—————————————————————————————-

If speed matters when it comes to your winnings, don’t settle for slow sites. Explore our expert picks for the fastest payout online casinos that prioritize instant withdrawals, crypto support, and trusted licensing.

LegbaCore will not be accepting any new customer engagements. This website will remain up to continue to serve as a reference for LegbaCore’s past work.

—————————————————————————————-

10-21-2015

Added the Hack in the Box GSEC version of the updated slides for our Thunderstrike 2 joint research with Trammell Hudson to the Research page. These slides disclosed that Apple was still vulnerable to CERT VU#552286 (which was made public at BlackHat in 2014.) The patch is forthcoming in OS X 10.11.1

Added the “BIOS Necromancy” whitepaper to the Research page, describing how the Apple vulnerability to something they didn’t think affected them came to be, and how this is actually a wider UEFI ecosystem issue which we know to affect other vendors’ codebases.

—————————————————————————————-

10-14-2015

Our Creative Commons licensed class slides for our 2 day class “Advanced x86: Introduction to BIOS & SMM” have been posted to OpenSecurityTraining.info.

—————————————————————————————-

8-6-2015

Added the slides and videos for our Thunderstrike 2 joint research with Trammell Hudson to the Research page.

—————————————————————————————-

6-11-2015

Added the How Many Million BIOSes Would you Like to Infect whitepaper to our Research page. This document contains more discussion than was provided in the conference talks of what could be done by live OSes like Tails or LPS to be more secure against firmware threats.

—————————————————————————————-

6-5-2015

Published videos of our demos of LightEater stealing GPG keys, passphrases, and unencrypted emails from Tails, and bricking a Gigabyte motherboard, despite the presence of their “DualUEFI” technology which is explicitly supposed to prevent such attacks.

—————————————————————————————- 5-28-2015

6 days of training syllabi posted to the new Training page (linked to from Services.)

We will be giving training on BIOS security at Hack in the Box GSEC in Singapore, October 12 & 13

Introductory BIOS & SMM Attack & Defense

LegbaCore to speak at BlackHat/Defcon about Mac firmware attacks.

Reminder that the “Understanding x86-64 Assembly for Reverse Engineering and Exploits” training will be given at BlackHat USA 2015. Early registration ends June 5th.

—————————————————————————————-

5-4-2015

RSA presentation “Are you giving firmware attackers a free pass?” posted under Research

—————————————————————————————-

4-14-2015

Posted 2 edited LightEater demo videos:

Remote ASUS BIOS infection using the Venamis vulnerability

Infecting a HP BIOS with physical access

LegbaCore to speak at SummerCon 2015

“x86 Firmware Forensics: First Steps” training to be given at FIRST June 14th 2015

—————————————————————————————-

3-22-2015

CanSecWest presentation “How many million BIOSes would you like to infect?” posted under Research

Legba Lexicon section added, as a quick reference for some of the technologies we care about.

“Understanding x86-64 Assembly for Reverse Engineering and Exploits” training to be given at BlackHat USA 2015. Early registration ends June 5th

—————————————————————————————-

1-30-2015

Rafal Wojtczuk (Bromium) & Corey Kallenberg (LegbaCore)’s joint talk “Attacks on UEFI security, inspired by Darth Venamis’s misery & Speed Racer” has been accepted to CanSecWest 2015!

“Attacking BIOSes with Intel TXT” whitepaper (pdf) posted by Hack in the Box.

“Understanding x86-64 Assembly for Reverse Engineering & Exploits” training will be hosted at Hack in the Box Amsterdam, May 26-27 2015. Early-bird registration ends March 1

—————————————————————————————-

1-28-2015

Video of ShmooCon “Betting BIOS Bugs Won’t Bite Y’er Butt?” presentation posted

—————————————————————————————-

1-22-2015:

We will be giving training on BIOS (in)security at CanSecWest.

Introductory BIOS & SMM Attack & Defense – by Xeno

Advanced BIOS & SMM Attack & Defense – by Corey

Save $300 by registering for both. But hurry and register before prices go up in February!

—————————————————————————————-

1-16-2015:

LegbaCore open for business!

Xeno giving our first talk as LegbaCore at ShmooCon. The talk, “Betting BIOS Bugs Won’t Bite Y’er Butt?” will start at 1800 EDT (UTC-4) and will be available via live stream here

—————————————————————————————-

Papa Legba, hear my call!