DEF CON 33 - Kill Chain Reloaded: Abuse legacy paths fr stealth persistence - A Hernando, B Martinez

The talk demonstrates how attackers can abuse legitimate signed but vulnerable software components to achieve stealth persistence on systems, bypassing security measures like Secure Boot 1:16. The researchers present techniques for exploiting UEFI vulnerabilities and signed drivers to maintain persistent access while evading detection.

Key Takeaways:
• Secure Boot has significant limitations as it will load vulnerable binaries even if they're compromised, especially if not properly updated in the DBX revocation list 2:16
• The researchers found vulnerable UEFI components like shield loader that allow loading unsigned EFI binaries, enabling pre-boot attacks 9:23
• They demonstrate bypassing both Secure Boot and BitLocker by exploiting a vulnerable signed UEFI application and manipulating the Windows Platform Binary Table 18:02
• Signed vulnerable drivers from major vendors can be exploited to gain kernel-level access and protect malicious processes from termination 35:24
• These techniques enable complete system compromise with stealth persistence while evading EDR solutions 41:35

The research highlights how the most effective offensive techniques don't rely on traditional malware but instead re-purpose legitimate signed components, making detection and removal significantly more challenging 42:25.

Sources:

• 1:16 Overview of bootkits and UEFI vulnerabilities
• 2:16 Secure Boot limitations explained
• 9:23 Vulnerable UEFI compon