---
title: "Below The Surface: November Firmware Threat Report from Eclypsium"
---

Flood of advisories exposes gaps in firmware security.

| View in browser Eclypsium Threat Report—November 2019   Flood of New Advisories Expose Massive Gaps in Firmware Security   It has been an incredibly busy and important week in firmware security marked by major security advisories from Intel and Cisco and new research from the industry. This included 77 newly disclosed Intel vulnerabilities, new weaknesses discovered in Cisco small business routers, and the discovery of new ZombieLoad issues that can expose data in processors.    READ MORE >           New Vulnerabilities Found In Windows Drivers   Ongoing Eclypsium research into Windows kernel security mode shows how readily available drivers can be used to attack and gain control over firmware. This update reveals the most powerful drivers we have identified to date, providing an attacker with near-limitless control over a victim device.   READ RESEARCH REPORT > VIEW RECORDED WEBINAR >           TPM Fail   Newly disclosed research has identified new vulnerabilities within the firmware of TPM (Trusted Platform Module) chips made by Intel and STMicroelectronics that could allow attackers to access the cryptographic keys normally protected by the TPM.   READ THE RESEARCH > LEARN MORE ABOUT TPM >           Industry News   Unpatched Firewalls Leads to Disconnection of Power Plant Cyber-attack on wind and solar energy provider causes the power plant to become disconnected from the grid. 90% of retail hardware vulnerabilities are critical Bugcrowd's analysis of bug bounty programs for the retail industry found that 90% of submitted hardware vulnerabilities were classified as critical compared to 20% for software. Navy Must Work To Secure Its Platforms, Networks And Installations From Cyber Attack Evidence that a massive cyber campaign is being waged against the Navy and every organization associated with it is mounting. The defense industrial base and associated supply chains are under constant assault. Open Source Titan Chip Announced Google announced a plan to release an open-source version of Titan known as OpenTitan. The OpenTitan SoC will provide an open-source approach to hardware Root-of-Trust (RoT) and will use the RISC-V open-source CPU instruction set architecture, and will be managed by lowRISC, the nonprofit full-stack engineering organization. 3 Ways to Stay Ahead on Supply Chain Security Analysis for federal agencies to build better supply chain security programs including the need for security assessments and the critical importance of supply chain technical skills. ANSSI Publication: Hardware security requirements for x86 platforms A helpful guide to security features and configuration options for IT departments use in enforcing the security of new hardware.  Trends in Server Platform Security Recorded presentation from Rob Wood of the NCC Group where he discusses the need for improved security models to address the firmware and hardware layers of servers and data centers. The Tragedy of the Commons in Platform Security Eclypsium's John Loucaides  analyzes examples of a variety of platform vulnerabilities, approaches to solving them, and how the community can come together to make meaningful improvements. Security Research   Malware attacking firmware of NAS devices Newly discovered malware is able to subvert security controls by injecting malicious code into the firmware QNAP network-attached storage devices. Using code in the firmware the malware is able to modify scheduled OS jobs, prevent firmware updates, prevent local security tools from running and more. 35 vulnerabilities in 8 enclave SDKs Researchers analyzed a variety of open-source enclave SDKs and found vulnerabilities that would allow an attacker to run malicious code inside the trusted execution environment (TEE) of a CPU. Vulnerabilities Discovered in Das U-Boot Multiple vulnerabilities have been found in Das U-Boot, a universal bootloader commonly used in embedded devices like networking hardware, Amazon Kindles, and ARM Chromebooks. The bugs could allow attackers to gain full control of an impacted device’s CPU and modify anything they choose. Breaking the UEFI firmware Authenticode security model In-depth analysis from Reversing Labs that identifies weaknesses within UEFI specification 2.1 and Microsoft Project Mu. The weaknesses show how it is possible to avoid Authenticode integrity checks in order to potentially run malicious UEFI firmware. TSX Asynchronous Abort (TAA) Vulnerability in Intel CPUs Analysis from VUSec where they disclose a “new” speculation-based vulnerability in Intel CPUs. The newly disclosed issues can enable a Rogue In-Flight Data Load (RIDL) attack despite the in-silicon mitigations/microcode patches from Intel published in May 2019.  Exploiting Intel’s Management Engine Provides a great introduction to the Intel Management Engine (ME), then provides detailed analysis of how an ME exploit works, and how it can be used to gain control over other devices.   Security Advisories November 2019 Intel Platform Update (IPU) Intel disclosed 77 new vulnerabilities across a broad spectrum of components, including 2 critical and 34 high severity bugs, some of which would allow an unauthenticated user to potentially enable escalation of privileges, information disclosure or denial of service. Cisco Security Advisory Cisco disclosed multiple security issues affecting Cisco Small Business Routers (RV016, RV042, RV042G, and RV082). Firmware issues included the discovery of hardcoded root password hashes in /etc/shadow file, the presence of public/private key pair, and a variety of 3rd party firmware vulnerabilities. Tools & Testing OWASP Foundation announces Firmware Security Testing Methodology The OWASP Foundation introduces their Security Testing Methodology to guide security researchers, software developers, hobbyists, and InfoSec professionals with conducting firmware security assessments. Crafting an EFI Emulator and Interactive Debugger An in depth analysis of building an EFI debugger that provides a very detailed hands-on view into how EFI works and the use of emulators and debuggers to capture important information that resides within the EFI. Sgx-Step - A Practical Attack Framework For Precise Enclave Execution Control An introduction to Sgx-Step, an open-source framework to facilitate side-channel attack research on Intel SGX platforms. Provides an introduction to the Intel SDX enclave and a walkthrough of using the tool to mount a practical attack.           Eclypsium, 15455 Greenbrier Pkwy, #250, Beaverton, OR 97006, USA Unsubscribe |
| --- |