bugtraq - Re: Windows Platform Binary Table (WPBT)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 13 Aug 2015 21:41:53 GMT
From: simon@...gewell.org
To: bugtraq@...urityfocus.com
Subject: Re: Windows Platform Binary Table (WPBT) - BIOS PE backdoor

In reading the WPBT document from MS I think I see another problem; namely that the WPBT table can contain a 'command line' which is not signed (only checksum of table).

So on the assumption that you can insert the table into ACPI list that the BIOS present to OS (maybe with a flashed PCI perpheral), you could use a 'borrowed' signed app and control it with the command line.

I'd be interested in analysing the WPBT table or Lenovo's autochk/wpbbin exes.
Simon.