Keynote talk by Vijay Sarvepalli, Principal Engineer, CERT division, Software Engineering Institute (SEI), Carnegie Mellon University (CMU), USA
Title: Securing UEFI in the Age of AI: The Forgotten Footholds
Sub-title: Persistence, trust chains, firmware invisibility, and why AI-era infrastructure raises the stakes for platform integrity.
Keywords: UEFI, firmware, chain-of-trust, persistence, AI-era hardware, AI-assisted vulnerability research, invisible attacks, persistence.
Time: 45 minutes plus 15 minutes Q&A
Abstract: UEFI quietly underpins the trust model of modern computing, yet remains one of the least understood and least monitored software layers in the stack. As AI systems increasingly depend on trusted hardware initialization, provisioning, and teardown, firmware becomes an even more attractive foothold for advanced adversaries seeking persistence and invisibility beneath the operating system. This keynote explores enduring UEFI attack surfaces, from chain-of-trust failures to NVRAM misuse, and examines why modern AI-driven security research still struggles to meaningfully analyze firmware ecosystems. The talk concludes with a call to action for both the firmware and AI security communities to better protect the foundations of trusted compute.
Speaker Bio: Vijay Sarvepalli currently serves as Principal Engineer of CERT division of Carnegie Mellon University’s Software Engineering Institute. Vijay is a seasoned professional with extensive expertise in software architecture, cybersecurity, and enterprise systems. As Principal Architect at the CERT Division of CMU’s SEI, he focuses on advancing software architecture practices with a particular emphasis on enhancing cybersecurity.
The URM@SPLASH/ISSTA Lunch brings together all who are under-represented within the SIGPLAN community. This lunch is explicitly intended to be a “big tent” event and is open to all who are under-represented in the community, with a special emphasis on those who are not already served by a dedicated SPLASH/ISSTA DEI event.