How is it possible to infect OROMs remotely? Trammell Hudson ✪ ported the open source Linux driver to Mac!

But if "low and slow" is more your style #Thunderstrike2 is a "firmworm" that jumps from t2e adapter to BIOS and back

The novel #Thunderstrike2 "firmworm" never touches the main OS memory or disk. It lives *only* in firmware.

Since #DFIR ppl don't check firmware, they would never find something like this (if Trammell Hudson ✪ and we weren't releasing helpful tools)

Only LebgaCore makes *trustworthy* BIOS integrity checking capabilities, so don't hold your breath for security vendors catching this either

Dear firmware makers: ALL UEFI-RELATED FIRMWARE LOOKS THE SAME TO ATTACKERS! YOUR SECURITY THROUGH OBSCURITY IS GONE!

Github page where we'll post option ROM integrity checker in the future to let people try to catch Thunderstrike 2 github.com/legbacore

Summary of all working attacks on modern UEFIs. Haven't yet checked SMM ones, but all others work on that Acer UEFI. x.com/c7zero/status/…

Are Macs secure against firmware attacks? Nope. Do you need an exploit to brick them? Nope. youtu.be/LEEEazuc8Dg

Researchers have created a firmware worm that attacks Macs wrd.cm/1KLLe6A

Stories about our talk with Trammell Hudson Trammell Hudson ✪ about #Thunderstrike2 are at Wired wired.com/2015/08/resear… and Forbes forbes.com/sites/thomasbr…

Congratulations to LegbaCore co-founder Corey Kallenberg for winning the 2015 Pwnie Awards for best privilege escalation

Xeno Kovah So stay tuned to his HITB GSEC talk, where he'll talk about how VU#552286 can exploit "dead code" to break into Mac firmware

Thunderstrike 2 slides now published at legbacore.com/Research.html

Our last public offering of the "Introductory BIOS & SMM attack & defense" class will be at #HITBGSEC Oct 12-13 gsec.hitb.org/sg2015/session…

My favorite new slide from our update to the Thunderstrike 2 talk for #HITBGSEC: BIOS Necromancy revealed!

Accompanying whitepaper to LegbaCore's #HITBGSEC talk, on CVE-2014-4860 in Apple context: gsec.hitb.org/materials/sg20…

Includes #HITBGSEC exclusive new content about Apple's vulnerability to our pwnie-award-winning vuln from last year x.com/HITBGSEC/statu…

The 2 day class "Introduction to BIOS & SMM" has been uploaded, thanks to the LegbaCore folks opensecuritytraining.info/ChangeBlog/Ent…