Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

Intel Firmware Attack and Defense

OpenSecurityTraining2 via YouTube

Overview

Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Explore Intel firmware security through this comprehensive 8.5-hour course covering attack vectors and defense mechanisms in x86 system firmware. Begin with fundamental concepts including processor reset states, real mode operations, and the reset vector walkthrough, then progress through chipset architecture evolution and device identification techniques. Master input/output operations including memory-mapped I/O (MMIO) and port I/O access methods, followed by detailed PCIe configuration space manipulation and Option ROM (OROM) attack methodologies. Dive deep into SPI flash memory architecture, examining the programming interface, flash descriptor regions, and protection mechanisms including Protected Range Registers (PRRs) and FLOCKDN controls. Learn about System Management Mode (SMM) operations, SMRAM memory regions including CSEG and TSEG protection, and various SMM-based attack techniques such as caching attacks, remapping vulnerabilities, call-out exploits, confused deputy attacks, and Time-of-Check-Time-of-Use (TOCTOU) conditions. Investigate power transition vulnerabilities during ACPI sleep states and the circumvention of security locks including BLE, FLOCKDN, and D_LCK protections. Conclude with boot process security considerations and practical defense strategies, supported by optional hands-on laboratories for BIOS decoding, BAR manipulation, and flash descriptor analysis using real hardware examples.

Syllabus

Arch4001 Intel Firmware Attack & Defense: 00 Intro 00 Intro
Arch4001 Intel Firmware Attack & Defense: 00 Intro 01 Attacker Motivation
Arch4001 Intel Firmware Attack & Defense: 01 Reset Vector 01 Intro 01 Real Mode Intro
Arch4001 Intel Firmware Attack & Defense: 01 Reset Vector 01 Intro 1.5 Reset Vector Walkthrough
Arch4001 Intel Firmware Attack & Defense: 01 Reset Vector 01 Intro 02 Processor Reset State GP Regs
Arch4001 Intel Firmware Attack & Defense: 01 Reset Vector 01 Intro 03 Optional BIOS Decode Lab
Arch4001 Intel Firmware Attack & Defense: 01 Reset Vector 01 Intro 04 Processor Reset State 2 CRs
Arch4001 Intel Firmware Attack & Defense: 01 Reset Vector 01 Intro 05 Real Mode Segmentation
Arch4001 Intel Firmware Attack & Defense: 02 Chipsets 01 Architectural Evolution
Arch4001 Intel Firmware Attack & Defense: 02 Chipsets 02 Which Data Sheet Matters
Arch4001 Intel Firmware Attack & Defense: 02 Chipsets 03 LPC DeviceID Lookup
Arch4001 Intel Firmware Attack & Defense: 02 Chipsets 04 DRAM Controller DeviceID Lookup
Arch4001 Intel Firmware Attack & Defense: 02 Chipsets 05 Conclusion
Arch4001 Intel Firmware Attack & Defense: 02 Chipsets 06 Optional Lab: BIOS Decode Enable
Arch4001 03 Input Output 01 MMIO 01 Overview
Arch4001 03 Input Output 01 MMIO 02 What Does It Mean To Be Memory Mapped
Arch4001 03 Input Output 02 Port IO 01 Intro
Arch4001 Intel Firmware Attack & Defense: 03 Input Output 02 Port IO 02 Fixed IO Ports
Arch4001 Intel Firmware Attack & Defense: 03 Input Output 02 Port IO 03 Variable IO Ports
Arch4001 03 Input Output 02 Port IO 04 Port Access Styles
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 01 Legacy PCI Intro
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 02 Legacy PCI 3 Address Spaces
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 03 PCIe vs. PCI Differences
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 04 Port IO Config Access
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 05 Config Space Header
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 06 BARs
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 07 Lab Mess With BARs
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 07 Lab Mess With BARs 2 Optiplex Example
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 08 RCRBBA Lookup
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 09 PCIEXBAR MMIO
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 10 Conclusion
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 01 Intro 11 Optional Lab: BDE Reloaded
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 02 OROM 01 Attack History
Arch4001 Intel Firmware Attack & Defense: 04 PCIe 02 OROM 02 How OROMs Work
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 01 Intro
Arch4001 05 SPI Flash 02 Programming Interface 01 Finding SPIBAR
Arch4001 05 SPI Flash 02 Programming Interface 02 Detailed Register View
Arch4001 05 SPI Flash 02 Programming Interface 03 Animated Register Setting Sequence
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 01 Flash Layout Overview
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 02 Optional Flash Descriptor Regions
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 03 Optional Flash Descriptor Sections
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 04 Optional Nitty Gritty 1
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 05 Optional Nitty Gritty 2
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 06 Optional Nitty Gritty 3
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 07 Optional Nitty Gritty 4
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 08 Optional Nitty Gritty 5
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 09 Optional Nitty Gritty 6
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 10 Optional Nitty Gritty 7
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 03 Descriptor 11 Optional Gritty Gang
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 01 PRRs
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 02 FLOCKDN
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 03 Other Attacks
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 04 BIOSWE and BLE
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 05 SMI Suppression 1
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 06 SMI Suppression 2
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 07 SMI Suppression 3
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 08 Speed Racer
Arch4001 Intel Firmware Attack & Defense: 05 SPI Flash 04 Protection 09 Physical Attacks
Arch4001 Intel Firmware Attack & Defense: 06 SMM 01 Intro 01 SMM Intro
Arch4001 Intel Firmware Attack & Defense: 06 SMM 01 Intro 02 SMI Source 1 BLE
Arch4001 Intel Firmware Attack & Defense: 06 SMM 01 Intro 03 SMI Status Flags
Arch4001 06 SMM 01 Intro 04 SMI Source 2 0xB2
Arch4001 06 SMM 01 Intro 05 SMI Source3 FSMIE
Arch4001 06 SMM 01 Intro 06 SMI Source 4 Periodic SMI
Arch4001 Intel Firmware Attack & Defense: 06 SMM 01 Intro 07 MSR SMI COUNT
Arch4001 Intel Firmware Attack & Defense: 06 SMM 01 Intro 08 Final Entry Exit Summary
Arch4001 Intel Firmware Attack & Defense: 06 SMM 02 SMRAM 01 Intro
Arch4001 Intel Firmware Attack & Defense: 06 SMM 02 SMRAM 02 CSEG
Arch4001 Intel Firmware Attack & Defense: 06 SMM 02 SMRAM 03 Protecting CSEG
Arch4001 Intel Firmware Attack & Defense: 06 SMM 02 SMRAM 04 TSEG
Arch4001 Intel Firmware Attack & Defense: 06 SMM 03 SMM Attacks 01 Caching
Arch4001 Intel Firmware Attack & Defense: 06 SMM 03 SMM Attacks 02 Remapping
Arch4001 Intel Firmware Attack & Defense: 06 SMM 03 SMM Attacks 03 Call-Outs
Arch4001 Intel Firmware Attack & Defense: 06 SMM 03 SMM Attacks 04 Confused Deputy
Arch4001 Intel Firmware Attack & Defense: 06 SMM 03 SMM Attacks 05 TOCTOU
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 01 Intro 01 Intro
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 01 Intro 02 ACPI Sleep
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 01 Intro 03 Lock Around The BLE
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 01 Intro 04 Lock Around The FLOCKDN
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 01 Intro 05 Lock Around The D_LCK
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 01 Intro 06 Lock Around The Others
Arch4001 Intel Firmware Attack & Defense: 07 Power Transition 02 Attacks
Arch4001 Intel Firmware Attack & Defense: 08 Boot 01
Arch4001 Intel Firmware Attack & Defense: 09 Conclusion

Taught by

OpenSecurityTraining2

Reviews

Start your review of Intel Firmware Attack and Defense

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.