AI
Threat Hunting for Vulnerable Signed Artifacts
The researchers used VirusTotal retro hunt with rules targeting import functions like physical memory access and kernel rewrite. A custom script queried the Microsoft catalog for specific strings, downloading matching CAB files. One retro hunt returned 4,000 results; another returned 10,000. They also filtered by certificate, searching for “Microsoft Windows UEFI Driver Publisher” and “Microsoft Operation UEFI CA 2011” to find legitimately signed candidates for exploitation.
UEFI Architecture and the Pre-Boot Attack Window
When a computer powers on, UEFI firmware runs before Windows, before any EDR or antivirus software. The DXE phase loads EFI modules. After initialization, UEFI hands off to the bootloader, on Windows usually bootmgfw.efi or bootmgr.efi. Everything executing before ExitBootServices runs outside the reach of most security tools. Placing a signed EFI binary in the boot path lets an attacker intercept and redirect execution before the OS can respond.
Shield Loader Internals and Secure Boot Gaps
Reboot Restore’s main UEFI binary, shield loader, runs in place of the Windows bootloader. The researchers reverse-engineered its four phases: reading a proprietary EF format from the ESP, decompressing chunks, checking an 800-byte trailer signature, then calling LoadImage. But shield manager, the component that shield loader itself loads, skips signature verification entirely. Any EFI binary dropped as shield.efi on the ESP partition runs without checks. Several shield loader versions have hashes not yet in Microsoft’s DBX revocation list.
WPBT Abuse for Firmware-Level Persistence
WPBT (Windows Platform Binary Table) lets firmware place a native application into C:\Windows\System32, running in the session manager context before any user logs in. A signed Lenovo binary reads a proprietary ACPI table called LUFT and installs whatever driver it finds embedded there. The researchers constructed a fake LUFT table carrying hald.sys, a vulnerable unsigned driver, then overwrote an SRAT table header with a WPBT header to trigger the Lenovo application at boot. It installs hald.sys and registers the service automatically.
Huawei AI Service Driver as a Kernel Rootkit Primitive
A signed Huawei AI service driver registers process creation callbacks and OB callbacks that strip PROCESS_TERMINATE rights from protected processes. The driver persists in memory even after the Huawei software is uninstalled. Its device object accepts IOCTL commands from any userland process with no signature check and no identity validation. Sending one IOCTL with a process path protects that process from termination. If the process dies, the driver restarts it by injecting an APC into services.exe to run a hidden command.
Full Kill Chain Demo Against a Live EDR
The proof of concept deployed a service called “hell” that established a reverse shell and opened a popup reading “hello 33”. Task Manager returned access denied when attempting to kill it. The Huawei driver had stripped the required privileges. A second variant used a different Huawei driver to call ZwTerminateProcess directly from kernel mode, killing EDR and antivirus processes without generating any alerts. The EDR ran at its highest enforcement level throughout. No alerts appeared in the console or event logs.
Notable Quotes
will be loaded and run without checks. Alejandro “0xedh” Hernando · ▶ 15:29
from an offensive viewpoint is perfect. Borja “borjmz” Martinez · ▶ 35:16
The design is fundamentality broken. Borja “borjmz” Martinez · ▶ 36:33
Key Takeaways
- Signed UEFI bootloaders with exploitable flaws can bypass Secure Boot when their hashes remain absent from the DBX revocation list.
- The Lenovo WPBT path lets an attacker install a kernel driver from the pre-boot environment using only signed components.
- The Huawei AI service driver creates a kernel-mode rootkit primitive accessible from userland with zero authentication.
About the Speaker(s)
Alejandro “0xedh” Hernando is a Red Team Operator and Security Researcher with over ten years of experience in offensive cybersecurity. His work spans vulnerability assessment, exploit development, offensive and defensive tooling, and in-depth security research on commercial and proprietary solutions.
Borja “borjmz” Martinez is a self-taught security specialist with more than nine years of experience in pentesting, red team operations, and research. He is also a CTF competitor, formerly active on the ED20 team.