Bringing Forensic Readiness to Modern Computer Firmware
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866912367276720128 |
|---|---|
| author | Latzo, Tobias Hantke, Florian Kotschi, Lukas Freiling, Felix |
| author_facet | Latzo, Tobias Hantke, Florian Kotschi, Lukas Freiling, Felix |
| contents | Today's computer systems come with a pre-installed tiny operating system, which is also known as UEFI. UEFI has slowly displaced the former legacy PC-BIOS while the main task has not changed: It is responsible for booting the actual operating system. However, features like the network stack make it also useful for other applications. This paper introduces UEberForensIcs, a UEFI application that makes it easy to acquire memory from the firmware, similar to the well-known cold boot attacks. There is even UEFI code called by the operating system during runtime, and we demonstrate how to utilize this for forensic purposes. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2505_05697 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Bringing Forensic Readiness to Modern Computer Firmware Latzo, Tobias Hantke, Florian Kotschi, Lukas Freiling, Felix Cryptography and Security Today's computer systems come with a pre-installed tiny operating system, which is also known as UEFI. UEFI has slowly displaced the former legacy PC-BIOS while the main task has not changed: It is responsible for booting the actual operating system. However, features like the network stack make it also useful for other applications. This paper introduces UEberForensIcs, a UEFI application that makes it easy to acquire memory from the firmware, similar to the well-known cold boot attacks. There is even UEFI code called by the operating system during runtime, and we demonstrate how to utilize this for forensic purposes. |
| title | Bringing Forensic Readiness to Modern Computer Firmware |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2505.05697 |