Technology Videos

Black Hat USA 2025 | Shade BIOS: Unleashing the Full Stealth of UEFI Malware

At Black Hat USA 2025, Kazuk Kimatsu of FFR Security presented “Shade BIOS,” a method for extending UEFI firmware functionality into runtime to create fully stealthy BIOS‑level malware. He explained that today’s UEFI bootkits and SMM backdoors are limited by either OS dependence—requiring driver hooks and updates for each OS version—or hardware dependence, needing device‑specific code. With platform protections such as SMM isolation, many existing approaches are losing effectiveness. Kimatsu demonstrated how retaining EFI boot‑service regions as runtime services, by hooking the GetMemoryMap call and reclassifying them, allows the firmware to stay resident after the OS loads. He also described solutions for memory allocation, identity‑mapped paging, variable handling, and device reinitialization, citing examples like Dell PowerEdge and HP ProLiant backdoors that previously suffered from narrow target scopes. If adopted, Shade BIOS could enable pure firmware malware that operates independently of OS defenses and without needing device‑specific drivers, raising the threat level for national‑security systems and cloud providers and prompting a reassessment of firmware‑level security controls.