It's been hacked before, too, see: https://defcon.org/images/defcon-22/dc-22-presentations/Kallenberg/DEFCON-22-Corey-Kallenberg-Extreme-Privilage-Escalation.p

It's been hacked before, too, see: https://defcon.org/images/defcon-22/dc-22-presentations/Kallenberg/DEFCON-22-Corey-Kallenberg-Extreme-Privilage-Escalation.pdf https://defcon.org/images/defcon-22/dc-22-presentations/Kall... and http://legbacore.com/Research_files/HowManyMillionBIOSWouldYouLikeToInfect_Full.pdf http://legbacore.com/Research_files/HowManyMillionBIOSWouldY... The example in the first link is especially depressing, because they found an integer overflow vulnerability in a code file that started with this warning comment: /* Caution: This module requires additional review when modified. This driver will have external input − capsule image. This external input must be validated carefully to avoid security issue like buffer overflow, integer overflow. */ And of course, later someone came along and added an integer overflow.