Ulf Frisk
blog.frizk.net · Personal blog · on HN since 2016
Ulf Frisk is a security researcher who builds the PCILeech DMA attack tool and writes about UEFI, kernel, and hardware attacks.
What HN saysHN links his posts on DMA attacks, UEFI attack surface, and the PCILeech file system, with commenters discussing Secure Boot and compatible FPGA hardware.
17HN people shared it
3linked it in comments
15stories submitted
884story points
2 years agolast shared
2016people per year2026
Most-shared posts
- 1Total Meltdown?4 people · 11 points · first shared 2018 · discussion on HN
- 2Attacking UEFI Runtime Services and Linux3 people · 3 points · first shared 2017 · discussion on HN
- 3MacOS FileVault2 Password Retrieval2 people · 282 points · first shared 2016 · 83 comments on HN
- 4Modifying the Acorn CLE-215 FPGA into a PCILeech DMA Attack Device2 people · 36 points · first shared 2021 · 3 comments on HN
- 5Introducing the Memory Process File System for PCILeech2 people · 1 points · first shared 2018 · discussion on HN
- 6Windows 7 patch for Meltdown enabled arbitrary reads and writes in kernel memory1 people · 545 points · first shared 2018 · 215 comments on HN
- 7MacOS FileVault2 Password Retrieval1 people · 2 points · first shared 2016 · discussion on HN
- 8Attacking UEFI (2017)1 people · 2 points · first shared 2024 · discussion on HN
- 9Windows 10 KASLR Recovery with TSX1 people · 1 points · first shared 2016 · discussion on HN
- 10DMA attacking over USB-C and Thunderbolt 31 people · 1 points · first shared 2016 · discussion on HN
What HN people wrote when they linked it
mjg59 · 2022-03-13
A few thoughts: yes, UEFI is a large attack surface. Secure Boot mitigates a lot of that - if it's turned on, the vast majority of UEFI functionality is only accessible to signed binaries. If you're running untrustworthy code in your boot environment then it's already in a position to just overwrite the firmware, there's no memory protection here. But UEFI doesn't entirely go away after the OS boots, there's some number of runtime services left that the OS depends on. http://blog.frizk.net/2017/01/attacking-uefi-and-linux.html is a demonstration that if you're able to modify those then you can compromise the OS. There's also, of course, all the code in SMM which can just do whatever and may have been audited but possibly hasn't been.
But honestly overall BIOS was a bigger concern than UEFI. It's easy to forget, but a lot of the BIOS hooks are still available at runtime - https://github.com/mqudsi/lrmi is an interface that lets you call them from Linux. It's reasonable to worry about the attack surface exposed by UEFI runtime services, but BIOS software interrupts are frankly even weirder. The reason we largely didn't worry about them is that you normally have to be root to call them, which is also the case for UEFI runtime services and most SMM interfaces. And SMM definitely predates UEFI, so getting away from UEFI complexity wouldn't save us there.
And there's been plenty of meaningful security work done in the UEFI space lately. There's support for proper IOMMU setup so…
floatingatoll · 2020-02-25
Two related links previously on HN (no comments):
Introducing the Memory Process File System for PCILeech
http://blog.frizk.net/2018/03/memory-process-file-system.html
Using your BMC as a DMA device: Plugging PCILeech to HPE ILO 4
https://www.synacktiv.com/posts/exploit/using-your-bmc-as-a-dma-device…
transpute · 2022-07-22
Crypto-surplus hardware with same FPGA, https://www.hivelist.org/@apshamilton/acorn-215-xilinx-artix-7-200t-fp… & https://www.eevblog.com/forum/fpga/sqrl-acorn-as-an-interesting-artix-…
Artix-7 is supported by LiteX, an open-source toolchain based on reverse engineering of Xilinx bitstream, https://github.com/enjoy-digital/litex & https://antmicro.com/blog/2020/05/multicore-vex-in-litex/
These can be used for PCILeech DMA attacks/testing, http://blog.frizk.net/2021/10/acorn.html