Collaborate Disseminate
I recently bought a used SanDisk SSD and I am curious to know if there is any way to assess the integrity of its firmware using information such as SMART or drive details.
In addition to SMART information, SanDisk Dashboard application als… Continue reading Is it possible to assess the integrity of an SSD’s firmware using SMART results or drive details?
I wondered why some ransomwares are mounting the EFI partition on Windows.
It’s happening for most ransomware on Windows (blackcat, lockbit, avoslocker …), and it is only accessible through powershell admin console (and not from the expl… Continue reading Why ransomware are mounting EFI partition [closed]
I was recently added ("tossed" is perhaps a better term) to a project that dabbles in the world of cybersecurity. My employer gave me the task testing a server our company is developing software for, the end use of which will be … Continue reading Resources for learning the fundamental principles of OS hardening (and how to test)
I have a laptop with dual boot (Windows 10, Windows 11) and only windows 10 is encrypted.
My problem is that I get asked for password before being able to choose which Win OS I’ll load. My windows 11 isn’t even encrypted.
I tried using gru… Continue reading Veracrypt asks password twice on boot (Dual boot)?
My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, applications etc. before loading.
When… Continue reading Secure boot after an OTA update confusion
Definitions
Grub is the second stage bootloader often found in Linux distributions.
shim is the first bootloader ran by the ROM firmware. It is signed by Microsoft.
ROM firmware is the code embedded in the hardware which implements the UEF… Continue reading Is grub implementation of secure boot inherently flawed?
If the ISO file for an operating system is malicious, is it possible for it to overwrite UEFI code when booted (If secure boot is disabled)?
When facing a malware situation, the usual “guaranteed solution” is to reinstall your OS. The new developments in malware world will also require you to have a CH341 programmer handy. …read more Continue reading Is That The Moon Worming Its Way Into Your BIOS?
Googleing or just casually browsing this very site one could easily encounter scary stories about malware that gets into firmware of external drives or infects the BIOS.
If someone uses a few years old motherboard that still has BIOS suppo… Continue reading How secure is BIOS nvme sanitization/secure erase
At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41. Continue reading MoonBounce: the dark side of UEFI firmware