The HackingTeam, Snowden, Shadow Brokers, and Vault7 leaks have revealed that UEFI/BIOS implants aren't just a theoretical concept but have actually been weaponized by nation states to conduct cyber espionage. Physical access requirements are a thing of the past, these low level implants can be installed remotely by exploiting vulnerabilities in the underlying UEFI system.

Today at BlackHat Asia 2017, we are disclosing two vulnerabilities in two different models of the GIGABYTE BRIX platform:

GB-BSi7H-6500 – firmware version: vF6 (2016/05/18)

GB-BXi7-5775 – firmware version: vF2 (2016/07/19)

Sauce:

https://www.slideshare.net/SallyFeller/uefi-firmware-rootkits-myths-and-reality