Security Weekly
Below the Surface: The Supply Chain Security PodcastSubscribe
Vulnerability Management, Security Program Controls/Technologies, Endpoint/Device Security

Learning About Firmware Security – Xeno Kovah – BTS #10

Full Audio

View Show Index

Segments

1. Learning About Firmware Security – Xeno Kovah – BTS #10

Firmware security is a deeply technical topic, that's hard to get started in. In this talk, Xeno will discuss some past work in firmware security, and how he has organized resources such as a low level timeline (with over 300 talks), and free MOOC classes, to help teach people about firmware security.

Segment Resources: https://ost2.fyi https://darkmentor.com/timeline.html

This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!

Sponsored By

Eclypsium

Guest

Xeno Kovah
Founder at OpenSecurityTraining2

Xeno began leading BIOS security research projects at MITRE in 2011. His team’s first public talks started appearing in 2013, which led to a flurry of presentations on BIOS-level vulnerabilities up through 2014. In 2015 he co-founded LegbaCore. And after presenting a firmware worm that could spread between Macs via Apple’s EFI-based BIOS and Thunderbolt Ethernet adapters, he ended up working for Apple. There he worked on securing all the lesser-known firmwares on Macs and peripherals – everything from 3rd party GPUs to SecureBoot for monitors! He worked on the x86-side of the T2 SecureBoot architecture, and his final project was leading the M1 SecureBoot architecture – being directly responsible for designing a system that could provide iOS-level security, while still allowing customer choice to trust arbitrary non-Apple code such as Linux bootloaders. He left Apple in Dec. 2020 after the M1 Macs shipped, so he could work full time on OpenSecurityTraining2.

Hosts

Principal Security Evangelist at Eclypsium
Principal Cyber Strategist at Eclypsium

Related

Wifi Vulns, Yubikeys, and Firmware – PSW #842

Don't tell the FCC there is a new Flipper firmware release, unpatchable?, argv[0] and sneaking past defenses, protect your registries, someone solved my UART RX problem, PKFail update, legal threats against security researchers documented, EDR bypass whack-a-mole continues, emulating PIs, VScode moonlights as a spy, Want to clone a YubiKey? All you...