# LogoFAIL firmware attack (with link to Insyde's security advisory)

**URL:** <https://community.frame.work/t/logofail-firmware-attack-with-link-to-insydes-security-advisory/41534>\
**Category:** Framework Laptop 13\
**Created:** [December 6, 2023, 5:40pm UTC](https://community.frame.work/t/logofail-firmware-attack-with-link-to-insydes-security-advisory/41534 "2023-12-06T17:40:10Z")\
**Posts on this page:** 1\
**Showing post:** 44

<div class="post-metadata">

**Author:** ![Ray519](https://avatars.discourse-cdn.com/v4/letter/r/5e9695/32.png) [@Ray519](https://community.frame.work/u/Ray519)\
**Post date:** [January 4, 2024, 1:39am UTC](https://community.frame.work/t/logofail-firmware-attack-with-link-to-insydes-security-advisory/41534/44 "2024-01-04T01:39:29Z")

</div>

> [@Simon84](#):
>
> wanted to find out if the Logo is included in the Boot Guard section (Gen12)

See my previous post here, I found it. Did not look to be in a region directly covered by bootguard if I am reading UefiTool correctly. But it might still be covered by transitively. I do not know enough to figure that out easily.

> [@12th Gen Intel Core BIOS 3.06 Beta](http://community.frame.work/t/12th-gen-intel-core-bios-3-06-beta/25726/412):
>
> So we know the bad parsers are in the BIOS. I don’t think we know yet, if the official logo is in a signed section of the BIOS or if it supports any of the hardcoded paths or NVars to silently load a new logo from the ESP. So might still be similar to Dell’s vulnerability (Dell logo is signed, would require another vulnerability to even get to the bad parsers) or full-blown vulnerability from the ESP. Somebody would have to look into the BIOS image to figure out about the builtin logo. Or foll…

I also first found the black image and the TianoCore logo. The rest I found by doing a binary search for magic bytes of various image formats supported by the parsers that are shipped by Insyde. Frameworks Logos and the new diagnostic graphics I found in the AMD bios are mostly PNG.

---

_[View the full topic](https://community.frame.work/t/logofail-firmware-attack-with-link-to-insydes-security-advisory/41534)._
