Shade BIOS：释放 UEFI 恶意软件的全部隐蔽性.pdf

1、#BHUSA BlackHatEventsShade BIOSShade BIOSUnleashing the Full Stealth of UEFI MalwareUnleashing the Full Stealth of UEFI MalwareKazuki Matsuo(InfPCTechStack)2025/08/06 Oceanside C,Level 2#BHUSA BlackHatEventsWhoami-Kazuki Matsuo(InfPCTechStack)TitleSecurity Researcher at FFRI Security,Inc.InterestsUE

2、FI BIOS,SMM(Negative Rings)Previous workSmmPack:Obfuscation for SMM Modules with TPM Sealed Key DIMVA 2024Youve Already Been Hacked:What if There Is a Backdoor in Your UEFI OROM?BHUSA 2024#BHUSA BlackHatEventsImportance of UEFI SecurityIs infecting BIOS overkill?Well,what about in these two fields N

3、ational Security BIOS is a reasonable place to install backdoors Many companies are involved in its vast supply chain(unlike OS,VMM,CPU)Leaked documents and toolkits,such as Vault 7 and vector-edk clearly confirm thatUEFI security is considered to be criticalCloud Security Can compromise every VMs S

4、trong rivalry with hypervisor-basedsecurity Fractured,AmliImage from https:/www.binarly.io/blog/attacking-pre-efi-ecosystem#BHUSA BlackHatEventsChallenges of Existing UEFI malwareIn-the-wild UEFI bootkits(Lojax-BlackLotus)After all,they all perform malicious activities in userland or kernel Not pure

5、-BIOS malware(they just support userland/kernel malbehaviors)Dependent on OS-level security(despite BIOS having higher privileges than OS）Leaked BIOS/UEFI backdoors(Jetplow,vector-edk,)Legacy BIOS or SMM backdoors:Very specific attack targets UEFI backdoors:Identical to UEFI bootkitsPoC BIOS/UEFI ma

6、lware in the research fields There are several SMM backdoors but they require device-specific implementation=They suffer from OS&Hardware-Dependence#BHUSA BlackHatEventsOS Dependence of Existing BootkitsThey can disable OS security mechanisms ESPector disables DSE(Driver Signature Enforcement)Cosmic