Extreme Privilege Escalation on Windows 8/UEFI Systems
Analysts investigate attack surfaces and defenses concerning Extreme Privilege Escalation on Windows 8/UEFI Systems.
Summary
Overview: The UEFI specification has more tightly coupled the bonds of the operating system and the platform firmware by providing the well-defined "runtime services" interface between the OS and the firmware. This interface is more expansive than the interface that existed in the days of conventional BIOS, which has inadvertently increased the attack surface against the platform firmware. Furthermore, Windows 8 has introduced APIs that allow accessing this UEFI interface from a userland process. Vulnerab
Key Topics: ilities in this interface can potentially allow a userland process to escalate its privileges from "ring 3" all the way up to that of the platform firmware, which includes permanently attaining control of the very-powerful System Management Mode (SMM).
Related talks
Black Hat·34 min
Haidar Kabibo
Engineers explore architecture and security mechanisms for PhantomRPC: A New Privilege Escalation Flaw in Windows RPC.
Black Hat·21 min
Wenxu Wu
Analysts investigate attack surfaces and defenses concerning Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically.
PROIDEA Events·35 min
Industry experts analyze emerging threats surrounding CONFidence 2017: Windows privilege escalation using 3rd party services (Kacper Szurek).