im se sviđa
  10. 5. velj 2019.

    My talk "Attacking Hardware Root of Trust from UEFI Firmware" on the next week. This research will also include the details of activation/deactivation Computrace/Lojack from OS without access to BIOS setup. It's no real option exist for permanent disabling!

    1 reply 64 proslijeđena tweeta 160 korisnika označava da im se sviđa
  11. 16. sij 2019.

    In "UEFI vulnerabilities classification focused on BIOS implant delivery", I try to create some sort of classification of different practical methods for UEFI firmware attacks with the final goal of persistent or non-persistent implant installation.

    107 proslijeđenih tweetova 187 korisnika označava da im se sviđa
  12. 19. velj 2018.

    New technique to bypass Intel Boot Guard implementation over PEI Loader specifics and not protected by Initial Boot Block PEI Raw file (can be modified). EDKII or AMI PEI Loader don't have authentication It's loads any discovered files with PE header in PEI section

    111 proslijeđenih tweetova 166 korisnika označava da im se sviđa
  13. 19. velj 2018.

    Everybody cares about signed BIOS updates. When other firmwares like Intel Embedded Controller (EC) can get FW updates without any authorization on some recent hardware. EC have RW access to SPI flash storage and other interesting stuff for rootkits.

    82 proslijeđena tweeta 152 korisnika označavaju da im se sviđa
  14. 17. stu 2017.

    It's a pleasure to be on stage again. This time for open the conference :)

    3 proslijeđena tweeta 48 korisnika označava da im se sviđa
  15. 12. lis 2017.

    New release of UEFITool with support of visual validation coverage of Intel Boot Guard.

    41 proslijeđeni tweet 66 korisnika označava da im se sviđa
  16. 10. ruj 2017.

    The video "The UEFI Firmware Rootkits: Myths and Reality" from released! Include demo from docx to SMM :-)

    73 proslijeđena tweeta 122 korisnika označavaju da im se sviđa
  17. 2. ruj 2017.

    Nice! Lenovo patched my CVE-2017-3753 (SMM Privilege Escalation) which is affect all AMI-based Lenovo hardware.

    93 proslijeđena tweeta 125 korisnika označava da im se sviđa
  18. 28. srp 2017.

    S3 rootkits coming! Just dropped a bomb for Intel Boot Guard (AMI version) about weak verification for transition PEI to DXE on sleep (S3)

    1 reply 51 proslijeđeni tweet 64 korisnika označavaju da im se sviđa
  19. 25. svi 2017.

    New art is amazing! CFP will be open shortly. Don't forget to submit. See you there in November ;)

    7 proslijeđenih tweetova 10 korisnika označava da im se sviđa
  20. 24. tra 2017.

    Great RE stuff "Intel ME: The Way of Static Analysis" by blog: video:

    66 proslijeđenih tweetova 86 korisnika označava da im se sviđa

@matrosov još nije poslao/la nijedan tweet s fotografijama ili videozapisima.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·