---
title: Detecting BadBIOS, Evil Maids, Bootkits, and Other Firmware Malware
osem_url: https://osem.seagl.org/conferences/seagl2017/program/proposals/374
beginning: '2017-10-06T15:30:00.000-07:00'
end: '2017-10-06T16:20:00.000-07:00'
presenters:
- name: Paul English
  affiliation: Vaisala Inc, Seattle Area System Administrator's Guild, League of Professional
    System Administrators, Seattle Privacy Coalition, Techno-Activism 3rd Mondays,
    Emerald Onion Project
  osem_url: https://osem.seagl.org/users/57
  gravatar_id: d4766d549bcc8771e8731d8d442b1060
  biography: Paul is CEO of PreOS Security Inc and is a board member for the League
    of Professional System Administrator, a nonprofit professional association for
    the advancement of the practice of system administration from 2015 through 2017.
    Paul has a bachelor’s degree in computer science from Worcester Polytechnic Institute
    obtained in 1998. He has been a UNIX & Linux system administrator and wearer of
    many other IT hats since 1996. More recently he has managed a few sysadmins while
    still racking the occasional server. In 2016, Paul ventured into a firmware security
    startup to help sysadmins keep their systems safe from new threats.
---

For attackers, platform firmware is the new Software. Most systems include hundreds of firmwares - UEFI or BIOS, PCIe expansion ROMs, USB controller drivers, storage controller host and disk/SSD drivers. Firmware-level hosted malware, bare-metal or virtualized, is nearly invisible to normal security detection tools, has full control of your system, and can often continue running even when the system is "powered off". Security Firms (eg, "Hacking Team" sell UEFI 0days to the highest bidder), and government agencies include firmware-level malware (eg, Wikileak'ed Vault7 CIA EFI malware). Defenders need to catch-up, and learn to defend their systems against firmware-level malware. In this presentation, we'll cover the NIST SP (147,147b,155,193) secure firmware guidance, for citizens, rather than vendors/enterprises. We'll discuss the problem of firmware-level malware, and cover some open source tools (FlashROM, CHIPSEC, etc.) to help detect malware on your system. We'll be discussing a new open source tool we've just released to help make it easier for you to do this check. You'll also get a nice paper tri-fold copy of our CHIPSEC Quick Reference for Sysadmins [note: we're all sysadmins for our own personal systems(!)], and some scary looking BadBIOS stickers for your laptop.
