Is there an EFI monster inside your apple?
summary
A disclosed EFI firmware zero day lets software write the Mac EFI flash (uses 8MB SPI chips) after a sleep/wake sequence, enabling persistent EFI rootkits that never touch the disk; exploit chains include browser RCE → write-flash. Hardware dumping with a Teensy SPI flasher or flashrom is the only trusted detection; UEFITool/UEFIExtract and IDA plugins are used for reversing. Apple patches the bug in about three weeks; Thunderstrike 2 demonstrates similar physical/Thunderbolt attacks.
AI-written summary · about
chapters (21)
- 0:00Start
- 1:31EFI Monsters?
- 2:24Assumptions
- 6:36What evil things can we do?
- 16:27A zero day story...
- 21:18Where is EFI?
- 28:04How to dump EFI
- 29:27Hardware
- 31:13Flash chip SPI pinout
- 31:34Teensy 2.0 pinout
- 32:14Tips & Tricks
- 33:46Software
- 36:46What's in the flash
- 38:41Descriptor region
- 39:20Intel ME region
- 41:19BIOS region
- 46:47EFI Boot Phases
- 49:25Tools
- 49:55EFI file types
- 52:33EFI Services
- 54:44Calling conventions
related talks
01h 01mThe Apple of Your EFI: An Updated Study of EFI Security
45mInside the Apple T2
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
27mProtecting Data In-Use from Firmware and Physical Attacks
44mLogoFAIL: Security Implications of Image Parsing During System Boot
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
44mBehind the scenes of iOS and Mac Security