Broken Trust: Firmware Bypass Chains, BMC Persistence, and EDR Evasion

Broken Trust: Firmware Bypass Chains, BMC Persistence, and EDR Evasion

Speakers: Alex Matrosov (CEO and Founder, Binarly), Fabio Pagani (Vulnerability Research Lead, Binarly)

Conference: DistrictCon

YouTube: https://www.youtube.com/watch?v=qPus0aeWMHo

Overview

This talk, "Broken Trust: Firmware Bypass Chains, BMC Persistence, and EDR Evasion," delivered by Binarly's CEO and Founder Alex Matrosov and Vulnerability Research Lead Fabio Pagani, delves into the critical and often-overlooked vulnerabilities within the firmware ecosystem. The presentation exposes a landscape where fundamental security flaws, some stemming from decades-old code, enable attackers to achieve deep persistence and evade modern security solutions. Drawing on years of extensive research and the disclosure of nearly a thousand firmware-related issues, Binarly highlights the severe implications for enterprise-grade devices and critical infrastructure.

The core of the discussion revolves around the fragility of the UEFI (Unified Extensible Firmware Interface) and Base Management Controller (BMC) security models. Matrosov and Pagani demonstrate how vulnerabilities like Logofail and Pickafail, alongside newly disclosed Supermicro BMC flaws (CVEs), can be chained together to bypass Secure Boot, install malicious bootkits, and ultimately achieve kernel-level control on Windows 11 systems, all while evading EDR (Endpoint Detection and Response) mechanisms. The talk serves as a stark warning about the growing attack surface in an increasingly complex and AI-driven computing environment, where firmware security remains a significant weak link.

The research underscores the systemic issues plaguing the industry, including slow patch cycles, insufficient vendor support for end-of-life devices, and a lack of comprehensive threat modeling that often dismisses "physical attacks" as out of scope. Binarly's findings reveal that these vulnerabilities are not merely theoretical but are actively being exploited by state-sponsored actors, commodity cybercriminals, and even gamers, making robust firmware security a paramount concern for any organization relying on modern compute infrastructure.

Background

▶ Watch: Introduction: BMC as 'keys from the castle' (0:00)

The importance of firmware security is often underestimated, yet it forms the foundational layer of trust for all modern computing systems. As highlighted in the talk, the complexity of firmware has grown exponentially, from approximately 1 million lines of code 15 years ago to over 10 million lines today, driven by the demands of new devices and artificial intelligence stacks. Despite this growth, the firmware world, especially for enterprise devices, lags significantly behind other stacks like mobile operating systems in terms of robust exploitation mitigations. This disparity makes exploitation chains often "quite simple" and "easy to exploit."

Binarly's research team has been at the forefront of uncovering these systemic issues, disclosing close to 1,000 security vulnerabilities over the past four years. A significant class of these problems stems from outdated and unmaintained code. For instance, the Logofail vulnerability, disclosed at Black Hat Europe 2023, was found through simple fuzzing of an image parser. Shockingly, these image parsing libraries, used by major IBV (Independent BIOS Vendor) firms like American Megatrends and Phoenix, had not been updated for 15 years, leading to a "class of problems affecting the entire ecosystem." Exploiting Logofail involves storing a malformed image on the ESP (EFI System Partition) or in an NVRAM variable, triggering an integer overflow that can lead to arbitrary code execution during the boot process.

Beyond C-language vulnerabilities, UEFI introduces its own unique mechanisms that, if misused, lead to severe flaws. One such example is the "pointer via variable memory write," where firmware reads attacker-controlled NVRAM variable content and uses it as a target for memory writes, enabling memory tampering. Many of these vulnerabilities carry high CVE scores, indicating their critical impact.

A particularly alarming class of vulnerabilities affects Secure Boot, the mechanism designed to ensure that only trusted code executes during the boot process. The talk details Pickafail, a "holy grail for bypassing Secure Boot" affecting 8-10% of devices. This vulnerability leveraged a Platform Key (PK) marked as a "do not trust" or "test key." Binarly discovered the corresponding PFX file (containing the private key) publicly available on GitHub for six months. Compounding the issue, the password for this private key was "ABCD" and stored in plain text in the same folder. This astonishing oversight undermines the entire chain of trust for a vast number of devices.

Another critical Secure Boot bypass involves a vulnerability in a module signed with a Microsoft third-party UEFI certificate. This certificate is widely trusted, used for signing components like shim (the first-stage Linux bootloader), making the module "hardware agnostic." The vulnerability itself was another instance of a "pointer via variable" issue, allowing an unprivileged operating system process to write to memory and ultimately disable Secure Boot to load a malicious bootloader. The speakers noted that some vendors push back on fixing these issues, deeming "physical attacks" (which can lead to this type of persistence) as out of scope, a dangerous stance given the potential for deep system compromise.

Key Findings

▶ Watch: Live Demo: Secure Boot bypass and untrusted driver load (17:00)

The Binarly research team's extensive analysis of over 80,000 different firmware images, spanning enterprise vendors like HP, Intel, Supermicro, Lenovo, and Dell, revealed a fragile ecosystem riddled with systemic security deficiencies. A critical finding is the alarmingly short support window for firmware, often only two years, with high-criticality issues sometimes receiving fixes for up to three years, and beyond that, support is rare without special SLAs. For client and gaming computing, the situation is even worse, with devices receiving as few as three to five updates over their entire lifespan. This lack of sustained support leaves a vast number of devices vulnerable to known and unknown exploits.

The timeline for fixing firmware vulnerabilities is another major concern, often stretching up to 16 months, even for "very easy to fix" issues (e.g., a one-line code change). This extended window provides attackers with ample opportunity to develop and deploy powerful, persistent tools.

Analysis of known vulnerabilities across the dataset revealed a "mountain" of issues primarily related to Logofail and Pickafail. These two vulnerabilities are particularly impactful because they affect the very first parts of the UEFI supply chain, specifically the EDK2 (EFI Development Kit II) reference implementation and the code developed by IBV (Independent BIOS Vendor) firms. As these components are at the "top of the UFI supply chain," their flaws "trickle down into OEMs device vendors and all and everything which stays downstream," leading to a massive impact across the ecosystem.

While the average number of unknown vulnerabilities is reportedly decreasing due to Binarly's consistent reporting efforts since 2021, the road ahead remains long. A concerning statistic indicates that 90% of firmware released in 2025 still contains at least one high-severity vulnerability. These persistent flaws can enable Secure Boot bypasses, arbitrary code execution during DXE (Driver Execution Environment), and attacks on SMM (System Management Mode), leaving systems highly exposed.

The malicious actor community is keenly aware of this landscape. Recent findings from September 2025 by Insek researchers uncovered "Abid Pia," a copycat of the infamous Pia malware, fully implemented to run during the UEFI boot process and including a Secure Boot bypass out-of-the-box. This signifies a shift where firmware-originating vulnerabilities, traditionally used by state-sponsored actors, are now being adopted by commodity cybercriminals and even gamers due to their ease of exploitation, reliability (e.g., 99% reliability for the Microsoft module vulnerability), and persistence capabilities.

The talk culminated in the disclosure of two new CVEs affecting Supermicro devices, which are widely used in enterprise networks and critical AI data centers. These vulnerabilities highlight that not all vendors possess comprehensive security teams, leading to slow fixes and inconsistencies. The Supermicro BMC issues, initially inspired by an Nvidia finding, exposed critical flaws in firmware update verification, allowing attackers to gain persistence on the Base Management Controller—the "keys from the castle" in data center environments.

Technical Deep Dive

▶ Watch: EDR evasion by attacking ETW (Event Tracing for Windows) (20:00)

The technical core of the presentation detailed how attackers can leverage firmware vulnerabilities to achieve deep system compromise, focusing on bootkits, EDR evasion, and critical Supermicro BMC vulnerabilities.

Bootkits and EDR Evasion

The speakers outlined the Windows boot process, from UEFI firmware initializing the platform, through the Windows Boot Manager and Windows OS loader, finally yielding control to the kernel. A bootkit running in the UEFI environment aims to inject malicious code at various stages to achieve kernel-level persistence.

Binarly showcased Red Lotus, an open-source bootkit written in Rust, inspired by the infamous Black Lotus. The infection chain proceeds as follows:

1. UEFI Vulnerability Exploitation: An initial firmware vulnerability (e.g., Logofail, Pickafail) provides arbitrary code execution at the UEFI level.
2. Windows Boot Manager Hook: The bootkit loads the Windows Boot Manager into memory, searches for the ImageArchStartBootApplication function using a pattern, and installs a hook.
3. Windows OS Loader Hook: When the first hook triggers, the bootkit searches for two more functions within the Windows OS loader and installs another set of hooks.
4. Rootkit Driver Injection: A buffer is allocated in memory to store a rootkit kernel driver. The bootkit then traverses the list of loaded kernel drivers, finds a victim driver, and patches its entry point to point to the malicious rootkit in memory.
5. Kernel Control: When the Windows kernel initializes the drivers, the patched victim driver's entry point executes, giving the bootkit control over the system kernel. At this point, the bootkit can read and patch specific functions within the kernel. This process often requires a firmware vulnerability combined with a "bring your own vulnerable driver" technique.

Once an attacker gains kernel-level control, they can perform advanced operations, as demonstrated by the capabilities of other rootkits like Abs-Rootkit (open-source on GitHub). These include hiding processes through direct kernel object manipulation, installing key loggers, manipulating network traffic, and hiding folders using mini filter drivers.

A significant implication of kernel control is EDR evasion. Many EDR (Endpoint Detection and Response) solutions rely heavily on ETW (Event Tracing for Windows), a framework that records detailed system information for real-time detection and forensic analysis. With kernel privileges, an attacker can directly interfere with ETW:

• Buffer Manipulation: Mess with the buffers where ETW events are stored.
• Driver Tampering: Attack other drivers that support ETW.
• Fake Event Injection: Inject fake events into the ETW stream. This has dual implications: it can make the EDR believe benign events occurred when they didn't, and it can be used offensively to create distractions. Many cloud-based EDRs have limits on the number of events they can process, so injecting a flood of fake events can create "blind spots" where malicious activity can go undetected.

Supermicro BMC Vulnerabilities

The talk unveiled two new CVEs affecting Supermicro BMCs, critical components that provide out-of-band management for servers in data centers and AI infrastructure. Controlling the BMC is equivalent to holding the "keys from the castle."

Supermicro's BMC firmware update verification process involves parsing the uploaded firmware, concatenating all signed regions, calculating a hash digest over these regions, and then verifying a signed signature using a public key stored on the device. If the signature is valid, the firmware is flashed.

The vulnerabilities revolved around the firmware map (FMAP) based validation. The FMAP table is crucial for parsing firmware, containing entries for each region (e.g., bootloader, kernel, root FS), including its offset, size, and attributes like is_signed. This FMAP is stored in a region called PDB_SEC_A, which is located by scanning the firmware for a specific pattern.

1. Nvidia's Initial Finding: Nvidia's threat research team discovered that by injecting a malicious PDB_SEC_A region before the original one in the uploaded firmware, the pattern matching would find the malicious one first. This allowed attackers to control the FMAP, and by replacing the root_fs entry, they could make the validation pass while booting a malicious root file system.

1. Supermicro Patch 1: Supermicro's initial fix added two constraints: no custom region offsets were allowed in the FMAP (only whitelisted offsets), and constraints were placed on which regions could have the is_signed flag.

1. Binarly Bypass 1 (CVE-202X-XXXX): Binarly found a bypass by taking all original regions from the firmware, concatenating them into a custom malicious BMC image, and then injecting a new fake PDB_SEC_A region with an FMAP containing a single entry representing this entire region. By also moving the bootloader, they could replace it with a malicious one (e.g., modifying the Uboot string).

1. Supermicro Patch 2: Supermicro responded by adding two new constraints: the offset of the processed PDB_SEC_A had to be a specific value, and the FMAP had to contain at least one region representing PDB_SEC_A. Critically, they removed the previous constraints.

1. Binarly Bypass 2 (CVE-202X-XXXX): Due to the removal of the previous constraints, Binarly was able to once again manipulate the FMAP by adding different entries at custom offsets, allowing them to swap the bootloader again.

1. Supermicro Final Patch: This patch introduced a "bunch of constraints" which Binarly believes are "actually enough" to stop the discussed attacks. However, concerns remain:

• RSI keys used to sign the firmware images were not rotated for the tested devices.
• While checks prevent immediate firmware downgrade attacks, this could become an issue in the future.
• For one device, sig_table validation was moved from a trusted execution environment to a library. This significantly escalates the attack surface, as attackers with root privileges on the BMC system could directly tamper with the library to bypass checks.

The talk also briefly mentioned similar problems with sig_table validation, which was bypassed and subsequently patched, with a detailed blog post expected soon.

Demo / Proof of Concept

▶ Watch: Super Micro BMC: Timeline of fixes and bypasses (32:00)

The talk featured two compelling demonstrations that vividly illustrated the severity of the vulnerabilities and attack chains discussed.

Secure Boot Bypass and Red Lotus Bootkit on Windows 11

The first demo showcased a complete compromise chain on an up-to-date Windows 11 machine with Secure Boot enabled. The demonstration began by preparing the environment for a Secure Boot bypass and then initiating a system reboot.

Upon reboot, the Secure Boot bypass successfully executed, printing an asyard string to the console, visually confirming that untrusted code was able to run during the critical boot process, despite Secure Boot being active. Following this, the Red Lotus bootkit initiated its infection chain, setting various hooks within the Windows boot process. The debugger window displayed output from the bootkit, detailing the installation of these hooks.

The final stage of the demo highlighted the rootkit's capabilities: it allowed an unprivileged process to load an untrusted kernel driver (.sys file) from an unprivileged shell. This demonstrated that once the bootkit achieves kernel control, it can fundamentally alter system behavior and bypass core operating system security mechanisms, illustrating the "game over" scenario for EDR and other endpoint protections.

Supermicro BMC Firmware Bypass (Binarly Bypass 2)

The second demonstration focused on the newly disclosed Supermicro BMC vulnerability (Binarly Bypass 2). This demo was performed using the BMC's web interface.

The process involved selecting the malicious BMC firmware image and initiating the upload. The BMC interface then parsed the firmware, displayed a seemingly valid version, and proceeded to load it, indicating that the firmware's integrity checks were successfully bypassed. Crucially, after the firmware was loaded and the BMC rebooted, the output showed that the Uboot string had been modified to "Binarly Research." This modification served as irrefutable proof that Binarly's custom, malicious bootloader had been successfully swapped and executed on the BMC.

The speakers emphasized that gaining control over the Base Management Controller is a "game over" scenario in modern data centers. Such control not only provides persistent access to the BMC itself but also impacts the host OS, potentially allowing an attacker to completely disrupt or control the system in all directions. The demo underscored how seemingly simple inconsistencies in firmware validation can lead to profound security compromises in critical infrastructure.

Defensive Implications

▶ Watch: Demo: Super Micro BMC firmware update bypass in action (40:00)

The findings presented in "Broken Trust" carry significant defensive implications for organizations, particularly those operating enterprise networks and critical infrastructure. Addressing these firmware-level threats requires a multi-faceted approach:

1. Prioritize Firmware Updates: Organizations must treat firmware updates with the same, if not greater, urgency as operating system or application patches. The long patch cycles (up to 16 months) and short support windows demonstrated in the talk mean that vulnerabilities can persist for extended periods. Implement robust patch management processes that include firmware for all devices.
2. Strengthen Secure Boot Implementation: Simply enabling Secure Boot is not enough. Organizations must verify that their systems use strong, rotated Platform Keys (PKs) and that no default or easily guessable passwords (like "ABCD" found in Pickafail) are present. Regularly audit Secure Boot configurations and the integrity of related certificates.
3. Understand the Supply Chain: Be aware that vulnerabilities in upstream components (like EDK2 or IBV code) can "trickle down" and affect diverse OEM devices. Demand greater transparency and faster fixes from vendors for these foundational issues.
4. Robust Device Provisioning and Verification: For critical infrastructure and data centers, implement rigorous device provisioning processes. This includes verifying the integrity of firmware before deployment to detect pre-implanted malicious code, especially for devices like Supermicro servers that are popular and potentially targeted.
5. Rethink EDR and Monitoring: Acknowledge that kernel-level bootkits can effectively bypass traditional EDR solutions by manipulating core OS mechanisms like ETW. Defenders should explore deeper, out-of-band monitoring solutions that are less susceptible to OS-level tampering. Consider hardware-assisted security features and independent integrity checks.
6. Demand Vendor Accountability: Push vendors to adopt more responsible security practices, including faster patch delivery and comprehensive threat modeling that considers "physical attacks" as an in-scope vector for achieving persistence. The industry needs to move beyond simply acknowledging issues to actively implementing sustainable security improvements.
7. Address End-of-Life (EOL) Devices: Develop strategies for managing EOL devices that no longer receive security updates. This may involve accelerated replacement programs, isolating EOL systems, or deploying compensating controls to mitigate known risks.
8. Reduce Code Complexity: Vendors should strive to reduce firmware code complexity, as it often introduces inconsistencies and new attack surfaces during patching, as seen with the Supermicro BMC fixes. Emphasize secure development lifecycle (SDL) practices from the outset.
9. Monitor for Unusual Firmware Activity: Implement monitoring for unauthorized firmware modifications, unexpected reboots, or changes in boot behavior that could indicate a bootkit infection.

By adopting these defensive postures, organizations can begin to build a more resilient security posture against the increasingly sophisticated firmware-level threats impacting modern computing.

Key Takeaways

• Firmware is a Critical, Under-Secured Attack Surface: Despite forming the foundation of trust, firmware often lacks robust mitigations, making exploitation comparatively easy and leading to deep, persistent compromises that can evade traditional EDR.
• Systemic Vulnerabilities Enable Widespread Compromise: Foundational flaws like Logofail (outdated image parsers) and Pickafail (leaked test keys, "ABCD" passwords) are not isolated incidents but represent systemic weaknesses that affect a vast percentage of devices across the entire UEFI supply chain.
• Secure Boot is Often Fragile: Secure Boot, designed to prevent untrusted code execution, is frequently undermined by easily discoverable vulnerabilities, misconfigurations, or compromised keys, rendering it ineffective against determined attackers.
• BMC Vulnerabilities Grant "Keys to the Castle": Flaws in Base Management Controllers (BMCs), such as those found in Supermicro devices, provide attackers with unparalleled persistence and control over critical server infrastructure, including the host OS, making them a prime target for state-sponsored and commodity attackers.
• Kernel-Level Bootkits Evade Modern EDR: Once a bootkit achieves kernel-level control, it can directly manipulate core operating system mechanisms like ETW (Event Tracing for Windows), allowing attackers to create blind spots, inject fake events, and effectively bypass EDR detection.
• Industry Challenges Persist: The firmware ecosystem continues to suffer from growing complexity, slow patch cycles (up to 16 months), short support windows for devices, and insufficient vendor threat modeling, despite some improvements in vulnerability detection.

About the Speaker(s)

Alex Matrosov is the CEO and Founder of Binarly, a company specializing in firmware security. He has a distinguished background in offensive security research, having previously created the offensive security research team at Nvidia. Alex is also a recognized author in the field, known for his book "Rootkits and Bootkits," which underscores his deep expertise in system-level threats and persistent malware.

Fabio Pagani serves as the Vulnerability Research Lead at Binarly. His work focuses on uncovering and analyzing critical security flaws within firmware and related technologies. Together, Alex and Fabio lead Binarly's efforts in identifying and disclosing widespread vulnerabilities that impact the entire computing ecosystem.