Jesse Michael - Get Off the Kernel if You Can't Drive
Demonstrates persistent firmware-level implants that survive OS reinstalls by exploiting UEFI driver loading and Secure Boot bypass vulnerabilities.
Summary
UEFI and Firmware Persistence
Jesse Michael (Principal Security Researcher, Eclypsium) presents practical techniques for achieving persistent code execution below the operating system through UEFI firmware exploitation.
UEFI Attack Surface
The Unified Extensible Firmware Interface runs before any OS code and has access to all hardware. Vulnerabilities in UEFI DXE drivers — which receive minimal security review — allow writing persistent code to SPI flash that survives OS reinstalls and disk replacements.
Secure Boot Bypass Techniques
The talk demonstrates techniques for bypassing UEFI Secure Boot: exploiting signed-but-vulnerable UEFI drivers (BootHole predecessors), abusing the OptionROM loading mechanism, and leveraging vendor-specific maintenance modes that disable signature verification.
Implant Capabilities
A UEFI implant can modify the OS bootloader, inject malicious kernel modules, and establish persistence that cannot be detected or removed by any OS-level security tool — only firmware re-flashing eliminates the implant.
Related talks
Main Stage·52 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.
Main Stage·58 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael demonstrate abusing non-volatile memory chips in laptop trackpads and USB-C monitors to store stealthy malware payloads.
Main Stage·30 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael answer community questions regarding non-volatile memory chips, peripheral firmware modification, and detection.