Skip to main content

#HITB2014KUL White Paper: Extreme Privilege Escalation on Windows 8/UEFI Systems

posted onJanuary 30, 2015
by l33tdawg

Authors: Xeno Kovah, Corey Kallenberg, John Butterworth amd Sam Cornwell - The MITRE Corporation

Presentation Overview: http://conference.hitb.org/hitbsecconf2014kul/sessions/watching-the-watcher-extreme-privilege-escalation-on-windows-8uefi-systems/

Abstract

The UEFI specification has more tightly coupled the bonds of the operating system and the platform firmware by providing the well-defined “Runtime Service” interface between the operating system and the firmware. This interface is more expansive than the interface that existed in the days of conventional BIOS, which has inadvertently increased the attack surface against the platform firmware. Furthermore, Windows 8 has introduced an API that allows accessing this UEFI interface from a privileged userland process. Vulnerabilities in this interface can potentially allow a privileged userland process to escalate its privileges from ring 3 all the way up to that of the platform firmware, which attains permanent control of the very-powerful System Management Mode. This paper discusses two such vulnerabilities that the authors discovered in the UEFI open source reference implementation and the techniques that were used to exploit them.

DOWNLOAD WHITE PAPER (PDF)


Source

Tags

Windows Microsoft HITB2014KUL

You May Also Like

Recent News

Tuesday, November 19th

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th