Over the past year, a number of BIOS security issues have come to light. And more are yet to come as we have disclosed a number of issues to a number of vendors and are awaiting their remediation. In our previous ³Defeating Signed BIOS Enforcement² talk, we discussed how some vendors¹ BIOS protections can be bypassed by an attacker who can get into SMM, e.g. through the architectural flaw of CPU cache poisoning. In this talk we with discuss a related but new security issue that also leads to the bypass of access controls on an SPI flash chip. This can lead to the attacker reflashing the BIOS with embedded malicious code, or bricking the system. This talk provides further evidence of why BIOS vendors need to make use of protected region registers to properly access control the BIOS, and why those that don¹t will continue to find themselves vulnerable to attacks. We will be releasing a new version of our free Copernicus BIOS checking tool that will allow you to determine if your BIOS vendor has not properly configured the system, and therefore your BIOS is vulnerable to being written to.