Your modern computer is a matryoshka doll of computers, computers inside computers, and it’s also turtles all the way down. This impacts all kinds of weird things, like how you handle laptops or how scared or comfortable you should be with cloud computing.UEFI is a spec defining interactions between low-level computer firmware (the stuff you think of as your BIOS) and all the other computers in their little computer village. Technically, UEFI runs on your normal processor, but at runtime it shares the processor with your OS, and for most purposes you can think of it as a co-processor running in parallel.The BMC is an actual co-processor (often ARM-based, or SH4 on older servers) that allows you to manage the server remotely. It has multiple devices exposed to the host, web servers, and lots of complex, network services running as root.In this talk, we’ll cover the attack surface of these two components on modern systems, how to assess them if you are so inclined, and how they should inform your decisions when planning data center deployments and cloud server usage. We’ll release initial versions of Binary Ninja plugins we’ve been working on at Atredis, bringing UEFI coverage to the new platform and its hot MLIL, and who knows, we might drop 0day or a post exploitation framework if we get around to it.