Keep life chaotic.
Arlington, VA
Joined July 2013
- Tweets423
- Following81
- Followers113
- Likes677
Vijay Sarvepalli retweeted
The SEI's CERT Division has released a new vulnerability note: Multiple deserialization vulnerabilities in PyTorch Lightning 2.4.0 and earlier versions. Learn more ➡️
kb.cert.org/vuls/id/252619?u…
ALT A series of red and blue locks on a background of ones and zeros. The red lock is open.
Here is another #UEFI vulnerability that takes months to coordinate. UEFI blocking DBX updates are still trickling in - most Linux and Windows users, trusting SecureBoot, are currently vulnerable. Digitally signing supply-chain is another major gap in our UEFI 5 recommendations
#ESETresearch discovered and reported to @certcc a vulnerability that allows bypassing UEFI Secure Boot on most UEFI-based systems. This vulnerability, #CVE-2024-7344, was found in a UEFI app signed by Microsoft’s 3rd-party UEFI certificate. @smolar_m welivesecurity.com/en/eset-r… 1/4
Vijay Sarvepalli retweeted
In the upcoming #UEFIForum webinar “Coordinating #UEFI Vulnerabilities as CERT/CC,” @CarnegieMellon will provide practical steps when coordinating UEFI vulnerabilities. Join us for the webinar on Nov. 21 at 8 a.m. PT: bit.ly/4ffgZZ1
🚨New! "PKFail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem."
#PKfail is a supply-chain issue affecting x86/ARM devices around the globe.
Blog:
binarly.io/blog/pkfail-untru…
Full report:
22222483.fs1.hubspotusercont…
A free scanning tool: pk.fail
Trying to find #pkfail in our servers -found one!
vijay@thinkserver-TS$ efi-readvar -v PK
Variable PK, length 862
PK: List 0, type X509
Signature 0, size 834, owner 26dc4851-195f-4ae1-9a19-fbf883bbb35e
Subject:
CN=DO NOT TRUST - AMI Test PK
Issuer:
CN=DO NOT TRUST - AMI Test PK
"we are repeating the same mistakes that we did in the past, We decided at some point it is super convenient to mix code and data... we are mixing code and data that we send to these AI systems.... that are under the control of the user." Dr. Daniel Gruss youtube.com/watch?v=XxVHkuPW…
Vijay Sarvepalli retweeted
Intel Hardware Shield deep dive: part 2 is SMM security policy reporting (ISSR, aka PPAM) and interaction with Windows' Secure Launch.
tandasat.github.io/blog/2024…
Another fascinating piece of technology! I have wanted to review this for a while and am glad I have spent time for it.
Intel Hardware Shield deep dive: part 1 is user-mode System Management Mode (ISRD).
tandasat.github.io/blog/2024…
ISRD is beautifully architected, and I have enjoyed studying it a lot. Excellent work by Intel.
Here #UEFI SHIM related story has started. What happens when there is a bootloader vulnerability that is part of shim. eclypsium.com/blog/the-real-…
#UEFI security updates tricking in.. support.microsoft.com/en-us/… "or later"...
This is some smoking good quality research on the zero-click adventures against iPhone.
This iMessage exploit is crazy. TrueType vulnerability that has existed since the 90s, 2 kernel exploits, a browser exploit, and an undocumented hardware feature that was not used in shipped software:
securelist.com/operation-tri…
Some really great work on CPU bug that affects multiple CPU families. - heard of Fast String MSR? always new surprises lingering on how CPU optimizations and internal interpretations can also carry straggling bugs. lock.cmpxchg8b.com/reptar.ht…
This is some very valuable work - PKI signing of firmware is crucial in the trust bootstrap.
intel.com/content/www/us/en/…
We've just published a new paper covering firmware signing keys to address some confusion around the purpose of private keys that have previously been leaked. All known Intel keys in these leaks are pre-production keys. Read more about what those are. community.intel.com/t5/Blogs…
C-cord strikes again. A worthy topic for secure development - probably for more than C++
My talk on Integer Type Selection from CppNow has finally been released youtu.be/82jVpEmAEV4?si=DGRk…
Join up in bolstering #UEFI it is in everyone's interest.
CISA Associate Director Sandra Radesky and Dr. Jonathan Spring published a call to action with recommended options to help bolster the #UEFI communities' cybersecurity. Learn more: go.dhs.gov/ook
PKI is hard in practice, esp. firmware well here is Platform Key(PK) in a production Lenovo server
mokutil --pk
[key 1]
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=DO NOT TRUST - Test PK
Validity
Not Before: Mar 6 15:16:55 2013 GMT
Not After : Mar 6 15:16:54 2017 GMT
Strong letter from @RonWyden about Microsoft security failures that enabled SolarWinds hack and recent Storm-0558 campaign. He calls on @CISAgov, @FTC and @TheJusticeDept to investigate company and hold it "responsible for its negligence." wyden.senate.gov/imo/media/d…
UEFI signing and revocation challenges - hopefully forces us to improve UEFI SecureBoot. Each and every time a bootloader is introduced to a new environment, more checks than signing are likely necessary.
#ESETresearch discovered 4 not-revoked GRUBs affected by CVE-2020-7205, a vulnerability first disclosed in 2020 by @d_olex. The GRUBs are all signed by HP Enterprise and used in multiple versions of Smart Storage Administrator Offline images @smolar_m xitter.cf/d_olex/status/12642384… 1/6