Legbacore's upcoming "digital voodoo" presentation will reveal an automated means of discovering BIOS defects that are vulnerable to remote attacks, meaning that your computer can be compromised below the level of the OS by attackers who do not have physical access to it.
A common threat-model for secure computing anticipates that a computer that is not physically compromised can be trusted if it is booted into a clean, secure operating system, like Tails, a privacy-oriented operating system recommended and used by Edward Snowden. Though there's been long suspicion that spy agencies have exotic means of remotely compromising computer BIOS, these remote exploits were considered rare and difficult to attain.
Legbacore founders Corey Kallenberg and Xeno Kovah's Cansecwest presentation, scheduled for next week, automates the process of discovering these vulnerabilities. Kallenberg and Kovah are confident that they can find many more BIOS vulnerabilities; they will also demonstrate many new BIOS attacks that require physical access.
Computers whose BIOS is compromised cannot be booted into a trustworthy state, because the BIOS can trick the operating system about what the underlying machine is doing. This means that a computer targeted by a BIOS attack could leak private communications and keys, even if it is booted with Tails.
He claimed that even other Tails protections, such as the memory wiper and offline mode, would not save it from the malware he and Kovah created. “We can just write the secrets you scrape to non-volatile storage and just wait until we have access to the internet to exfiltrate that data to the attacker.
“If an attacker has remote software accessged is coming after you.”
'Voodoo' Hackers: Stealing Secrets From Snowden's Favorite OS Is Easier Than You'd Think [Thomas Fox-Brewster/Forbes]
Wired security reporter Andy Greenberg's latest book is Sandworm (previously), a true-life technothriller that tells the stories of the cybersecurity experts who analyzed and attributed as series of ghastly cyberwar attacks that brought down parts of the Ukrainian power grid, and then escaped the attackers' control and spread all over the world.
Daniel Moghimi, Berk Sunar, Thomas Eisenbarth and Nadia Heninger have published TPM-FAIL: TPM meets Timing and Lattice Attacks, their Usenix security paper, which reveals a pair of timing attacks against trusted computing chips ("Trusted Computing Modules" or TPMs), the widely deployed cryptographic co-processors used for a variety of mission-critical secure computing tasks, from verifying software […]
The privacy-focused web browser Brave has finally launched a 1.0 version, bringing it officially out of beta.
Between all of our apps, streaming devices, Bluetooth speakers, and energy-sucking decorations, paying for utilities each month can be…brutal. In fact, the average household spends roughly $70 a month on the water bill alone. That number might not seem terribly significant, but when you add it up, that’s $840 a year — a pretty significant […]
Seems like no matter what kind of wireless earbud you buy, you’re sacrificing something: Sound for longevity, battery life for durability, the list goes on. Finally, it seems like the tech is starting to come together for the full package in a few newer models. Case in point: These PaMu Slide Bluetooth 5 In-Ear Headphones. […]
If you’re doing any kind of data work, chances are you’re working in Excel. This venerable platform has evolved beyond its roots as a workhorse spreadsheet creator into an essential tool for data analysts and other high-level number crunchers. Want to brush up on this year’s version of the software? There’s no quicker way than […]