Too young to be secure: Analysis of UEFI threats and vulnerabilities
Unified Extensible Firmware Interface (UEFI) is a software interface between an operating system and platform firmware designed to replace a traditional BIOS. In general, UEFI has many technical advantages over BIOS (pre-OS environment, boot and run-time services, CPU-independent drivers etc.) inclu...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
FRUCT
2013-11-01
|
| Series: | Proceedings of the XXth Conference of Open Innovations Association FRUCT |
| Subjects: | |
| Online Access: | https://www.fruct.org/publications/fruct14/files/Bas_49.pdf
|
| _version_ | 1819141777370644480 |
|---|---|
| author | Vladimir Bashun Anton Sergeev Victor Minchenkov Alexandr Yakovlev |
| author_facet | Vladimir Bashun Anton Sergeev Victor Minchenkov Alexandr Yakovlev |
| author_sort | Vladimir Bashun |
| collection | DOAJ |
| description | Unified Extensible Firmware Interface (UEFI) is a software interface between an operating system and platform firmware designed to replace a traditional BIOS. In general, UEFI has many technical advantages over BIOS (pre-OS environment, boot and run-time services, CPU-independent drivers etc.) including also powerful security mechanisms (e.g. secure boot, update, etc.). They are aimed to provide platform integrity, be root of trust of security architecture, control all stages of boot process until it pass control to authenticated OS kernel. From the other side UEFI technology is the focus of many new potential threats and exploits and presents new vulnerabilities that must be managed. The main goal of this research is to provide analysis of the UEFI security issues, find the point and source of the security problems and classify them. The paper describes the architectural and implementation troubles of UEFI which lead to threats, vulnerabilities and attacks. It also includes extensive review of the previous research activities in this area and the results of our own experiments. As the result of the work some recommendation about how to make this young technology more safe and secure are provided. |
| first_indexed | 2024-12-22T11:59:50Z |
| format | Article |
| id | doaj.art-e746a33bceb94f9cb732931026b2cc4d |
| institution | Directory Open Access Journal |
| issn | 2305-7254 2343-0737 |
| language | English |
| last_indexed | 2024-12-22T11:59:50Z |
| publishDate | 2013-11-01 |
| publisher | FRUCT |
| record_format | Article |
| series | Proceedings of the XXth Conference of Open Innovations Association FRUCT |
| spelling | doaj.art-e746a33bceb94f9cb732931026b2cc4d2022-12-21T18:26:40ZengFRUCTProceedings of the XXth Conference of Open Innovations Association FRUCT2305-72542343-07372013-11-0123214162410.1109/FRUCT.2013.6737940Too young to be secure: Analysis of UEFI threats and vulnerabilitiesVladimir Bashun0Anton Sergeev1Victor Minchenkov2Alexandr Yakovlev3St. Petersburg State University of Aerospace Instrumentation, St. Petersburg, RussiaSt. Petersburg State University of Aerospace Instrumentation, St. Petersburg, RussiaSt. Petersburg State University of Aerospace Instrumentation, St. Petersburg, RussiaSt. Petersburg State University of Aerospace Instrumentation, St. Petersburg, RussiaUnified Extensible Firmware Interface (UEFI) is a software interface between an operating system and platform firmware designed to replace a traditional BIOS. In general, UEFI has many technical advantages over BIOS (pre-OS environment, boot and run-time services, CPU-independent drivers etc.) including also powerful security mechanisms (e.g. secure boot, update, etc.). They are aimed to provide platform integrity, be root of trust of security architecture, control all stages of boot process until it pass control to authenticated OS kernel. From the other side UEFI technology is the focus of many new potential threats and exploits and presents new vulnerabilities that must be managed. The main goal of this research is to provide analysis of the UEFI security issues, find the point and source of the security problems and classify them. The paper describes the architectural and implementation troubles of UEFI which lead to threats, vulnerabilities and attacks. It also includes extensive review of the previous research activities in this area and the results of our own experiments. As the result of the work some recommendation about how to make this young technology more safe and secure are provided.https://www.fruct.org/publications/fruct14/files/Bas_49.pdf UEFI Secure BootBoot firmwareBootkitRootkit |
| spellingShingle | Vladimir Bashun Anton Sergeev Victor Minchenkov Alexandr Yakovlev Too young to be secure: Analysis of UEFI threats and vulnerabilities Proceedings of the XXth Conference of Open Innovations Association FRUCT UEFI Secure Boot Boot firmware Bootkit Rootkit |
| title | Too young to be secure: Analysis of UEFI threats and vulnerabilities |
| title_full | Too young to be secure: Analysis of UEFI threats and vulnerabilities |
| title_fullStr | Too young to be secure: Analysis of UEFI threats and vulnerabilities |
| title_full_unstemmed | Too young to be secure: Analysis of UEFI threats and vulnerabilities |
| title_short | Too young to be secure: Analysis of UEFI threats and vulnerabilities |
| title_sort | too young to be secure analysis of uefi threats and vulnerabilities |
| topic | UEFI Secure Boot Boot firmware Bootkit Rootkit |
| url | https://www.fruct.org/publications/fruct14/files/Bas_49.pdf
|
| work_keys_str_mv | AT vladimirbashun tooyoungtobesecureanalysisofuefithreatsandvulnerabilities AT antonsergeev tooyoungtobesecureanalysisofuefithreatsandvulnerabilities AT victorminchenkov tooyoungtobesecureanalysisofuefithreatsandvulnerabilities AT alexandryakovlev tooyoungtobesecureanalysisofuefithreatsandvulnerabilities |