OuterHaven: UEFI Memory Space
Explores methods for exploiting, monitoring, and enumerating the UEFI memory space to detect pre-boot firmware persistence.
Summary
Pre-Boot Exploitation and Firmware Threats
The Unified Extensible Firmware Interface (UEFI) provides critical system boot services, making its memory space an attractive target for adversaries seeking covert, pre-boot persistence.
Access Hurdles and Memory Enumeration
Navigating and inspecting UEFI memory involves complex hardware and privilege boundaries, creating significant visibility gaps for conventional operating system security agents.
Scripted Inspection and Monitoring Tools
The talk introduces Windows-hosted scripts and Python utilities designed to enumerate UEFI memory regions, monitor unauthorized modifications, and detect stealthy firmware implants.
Related talks
Main Stage·52 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.
Main Stage·58 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael demonstrate abusing non-volatile memory chips in laptop trackpads and USB-C monitors to store stealthy malware payloads.
Main Stage·30 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael answer community questions regarding non-volatile memory chips, peripheral firmware modification, and detection.