One Bootloader to Load Them All: Subverting UEFI Secure Boot
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.
Summary
The Foundation of UEFI Secure Boot
Secure Boot verifies the cryptographic signatures of all boot stages—from UEFI firmware to OS bootloaders—against Microsoft-trusted keys stored in NVRAM.
Auditing the Microsoft 3rd Party UEFI Certificate Ecosystem
Mickey Shkatov and Jesse Michael investigate dozens of OEM, enterprise rescue, and dual-boot bootloaders signed by Microsoft's Third-Party UEFI CA.
Exploiting Bootloader Vulnerabilities to Execute Untrusted Code
The researchers demonstrate weaponizing memory corruption and unvalidated configuration execution in signed bootloaders to bypass Secure Boot entirely.
Managing the Revocation Crisis and Firmware Patching
The authors analyze the complex challenges of managing UEFI Secure Boot Forbidden Signature Database (DBX) revocation lists across legacy hardware.
Related talks
Main Stage·41 min
Christopher Wade
Christopher Wade details actionable exploitation techniques to bypass signature verification in modern Android and embedded bootloaders, deploying unsigned firmware.
Main Stage·49 min
Jesse Michael
Demonstrates persistent firmware-level implants that survive OS reinstalls by exploiting UEFI driver loading and Secure Boot bypass vulnerabilities.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.