PCI option ROMs are ubiquitous on IBM PC-compatible x86 computers, and are used from early boot for initialization. Like the BIOS, option ROMs are a quintessential part of the boot process, but unlike the BIOS, these ROMs can be introduced by external --- potentially unsafe --- devices. The talk explores how potential malicious ROMs can act as rootkits, and steal hardware resources without the host OS' knowledge. Such malicious ROMs can also snoop on the activities of the OS, and interactions with external devices. The talk further explores security introduced with UEFI, how to bypass it, and concludes with how to prevent all such attacks.