Poked firmware before it was cool. Security researcher @NVIDIA. Opinions expressed are my own.
Joined August 2015
- Tweets133
- Following173
- Followers612
- Likes770
Pinned Tweet
A recording of our #defcon31 talk "Breaking BMC - The Forgotten Key to the Kingdom" is now available: youtube.com/watch?v=dbJQIQib…
cc: @Adam_pi3
Alex Tereshkin retweeted
I'm hiring an exceptional Offensive Security Researcher for my team at NVIDIA (Offensive Security Research - OSR).
Firmware, microcode, RISC-V, hypervisors, and shipping mitigations like HW CFI, Memory Tagging, and Pointer Masking from the ground up.
jobs.nvidia.com/careers?quer…
Alex Tereshkin retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Alex Tereshkin retweeted
Nvidia OSR (@AlexTereshkin, @Adam_pi3) reveals high-impact Supermicro BMC vulnerabilities (CVE-2024-10237/38/39). Binarly REsearch documenting the details:
👻Ghost in the Controller: Abusing Supermicro BMC Firmware Verification.
Read the full story: binarly.io/blog/ghost-in-the…
Alex Tereshkin retweeted
Together with @AlexTereshkin we managed to summarize NVIDIA Offensive Security Research (OSR) work on breaking BMC (reference to our DefCon talk youtube.com/watch?v=dbJQIQib…). This blog post also includes a link to the full paper.
Baseboard Management Controllers (BMCs) are vital for remote server management, but they can also be a significant security risk.
Explore findings and recommendations to safeguard your #datacenter infrastructure from NVIDIA's Offensive Security Research team. ➡️ nvda.ws/3HsQOme
Alex Tereshkin retweeted
I'm delighted to share that our talk "How to Secure Unique Ecosystem Shipping 1 Billion+ Cores?" has been accepted to @BlackHatEvents #BHUSA 2025!
How to create a secure unique ecosystem from scratch? What's Separation Kernel? How and why to modify RISC-V? come to our talk! :)
Alex Tereshkin retweeted
You can now jailbreak your AMD CPU! 🔥We've just released a full microcode toolchain, with source code and tutorials. bughunters.google.com/blog/5…
Alex Tereshkin retweeted
Found a nice little SecureBoot bypass in a sizable bunch of UEFI firmwares, will share the details when able.
Meanwhile, this is the SHA2-256 of the PoC tool to trigger it:
530584749f90d187ac20f77c6d4bb2e09ec1c852090962dfab01c4274a8a6d2d
Alex Tereshkin retweeted
New blog post: Tales from the Call-Gate: An SMM Supervisor Vulnerability
labs.ioactive.com/2024/10/ta…
@kiqueNissim
Nice writeup! Thanks guys.
🚨New! "CVE-2024-36435 Deep-Dive: The Year’s Most Critical BMC Security Flaw."
🔥Classic buffer overflow vulnerabilities resurface in BMCs, remotely opening the gates from the castle.
🏆Kudos to @AlexTereshkin for the initial discovery and disclosure!
binarly.io/blog/cve-2024-364…
Thanks, Xeno. Those were fun times indeed. Much respect to LegbaCore research! #ResearchRespect
I'm trying to start a positive security trend of #ResearchRespect wherein we give shoutouts to researchers whose work we really respect and describe why. I'll go first (in no particular order) with "Attacking Intel BIOS" by Rafal Wojtczuk and @AlexTereshkin at BlackHat 2009
Alex Tereshkin retweeted
#LogoFAIL abstract is online! Embargo ends on Dec 6th. LogoFAIL impacting all major IBVs reverence code: AMI, Insyde, and Phoenix. Also, this attack is not silicon-specific but UEFI-specific🔥 and impacts ARM and x86.
Kudos to @Binarly_io REsearch team!
blackhat.com/eu-23/briefings…
Alex Tereshkin retweeted
🔬OSR Team keeps rocking! @AlexTereshkin and @Adam_pi3 keep digging into BMC and FW rabbit hole.
🔥The main caveat is that most of those discoveries are related to IBVs reference code and impact the entire industry.
⛓️One vendor fix != Industry
⛓️Supply Chain Security is hard!
NVIDIA released a security bulletin for NVIDIA DGX H100.
Thanks to the NVIDIA OSR team for: CVE‑2023‑25531, CVE‑2023‑25532, CVE‑2023‑25533, CVE‑2023‑25534, CVE‑2023‑31008, CVE‑2023‑31009, CVE‑2023‑31010, CVE‑2023‑31011, CVE‑2023‑31012, and CVE‑2023‑31013
nvidia.com/en-us/security/
Alex Tereshkin retweeted
What is BMC? Should we care about BMC's security? How easy is it to hack it?
You can find all the answers during our talk (CC @AlexTereshkin) at @defcon at 3:30pm on Saturday ;-) Join us!
forum.defcon.org/node/245714
CC: @mbazaliy, @igoooo, NVDA RISC-V FW dude
#DEFCON31 #Defcon
Check out the abstract of our upcoming DC talk :)
CC: @Adam_pi3
forum.defcon.org/node/245714
We enjoyed doing this research, super fun stuff. See you all in Vegas!
"Accepted Presentation:
Breaking BMC: The Forgotten Key to the Kingdom
Congrats! Your @defcon 31 Submission is accepted!"
I'm super exited about the 3rd DefCon talk in a row! :)
CC: Alex Tereshkin (@AlexTereshkin)
#defcon31 #defcon
Alex Tereshkin retweeted
Bug bounties are broken - the story of "i915" bug, ChromeOS + Intel bounty programs, and beyond
@GoogleVRP @IntelSecurity
How the unspoken problems of bug bounties can be addressed? "Imbalance of Power" is a real problem and it should be changed.
blog.pi3.com.pl/?p=931
Alex Tereshkin retweeted
RISC-V (@risc_v) Control Flow Integrity (CFI) is coming and I'm proud to be one of the contributors to this important security extension. Full spec is available here:
github.com/riscv/riscv-cfi/b…
