DE MYSTERIIS DOM JOBSIVS Mac EFI Rootkits - Reverse ...

More documents

Recommendations

Info

INTRODUCTIONPRIOR ART‣ Other work in this area‣ Old MBR viruses‣ ...‣ John Heasman @ Black Hat ’07 (badass talk on <strong>EFI</strong>)‣ Core Security @ CanSecWest ’09 (BIOS infection)‣ Invisible Things @ Black Hat ’09 (Intel U<strong>EFI</strong> BIOS)‣ endrazine @ Black Hat 2012 (BIOS/Coreboot)‣ and more...De Mysteriis Dom Jobsivs - Black Hat USA2012
Page 1 and 2: DE MYSTERIIS DOM JOBSIVS:MAC EFI RO
Page 3 and 4: AGENDA‣ Things I will talk aboutI
Page 5: INTRODUCTIONI WANT A COOL BOOT SCRE
Page 9 and 10: WHAT’S AN EFI?AND WHY DO I CARE?
Page 11 and 12: EFI ARCHITECTURE‣ Tables - pointe
Page 13 and 14: EFI ARCHITECTUREDEVELOPING FOR EFI
Page 15 and 16: EFI ARCHITECTUREBOOT PROCESSToken s
Page 17 and 18: DOING BAD THINGS WITH EFIWHAT CAN W
Page 19 and 20: DOING BAD THINGS WITH EFIATTACKING
Page 21 and 22: DOING BAD THINGS WITH EFIATTACKING
Page 23 and 24: De Mysteriis Dom Jobsivs - Black Ha
Page 25 and 26: ATTACKING THE KERNELEFI BOOT PROCES
Page 27 and 28: ATTACKING THE KERNELPATCHING THE KE
Page 29: ATTACKING THE KERNELPATCHING THE KE
Page 32 and 33: ATTACKING THE KERNELPATCHING THE KE
Page 34 and 35: ATTACKING THE KERNELHALF-ASSED ROOT
Page 36 and 37: IV. PERSISTENCEDe Mysteriis Dom Job
Page 38 and 39: MESSING WITH THE BOOTLOADER‣ /Sys
Page 40 and 41: PERSISTENCEPCI DEVICE EXPANSION ROM
Page 42 and 43: ‣ Hardware-specific, but it’s a
Page 44: PERSISTENCEFIRMWARE FLASH‣ Manipu
Page 47 and 48: PERSISTENCEFIRMWARE FLASHOOPSDe Mys
Page 49 and 50: ‣ Change boot target‣ USB, Fire
Page 51 and 52: EVIL MAID ATTACKSIT’S MY JOB TO K
Page 53 and 54: EVIL MAID ATTACKSIT’S MY JOB TO K
Page 55 and 56: EVIL MAID ATTACKSTHUNDERBOLT TO GIG
Page 57 and 58:
DEMO‣ Evil maid using Thunderbolt
Page 59 and 60:
IN CASE MY DEMO BROKEHERE’S SOME
Page 61 and 62:
V. DEFENCEDe Mysteriis Dom Jobsivs
Page 63 and 64:
DEFENCEUEFI SECURE BOOT‣ Part of
Page 65 and 66:
IN CONCLUSION...I HAD FUN.‣ So ba
Page 67:
KTHXBAI \m/twitter: @snareblog: htt
show all

DE MYSTERIIS DOM JOBSIVS Mac EFI Rootkits - Reverse ...

Create successful ePaper yourself

Delete template?

Save as template?