A Tale of One Software Bypass of Windows 8 Secure Boot. Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk
|
|
|
- Buck Bruce
- 7 years ago
- Views:
Transcription
1 A Tale of One Software Bypass of Windows 8 Secure Boot Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk
2 and Bootkits Windows 8 Secure Boot Attacking Secure Boot Recommendations Agenda
3 and Bootkits
4 OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Unified Extensible Firmware Interface ()
5 OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Unified Extensible Firmware Interface ()
6 Industry Standard Interface Between Firmware & OS Processor Architecture and OS Independent C Development Environment (EDK2/UDK) Rich GUI Pre-Boot Application Environment Includes Modular Driver Model Unified Extensible Firmware Interface ()
7 Malware OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Bootkits
8 Malware OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Bootkits
9 Replacing Windows Boot Manager EFI System Partition (ESP) on Fixed Drive ESP\EFI\Microsoft\Boot\bootmgfw.efi technology: say hello to the Windows 8 bootkit! by ITSEC Replacing Fallback Boot Loader ESP\EFI\Boot\bootx64.efi and Dreamboot by Sébastien Kaczmarek, QUARKSLAB Adding New Boot Loader (bootkit.efi) Modified BootOrder / Boot#### EFI variables Bootkits
10 Malware OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Bootkits
11 Adding/Replacing DXE Driver Stored on Fixed Drive Not embedded in Firmware Volume (FV) in ROM Modified DriverOrder + Driver#### EFI variables Bootkits
12 Malware OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Bootkits
13 Patching Option ROM DXE Driver in Add-On Card (Network, Storage..) Non-Embedded in FV in ROM Mac EFI Rootkits Black Hat USA 2012 Bootkits
14 Replacing OS Loaders (winload.efi, winresume.efi) Patching GUID Partition Table (GPT) Bootkits
15 Malware OS Kernel / Drivers OS Loaders OROM DXE Driver Boot Loader OROM DXE Driver Bootx64.efi Bootmgfw.efi HDD DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Bootkits
16 OS Boot Is Trivially Subverted
17 Replacing legacy OS boot with boot will also replace legacy M/VBR bootkits with bootkits. So can bootkit problem be fixed?
18 Windows 8 Secure Boot
19 DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics System Firmware and NVRAM Are in ROM
20 Signed BIOS Update DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Firmware Relies on Secure Update
21 Signed BIOS Update OROM OROM DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics DXE Verifies Non-Embedded OROMs
22 Signed BIOS Update OROM OROM DXE Driver DXE Driver DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics DXE Verifies Non-Embedded DXE Drivers
23 Signed BIOS Update OROM OROM App App DXE Driver DXE Driver DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics DXE Core Verifies Applications
24 Signed BIOS Update OROM App DXE Driver Boot Loader OROM App DXE Driver Bootx64.efi Bootmgfw.efi DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics DXE Core Verifies Boot Loader(s)
25 Signed BIOS Update OROM OROM App App DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi Secure Boot DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Secure Boot
26 Signed BIOS Update OS Loaders (winload.efi, winresume.efi) OROM OROM App App DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi Secure Boot DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Boot Loader Verifies OS Loader
27 Signed BIOS Update OS Kernel / Early Launch Anti-Malware (ELAM) OS Loaders (winload.efi, winresume.efi) OROM OROM App App DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi Secure Boot DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics OS Loader Verifies OS Kernel
28 Signed BIOS Update OS Driver OS Driver OS Kernel / Early Launch Anti-Malware (ELAM) OS Loaders (winload.efi, winresume.efi) OROM OROM App App DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi Secure Boot DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics OS Kernel Verifies OS Device Drivers
29 Signed BIOS Update OS Driver OS Driver OS Kernel / Early Launch Anti-Malware (ELAM) OS Loaders (winload.efi, winresume.efi) Windows 8 Secure Boot OROM OROM App App DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi Secure Boot DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Windows 8 Secure Boot
30 Platform Key (PK) Verifies KEKs Platform Vendor s Cert Key Exchange Keys (KEKs) Verify db and dbx Earlier rev s: verifies image signatures Authorized Database (db) Forbidden Database (dbx) X509 Certificates, image SHA1/SHA256 hashes of allowed and revoked images Earlier rev s: RSA-2048 public keys, PKCS#7 Signatures Secure Boot Keys
31 Non-Volatile (NV) Stored in SPI Flash based NVRAM Boot Service (BS) Accessible to DXE drivers / Boot Loaders at boot time Run-Time (RT) Accessible to the OS through run-time SetVariable/GetVariable API Time-Based Authenticated Write Access Signed with time-stamp (anti-replay) PK cert verifies PK/KEK update KEK verifies db/dbx update certdb verifies general authenticated EFI variable updates Secure Boot Key Protections
32 Certificate: Data: Version: 3 (0x2) Serial Number: 53:41:e0:15:c4:3a:f8:a8:48:36:b9:a5:ff:69:14:88 Signature Algorithm: sha256withrsaencryption Issuer: CN=ASUSTeK MotherBoard PK Certificate Validity Not Before: Dec 26 23:34: GMT Not After : Dec 26 23:34: GMT Subject: CN=ASUSTeK MotherBoard PK Certificate Subject Public Key Info: Public Key Algorithm: rsaencryption Public-Key: (2048 bit) Modulus: 00:d9:84:15:36:c5:d4:ce:8a:a1:56:16:a0:e8:74:... Exponent: (0x10001) X509v3 extensions: :?=.../0-1+0)..U..."ASUSTeK MotherBoard PK Certificate..SA...:..H6...i.. Signature Algorithm: sha256withrsaencryption 73:27:1a:32:88:0e:db:13:8d:f5:7e:fc:94:f2:1a:27:6b:c2: BEGIN CERTIFICATE----- MIIDRjCCAi6gAwIBAgIQU0HgFcQ6+KhINrml/2kUiDANBgkqhkiG9w0BAQsFADAt END CERTIFICATE----- PK (openssl x509 -in PK.pem text)
33 SecureBoot Enables/disables image signature checks SetupMode PK is installed (USER_MODE) or not (SETUP_MODE) SETUP_MODE allows updating KEK/db(x), self-signed PK CustomMode Modifiable by physically present user Allows updating KEK/db/dbx/PK even when PK is installed SecureBootEnable Global non-volatile Secure Boot Enable Modifiable by physically present user Secure Boot Configuration
34 PK variable exists in NVRAM? Yes. Set SetupMode to USER_MODE No. Set SetupMode to SETUP_MODE SecureBootEnable variable exists in NVRAM? Yes No SecureBootEnable is SECURE_BOOT_ENABLE and SetupMode is USER_MODE? Set SecureBoot to ENABLE Else? Set SecureBoot to DISABLE SetupMode is USER_MODE? Set SecureBoot to ENABLE SetupMode is SETUP_MODE? Set SecureBoot to DISABLE Dependencies (AutenticatedVariableService)
35 DxeImageVerificationLib defines policies applied to different types of images and on security violation IMAGE_FROM_FV (ALWAYS_EXECUTE), IMAGE_FROM_FIXED_MEDIA, IMAGE_FROM_REMOVABLE_MEDIA, IMAGE_FROM_OPTION_ROM ALWAYS_EXECUTE, NEVER_EXECUTE, ALLOW_EXECUTE_ON_SECURITY_VIOLATION DEFER_EXECUTE_ON_SECURITY_VIOLATION DENY_EXECUTE_ON_SECURITY_VIOLATION QUERY_USER_ON_SECURITY_VIOLATION Image Verification Policies
36 Let s have a look at the Secure Boot image verification process SecurityPkg\Library\DxeImageVerificationLib
37 Image Verification Policy? (IMAGE_FROM_FV) ALWAYS_EXECUTE? EFI_SUCCESS NEVER_EXECUTE? EFI_ACCESS_DENIED Image Verification (Policies)
38 SecureBoot EFI variable doesn t exist or equals to SECURE_BOOT_MODE_DISABLE? EFI_SUCCESS File is not valid PE/COFF image? EFI_ACCESS_DENIED SecureBootEnable NV EFI variable doesn t exist or equals to SECURE_BOOT_DISABLE? EFI_SUCCESS SetupMode NV EFI variable doesn t exist or equals to SETUP_MODE? EFI_SUCCESS Image Verification (Configuration)
39 Image signed? No Yes Image SHA256 hash in dbx? EFI_ACCESS_DENIED Image SHA256 hash in db? EFI_SUCCESS For each signature in PE file: Signature verified by root/intermediate cert in dbx? EFI_ACCESS_DENIED Image hash in dbx? EFI_ACCESS_DENIED For each signature in PE file: Signature verified by root/intermediate cert in db? EFI_SUCCESS Image hash in db? EFI_SUCCESS EFI_ACCESS_DENIED Image Verification (Crypto)
40 Secure Boot in Action
41 Windows 8/ Secure Boot is pretty important protection from boot malware!
42 Attacking Windows 8 Secure Boot
43 Just turn it off in the BIOS setup screen ;)
44 Just to be clear, the issues are in the implementation of Secure Boot and required firmware protections on certain platforms
45 We think Windows 8 Secure Boot looks like this Or more like this Windows 8 Secure Boot (Microsoft) Windows 8 Secure Boot Secure Boot ()
46 How exciting! But still not close BIOS Vendor 2 Secure Boot BIOS Vendor 1 Secure Boot BIOS Vendor 3 Secure Boot
47 Platform Vendor1 Platform Vendor4 Platform Vendor3 Platform Vendor N Platform Vendor2 Platform Vendor5 The Reality Is Much More Exciting
48 Windows 8 Secure Boot is only secure when ALL platform/bios vendors do a couple of things correctly
49 Allow signed firmware updates only Protect firmware in SPI flash from direct modification Protect firmware update components (inside SMM or DXE on reboot) Program SPI controller and flash descriptor securely Protect SecureBootEnable/CustomMode/PK/KEK/db(x) in NVRAM Implement VariableAuthenticated in SMM and physical presence checks Protect SetVariable runtime API Securely disable Compatibility Support Module (CSM), unsigned legacy Option ROMs and MBR boot loaders Configure secure image verification policies (no ALLOW_EXECUTE) Build platform firmware using latest /EDK sources Correctly implement signature verification and crypto functionality And don t introduce a single bug in all of this
50 System.Fundamentals.Firmware.SecureBoot 3 When Secure Boot is Enabled, CSM must NOT be loaded 7 Secure Boot must be rooted in a protected or ROM-based Public Key 8 Secure firmware update process 9 Signed Firmware Code Integrity Check 14 No in-line mechanism is provided whereby a user can bypass Secure Boot failures and boot anyway Windows 8 Secure Boot Requirements
51
52 What If BIOS Updates Are Not Signed?
53 Signed BIOS Update OS Driver OS Kernel OS Loaders OS Driver DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics When Firmware Updates Are Not Signed
54 No luck firmware update capsules are signed RSA-PSS 2048 / SHA-256 / e=f 4 Wait, let s check one little thing
55 Can We Write to Firmware in ROM?
56 So firmware updates are signed but firmware is directly writeable in SPI flash? So is NVRAM with EFI variables. Hmm What could go wrong? Hint: Malware could patch DXE Image Verification driver in ROM or it could change persistent Secure Boot keys/configuration in NVRAM
57 Signed BIOS Update OS Driver OS Kernel OS Loaders OS Exploit DXE Driver DXE Driver Boot Loader Bootx64.efi Bootmgfw.efi DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics When Firmware Is Not Protected in ROM
58 Signed BIOS Update OS Driver OS Kernel OS Loaders OS Exploit DXE Driver DXE Driver Modify Secure Boot FW or config in ROM Boot Loader Bootx64.efi Bootmgfw.efi DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Malware Modifies Firmware in ROM (directly programming SPI controller)
59 Signed BIOS Update OS Driver OS Kernel OS Loaders OS Exploit Install Bootkit DXE Driver DXE Driver Bootkit DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Then Installs Bootkit
60 Signed BIOS Update OS Driver OS Kernel OS Loaders OS Exploit DXE Driver DXE Driver Bootkit DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Firmware Doesn t Enforce Secure Boot
61 Signed BIOS Update OS Driver OS Kernel OS Loaders OS Exploit DXE Driver DXE Driver Bootkit DXE Core / Dispatcher System Firmware (SEC/PEI) Hardware I/O Memory Network Graphics Bootkit Now Patches OS Loaders/Kernel
62 Patch DXE ImageVerificationLib driver code Differ from one platform/vendor to another Different versions of EDK and BIOS Cores Replace/add hash or Cert in db Bootkit hash is now allowed Generic exploit, independent of the platform/vendor Can be found by inspecting db in ROM Replace/add RootCert in KEK or PK with your own Bootkit signature is now valid Exploit Strategies
63 Clear SecureBootEnable variable Despite defines SecureBootEnable EFI variable platform vendors store Secure Boot Enable in platform specific places Format of EFI NVRAM and EFI variable in ROM is platform/vendor specific May require modification in multiple places in NVRAM parsing of platform specific NVRAM format Replacing entire NVRAM or even entire BIOS region to SB=off state is simpler but takes a while Exploit Strategies
64 Parsing Proprietary EFI NVRAM
65 Corrupt Platform Key EFI variable in NVRAM Name ( PK ) or Vendor GUID (8BE4DF61-93CA-11D2- AA0D-00E098032B8C) Recall that AutenticatedVariableService DXE driver enters Secure Boot SETUP_MODE when correct PK EFI variable cannot be located in EFI NVRAM Main volatile SecureBoot variable is then set to DISABLE ImageVerificationLib then assumes Secure Boot is off and skips Secure Boot checks Generic exploit, independent of the platform/vendor 1 bit modification! Exploit Strategies
66 Corrupting Platform Key in ROM
67 Windows 8 HW Certification Requires Platforms to Protect Firmware and NVRAM with Secure Boot keys!
68 Secure Boot Is Enabled
69 Corrupting Platform Key in NVRAM
70 Platform Key Is De-Installed
71 Для загрузки необходим номер вашей кредитной карты на securecreditсardz.ru
72 Back to Setup Mode Secure Boot Is Off
73 Demo 1 Attacking Windows 8 Secure Boot on ASUS VivoBook Q200E
74 This issue does not affect platform vendors correctly protecting their BIOS in ROM and during BIOS Update but When firmware is not adequately protected (in ROM or during update), subverting Secure Boot is not the only thing to worry about!
75 S-CRTM and TPM based Measured Boot including Full-Disk Encryption solutions relying on the TPM can also be subverted Evil Maid Just Got Angrier BIOS Chronomancy by John Butterworth, Corey Kallenberg, Xeno Kovah
76 Or you can get infected with BIOS or SMM malware a.k.a. extremely persistent malware.gov Persistent BIOS Infection by Anibal Sacco, Alfredo Ortega Hardware Backdooring is Practical by Jonathan Brossard The Real SMM Rootkit by core collapse SMM Rootkits by Shawn Embleton, Sherri Sparks, Cliff Zou
77 Huh! It requires kernel exploit?
78 Why Not Just Directly Modify Secure Boot Keys from the OS? There s an API for that # chipsec_util.py uefi writevar PK 8BE4DF61-93CA-11D2-AA0D-00E098032B8C PK_forged.bin SetFirmwareEnvironmentVariable failed [Error 5] Access is Denied. Secure Boot Variables
79 Remember Secure Boot Key variables are Authenticated Write Access You have to sign EFI variable and have corresponding X509 Cert in NVRAM (PK/KEK/certdb) Secure Boot Variables
80 Is it possible to bypass Windows 8 Secure Boot and install bootkit by remote user mode exploit? Coordinated disclosure of multiple vulnerabilities to affected BIOS and platform vendors is ongoing but we can offer a demo
81 Demo 2 Attacking Windows 8 Secure Boot from user-mode
82 Now what?
83 Only signed updates should be allowed Signed Capsule based update via S3/reset Run-time update from within SMM only Protect firmware in ROM Use BIOS Control to enable write protection of the entire BIOS region in SPI flash Use Protected Range registers to write-protect ranges of SPI flash Protect EFI variable store (NVRAM) in ROM NVRAM contains Secure Boot keys and NV configuration Measuring Secure Boot configuration into PCR[7] may prevent or complicate certain exploits Facilitates detection via remote attestation Windows BitLocker may seal encryption keys to PCR[7] Microsoft Hardware Certification Requirements Recommendations (Platform Vendors)
84 Make sure platform has Windows 8 Logo Such platform has to adhere to the security requirements in System.Fundamentals.Firmware.SecureBoot Check if firmware updates are signed Corrupt firmware update binary and feed it to the BIOS update utility Ask if and how platform adheres to the BIOS Protection Guidelines (NIST SP ) Recommendations
85 Black Hat organizers and review committee Bruce Monroe, John Loucaides, Ben Parmeter, Paul Alappat; Microsoft s MSRC and Secure Boot team for coordinating vendor disclosures Nicholas Adams, Kirk Brannock, doughty, Dhinesh Manoharan, Brian Payne, Mickey Shkatov, Vincent Zimmer, Monty Wiseman for help & support of this work Greetz @drraid, Acknowledgements
86 BIOS SECURITY by John Butterworth, Corey Kallenberg and Xeno Kovah UART THOU MAD? by Toby Kohlenberg and Mickey Shkatov ANDROID: ONE ROOT TO OWN THEM ALL by Jeff Forristal Don t Miss These Talks!
87
Hi and welcome to the Microsoft Virtual Academy and
Hi and welcome to the Microsoft Virtual Academy and 2012 Microsoft Corporation 1 the start of the Windows 8 Security Insights training. My name is Milad Aslaner I m part of the Premier Field Engineering
Attacking Hypervisors via Firmware and Hardware
Attacking Hypervisors via Firmware and Hardware Alex Matrosov (@matrosov), Mikhail Gorobets, Oleksandr Bazhaniuk (@ABazhaniuk), Andrew Furtak, Yuriy Bulygin (@c7zero) Advanced Threat Research Agenda Hypervisor
Trustworthy Computing
Stefan Thom Senior Software Development Engineer and Security Architect for IEB, Microsoft Rob Spiger, Senior Security Strategist Trustworthy Computing Agenda Windows 8 TPM Scenarios Hardware Choices with
UEFI Firmware Security Best Practices
UEFI Firmware Security Best Practices Presented by: Dick Wilkins, PhD Principal Technology Liaison presented by UEFI Plugfest May 2014 Agenda Introduction Threats and Vulnerabilities Mitigation Guidelines
INLICHTINGEN DIENSTEN INLICHTINGEN DIENSTEN
Indien u hergebruik wenst te maken van de inhoud van deze presentatie, vragen wij u in het kader van auteursrechtelijke bescherming de juiste bronvermelding toe te passen. 17 juni 2014 De Reehorst in Ede
Attacking Hypervisors via Firmware and Hardware
Attacking Hypervisors via Firmware and Hardware Mikhail Gorobets, Oleksandr Bazhaniuk, Alex Matrosov, Andrew Furtak, Yuriy Bulygin Advanced Threat Research Agenda Hypervisor based isolation Firmware rootkit
Using the TPM to Solve Today s Most Urgent Cybersecurity Problems
Using the to Solve Today s Most Urgent Cybersecurity Problems May 20, 2014 10:00AM PDT 2 Stacy Cannady, Technical Marketing Trustworthy Computing, Cisco Stacy Cannady, CISSP, is technical marketing - Trustworthy
Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken
Bypassing Local Windows Authentication to Defeat Full Disk Encryption Ian Haken Who Am I? Currently a security researcher at Synopsys, working on application security tools and Coverity s static analysis
UEFI Implications for Windows Server
presented by UEFI Implications for Windows Server Taipei UEFI Plugfest March 18-22, 2013 Presented by Arie van der Hoeven (Microsoft Corporation) Updated 2011-06-01 Taipei UEFI Plugfest March 2013 www.uefi.org
UEFI SECURE BOOT IN MODERN COMPUTER SECURITY SOLUTIONS
UEFI SECURE BOOT IN MODERN COMPUTER SECURITY SOLUTIONS September 2013 Authors: Richard Wilkins, Ph.D. Phoenix Technologies, Ltd. Dick_Wilkins@phoenix.com Brian Richardson Intel Corporation Brian.Richardson@intel.com
Dell Client BIOS: Signed Firmware Update
Dell Client BIOS: Signed Firmware Update An Implementation and Deployment Guide to NIST SP800-147 BIOS Protections for Dell Client BIOS Rick Martinez Dell Client BIOS This white paper is for informational
Protecting Data with Short- Lived Encryption Keys and Hardware Root of Trust. Dan Griffin DefCon 2013
Protecting Data with Short- Lived Encryption Keys and Hardware Root of Trust Dan Griffin DefCon 2013 Time-Bound Keys Announcements New tool: TimedKey.exe New whitepaper: Trusted Tamperproof Time on Mobile
Windows 8 Security. Security Response. November, 2011
November, 2011 Introduction You have almost certainly heard by now about the exciting changes from Microsoft planned for Windows 8. If you have followed the press or, better yet, played with the Windows
Overview of Windows 10 Requirements for TPM, HVCI and SecureBoot
presented by Overview of Windows 10 Requirements for TPM, HVCI and SecureBoot UEFI Spring Plugfest May 18-22, 2015 Gabe Stocco, Scott Anderson, Suhas Manangi Updated 2011-06-01 UEFI Plugfest May 2015 www.uefi.org
Hardware Enabled Zero Day Protection
Hardware Enabled Zero Day Protection Cyber Security Division 2012 Principal Investigators Meeting October 11, 2012 Paul A. Rivera President/CEO Def-Logix, Inc. Email: privera@def-logix.com Phone: 210-478-1369
Technical Brief Distributed Trusted Computing
Technical Brief Distributed Trusted Computing Josh Wood Look inside to learn about Distributed Trusted Computing in Tectonic Enterprise, an industry-first set of technologies that cryptographically verify,
Hardware Backdooring is practical. Jonathan Brossard (Toucan System) Florentin Demetrescu (Cassidian)
Hardware Backdooring is practical Jonathan Brossard (Toucan System) Florentin Demetrescu (Cassidian) DISCLAIMER We are not «terrorists». We won't release our PoC backdoor. The x86 architecture is plagued
UEFI on Dell BizClient Platforms
UEFI on Dell BizClient Platforms Authors: Anand Joshi Kurt Gillespie This document is for informational purposes only and may contain typographical errors and technical inaccuracies. The content is provided
Betting BIOS Bugs Won t Bite Y er Butt? Xeno Kovah Corey Kallenberg
Betting BIOS Bugs Won t Bite Y er Butt? Xeno Kovah Corey Kallenberg About us MITRE researchers for the past 7.5 years As of today, full @me at LegbaCore! Focused on low level x86 security at the kernel
Session ID: Session Classification:
Session ID: Session Classification: Protecting Data with Encryption Access Control Protect Sensitive Data Protect and Manage Threats Groundbreaking Malware Resistance Protects the client, data, and corporate
Attacking Intel Trusted Execution Technology
Attacking Intel Trusted Execution Technology Rafal Wojtczuk rafal@invisiblethingslab.com Joanna Rutkowska joanna@invisiblethingslab.com ---===[ Invisible Things Lab ]===--- Abstract In this paper we present
Security Policy for FIPS 140 2 Validation
BitLocker Windows OS Loader Security Policy for FIPS 140 2 Validation BitLocker Windows OS Loader (winload) in Microsoft Windows 8.1 Enterprise Windows Server 2012 R2 Windows Storage Server 2012 R2 Surface
Windows Phone 8 Security deep dive
October 2012 Windows Phone 8 Security deep dive David Hernie Technical Evangelist Microsoft Belux Office Microsoft Corporation All large screen, dual-core, LTE and NFC Nokia Lumia 920 Nokia Lumia 820 Samsung
Lecture Overview. INF3510 Information Security Spring 2015. Lecture 4 Computer Security. Meaningless transport defences when endpoints are insecure
Lecture Overview INF3510 Information Security Spring 2015 Fundamental computer security concepts CPU and OS kernel security mechanisms Virtualization Memory Protection Trusted computing and TPM Lecture
Race to bare metal: UEFI and hypervisors
Race to bare metal: UEFI and hypervisors Agenda 1. Race to bare metal 2. Overview UEFI 3. UEFI in practice 4. Advantages of UEFI for anti/malware hypervisors 5. Some practical considerations 1. Race to
Windows Server 2008 R2 Boot Manager Security Policy For FIPS 140-2 Validation
Boot Manager Security Policy Windows Server 2008 R2 Boot Manager Security Policy For FIPS 140-2 Validation v 1.3 6/8/11 1 INTRODUCTION... 1 1.1 Cryptographic Boundary for BOOTMGR... 1 2 SECURITY POLICY...
BIOS and Secure Boot Attacks Uncovered
ekoparty 10 BIOS and Secure Boot Attacks Uncovered Andrew Furtak, Yuriy Bulygin, Oleksandr Bazhaniuk, John Loucaides, Alexander Matrosov, Mikhail Gorobets In The Beginning Was The Legacy BIOS.. Legacy
Embedded Trusted Computing on ARM-based systems
1 / 26 Embedded Trusted Computing on ARM-based systems Martin Schramm, M.Eng. 10.04.2014 Agenda 2 of 26 martin.schramm@th-deg.de Embedded computing platforms have become omnipresent intend to alleviate
Patterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de
The Impact of Cryptography on Platform Security
The Impact of Cryptography on Platform Security Ernie Brickell Intel Corporation 2/28/2012 1 Security is Intel s Third Value Pillar Intel is positioning itself to lead in three areas: energy-efficient
Providing a jump start to EFI application development and a uniform pre-boot environment
Providing a jump start to EFI application development and a uniform pre-boot environment Yosi Govezensky Program Manager Microcomputer Software Corp. February 15-17, 2000 Agenda l EFI Application Toolkit
UEFI PXE Boot Performance Analysis
UEFI PXE Boot Performance Analysis February 2014 Li Ruth, Brian Richardson Intel Corporation Executive Summary Network boot using the Preboot Execution Environment (PXE) is widely supported by current
Secure Storage. Lost Laptops
Secure Storage 1 Lost Laptops Lost and stolen laptops are a common occurrence Estimated occurrences in US airports every week: 12,000 Average cost of a lost laptop for a corporation is $50K Costs include
Opal SSDs Integrated with TPMs
Opal SSDs Integrated with TPMs August 21, 2012 Robert Thibadeau, Ph.D. U.S. Army SSDs Must be Opal s We also Studied using the TPM (Trusted Platform Module) with an Opal SSD (Self-Encrypting Drive) 2 Security
A Tour Beyond BIOS Supporting an SMM Resource Monitor using the EFI Developer Kit II
White Paper A Tour Beyond BIOS Supporting an SMM Resource Monitor using the EFI Developer Kit II Jiewen Yao Intel Corporation Vincent J. Zimmer Intel Corporation June 2015 i Executive Summary In the current
How to Secure Infrastructure Clouds with Trusted Computing Technologies
How to Secure Infrastructure Clouds with Trusted Computing Technologies Nicolae Paladi Swedish Institute of Computer Science 2 Contents 1. Infrastructure-as-a-Service 2. Security challenges of IaaS 3.
BitLocker Drive Encryption Hardware Enhanced Data Protection. Shon Eizenhoefer, Program Manager Microsoft Corporation
BitLocker Drive Encryption Hardware Enhanced Data Protection Shon Eizenhoefer, Program Manager Microsoft Corporation Agenda Security Background BitLocker Drive Encryption TPM Overview Building a BitLocker
Frontiers in Cyber Security: Beyond the OS
2013 DHS S&T/DoD ASD (R&E) CYBER SECURITY SBIR WORKSHOP Frontiers in Cyber Security: Beyond the OS Clear Hat Consulting, Inc. Sherri Sparks 7/23/13 Company Profile CHC was founded in 2007 by S. Sparks
Mobile Device as a Platform for Assured Identity for the Federal Workforce
Mobile Device as a Platform for Assured Identity for the Federal Workforce Dr. Sarbari Gupta President and CEO, Electrosoft U.S. Army Information Technology Agency (ITA) Security Forum Fort Belvoir Electrosoft
Absolute Backdoor Revisited. Vitaliy Kamlyuk, Kaspersky Lab Sergey Belov, Kaspersky Lab Anibal Sacco, Cubica Labs
Absolute Backdoor Revisited Vitaliy Kamlyuk, Kaspersky Lab Sergey Belov, Kaspersky Lab Anibal Sacco, Cubica Labs BlackHat, Las Vegas August, 2014 What is Computrace? Computrace is an Anti-Theft software
EMET 4.0 PKI MITIGATION. Neil Sikka DefCon 21
EMET 4.0 PKI MITIGATION Neil Sikka DefCon 21 ABOUT ME Security Engineer on MSRC (Microsoft Security Response Center) I look at 0Days EMET Developer I enjoy doing security research on my free time too:
Advanced x86: BIOS and System Management Mode Internals SPI Flash. Xeno Kovah && Corey Kallenberg LegbaCore, LLC
Advanced x86: BIOS and System Management Mode Internals SPI Flash Xeno Kovah && Corey Kallenberg LegbaCore, LLC All materials are licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/
Recipe for Mobile Data Security: TPM, Bitlocker, Windows Vista and Active Directory
Recipe for Mobile Data Security: TPM, Bitlocker, Windows Vista and Active Directory Tom Olzak October 2007 If your business is like mine, laptops regularly disappear. Until recently, centrally managed
UNCLASSIFIED Version 1.0 May 2012
Secure By Default: Platforms Computing platforms contain vulnerabilities that can be exploited for malicious purposes. Often exploitation does not require a high degree of expertise, as tools and advice
MBR and EFI Disk Partition Systems
MBR and EFI Disk Partition Systems Brought to you by www.rmroberts.com Computer technology is constantly evolving. The hard disk drive partition system has become quite complicated in recent years because
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE) Andreas Greulich, MELANI Swiss Cyber Storm, 18 April 2009 Agenda Part 1: Introduction (~5 ) Infection
Software Token Security & Provisioning: Innovation Galore!
Software Token Security & Provisioning: Innovation Galore! Kenn Min Chong, Principal Product Manager SecurID, RSA Emily Ryan, Security Solution Architect, Intel Michael Lyman, Product Marketing Manager,
A Hypervisor IPS based on Hardware assisted Virtualization Technology
A Hypervisor IPS based on Hardware assisted Virtualization Technology 1. Introduction Junichi Murakami (murakami@fourteenforty.jp) Fourteenforty Research Institute, Inc. Recently malware has become more
A Perspective on the Evolution of Mobile Platform Security Architectures
A Perspective on the Evolution of Mobile Platform Security Architectures Kari Kostiainen Nokia Research Center, Helsinki TIW, June 2011 Joint work with N. Asokan, Jan-Erik Ekberg and Elena Reshetova 1
DELL. Unified Server Configurator Security Overview. A Dell Technical White Paper. By Raja Tamilarasan, Wayne Liles, Marshal Savage and Weijia Zhang
DELL A Dell Technical White Paper Unified Server Configurator Security Overview By Raja Tamilarasan, Wayne Liles, Marshal Savage and Weijia Zhang THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND
Index. BIOS rootkit, 119 Broad network access, 107
Index A Administrative components, 81, 83 Anti-malware, 125 ANY policy, 47 Asset tag, 114 Asymmetric encryption, 24 Attestation commercial market, 85 facts, 79 Intel TXT conceptual architecture, 85 models,
Full Drive Encryption Security Problem Definition - Encryption Engine
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 Full Drive Encryption Security Problem Definition - Encryption Engine Introduction for the FDE Collaborative Protection Profiles
Technical Note. Installing Micron SEDs in Windows 8 and 10. Introduction. TN-FD-28: Installing Micron SEDs in Windows 8 and 10.
Technical Note Installing Micron SEDs in Windows 8 and 10 TN-FD-28: Installing Micron SEDs in Windows 8 and 10 Introduction Introduction Self-encrypting drives (SEDs) can provide an effective way of protecting
William Hery (whery@poly.edu) Research Professor, Computer Science and Engineering NYU-Poly
William Hery (whery@poly.edu) Research Professor, Computer Science and Engineering NYU-Poly Ramesh Karri (rkarri@poly.edu) Associate Professor, Electrical and Computer Engineering NYU-Poly Why is cyber
WIND RIVER SECURE ANDROID CAPABILITY
WIND RIVER SECURE ANDROID CAPABILITY Cyber warfare has swiftly migrated from hacking into enterprise networks and the Internet to targeting, and being triggered from, mobile devices. With the recent explosion
TCG PC Client Specific Implementation Specification for Conventional BIOS
TCG PC Client Specific Implementation Specification for Conventional BIOS Specification Version 1.21 Errata Revision 1.00 February 24 th, 2012 For TPM Family 1.2; Level 2 Contact: admin@trustedcomputinggroup.org
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
Using BitLocker As Part Of A Customer Data Protection Program: Part 1
Using BitLocker As Part Of A Customer Data Protection Program: Part 1 Tech Tip by Philip Cox Source: searchsecuritychannel.com As an information security consultant, one of my jobs is to help my clients
Cautions When Using BitLocker Drive Encryption on PRIMERGY
Cautions When Using BitLocker Drive Encryption on PRIMERGY July 2008 Fujitsu Limited Table of Contents Preface...3 1 Recovery mode...4 2 Changes in hardware configurations...5 3 Prior to hardware maintenance
Factory Application Certificates and Keys Products: SB700EX, SB70LC
Factory Application Certificates and Keys Products: SB700EX, SB70LC 1 Contents 1 Overview... 3 2 Certificates and Keys... 3 2.1 What is in a Certificate?... 4 3 SSL Certificates and Keys... 6 3.1 NetBurner
Fastboot Techniques for x86 Architectures. Marcus Bortel Field Application Engineer QNX Software Systems
Fastboot Techniques for x86 Architectures Marcus Bortel Field Application Engineer QNX Software Systems Agenda Introduction BIOS and BIOS boot time Fastboot versus BIOS? Fastboot time Customizing the boot
Smartphone Security. A Holistic view of Layered Defenses. David M. Wheeler, CISSP, CSSLP, GSLC. (C) 2012 SecureComm, Inc. All Rights Reserved
Smartphone Security A Holistic view of Layered Defenses David M. Wheeler, CISSP, CSSLP, GSLC 1 The Smartphone Market The smartphone security market is expected to grow at a rate of 44 percent annually
Acronym Term Description
This glossary contains definitions of terms created by TCG, or terms that have a particular meaning in trusted computing, or terms that cause particular confusion in trusted computing. Acronym Term Description
Background. TPMs in the real world. Components on TPM chip TPM 101. TCG: Trusted Computing Group. TCG: changes to PC or cell phone
CS 155 Spring 2006 Background TCG: Trusted Computing Group Dan Boneh TCG consortium. Founded in 1999 as TCPA. Main players (promotors): (>200 members) AMD, HP, IBM, Infineon, Intel, Lenovo, Microsoft,
FIPS 140-2 Security Policy 3Com Embedded Firewall PCI Cards
FIPS 140-2 Security Policy 3Com Embedded Firewall PCI Cards 3Com Corporation 5403 Betsy Ross Drive Santa Clara, CA 95054 USA February 24, 2006 Revision Version 0.4 Page 1 of 15 1. Introduction The following
Introducing Ring -3 Rootkits
Introducing Ring -3 Rootkits Alexander Tereshkin and Rafal Wojtczuk Black Hat USA, July 29 2009 Las Vegas, NV 1 Introducing Ring -3 2 Getting there 3 Writing useful Ring -3 rootkits A Quest to Ring -3
Penetration Testing Windows Vista TM BitLocker TM
Penetration Testing BitLocker TM Drive Encryption Douglas MacIver Penetration Engineer System Integrity Group, Corporation Hack In The Box 2006/09/21 2006 Corporation. All rights reserved. Trustworthy
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules Dr. Frederic Stumpf, ESCRYPT GmbH Embedded Security, Stuttgart, Germany 1 Introduction Electronic Control Units (ECU) are embedded
BOOTKITS: PAST, PRESENT & FUTURE Eugene Rodionov ESET, Canada Alexander Matrosov Intel, USA David Harley ESET North America, UK
BOOTKITS: PAST, PRESENT & FUTURE Eugene Rodionov ESET, Canada Alexander Matrosov Intel, USA David Harley ESET North America, UK Email rodionov@eset.com; alexander.matrosov@ intel.com; david.harley.ic@eset.com
Navigating Endpoint Encryption Technologies
Navigating Endpoint Encryption Technologies Whitepaper November 2010 THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND TECHNICAL INACCURACIES. THE CONTENT IS
Secure Data Management in Trusted Computing
1 Secure Data Management in Trusted Computing Ulrich Kühn Deutsche Telekom Laboratories, TU Berlin Klaus Kursawe (KU Leuven) Stefan Lucks (U Mannheim) Ahmad-Reza Sadeghi (RU Bochum) Christian Stüble (RU
Virtually Secure. a journey from analysis to remote root 0day on an industry leading SSL-VPN appliance
Virtually Secure a journey from analysis to remote root 0day on an industry leading SSL-VPN appliance Who am I? Tal Zeltzer Independent security researcher from Israel Reverse engineering (mostly embedded
DELL. Unified Server Configurator: IT and Systems Management Overview. A Dell Technical White Paper
DELL A Dell Technical White Paper Unified Server Configurator: IT and Systems Management Overview By Shelli Allgood, Anand Narayanan, Hai Phung, Pritesh Prabhu and Ganesh Viswanathan THIS WHITE PAPER IS
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
OVAL+TPM. A Case Study in Enterprise Trusted Computing. Ariel Segall. June 21, 2011
OVAL+TPM A Case Study in Enterprise Trusted Computing Ariel Segall June 21, 2011 Approved for Public Release: 11-0144. Distribution Unlimited. c 2011. All Rights Reserved. (1/15) Motivation Goal: Demonstrate
Lifecycle Controller Platform Update/Firmware Update in Dell PowerEdge 12th Generation Servers
Lifecycle Controller Platform Update/Firmware Update in Dell PowerEdge 12th Generation Servers This Dell Technical White Paper provides detailed information about the capabilities of Lifecycle Controller
Windows Phone 8 Security Overview
Windows Phone 8 Security Overview This white paper is part of a series of technical papers designed to help IT professionals evaluate Windows Phone 8 and understand how it can play a role in their organizations.
Security Technical. Overview. BlackBerry Enterprise Service 10. BlackBerry Device Service Solution Version: 10.2
BlackBerry Enterprise Service 10 BlackBerry Device Service Solution Version: 10.2 Security Technical Overview Published: 2014-09-10 SWD-20140908123239883 Contents 1 About BlackBerry Device Service solution
Introduction to BitLocker FVE
Introduction to BitLocker FVE (Understanding the Steps Required to enable BitLocker) Exploration of Windows 7 Advanced Forensic Topics Day 3 What is BitLocker? BitLocker Drive Encryption is a full disk
Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement. MJ0011 th_decoder@126.com
Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement MJ0011 th_decoder@126.com Agenda Background A Patched Vulnerability: CVE-2010-4398 Bypass DSE on Windows7 x64 Windows8
Design and development of an automated regression test suite for UEFI
Design and development of an automated regression test suite for UEFI Master Thesis Leading to a master s degree in Automotive Software Engineering Professorship of Computer Engineering Faculty of Computer
Everything is Terrible
Everything is Terrible A deep dive into provisioning and code signing Hello and welcome to Everything is Terrible. This is a deep dive talk into the processes behind provisioning and code signing on Apple
Analysis of advanced issues in mobile security in android operating system
Available online atwww.scholarsresearchlibrary.com Archives of Applied Science Research, 2015, 7 (2):34-38 (http://scholarsresearchlibrary.com/archive.html) ISSN 0975-508X CODEN (USA) AASRC9 Analysis of
Lecture Embedded System Security Dynamic Root of Trust and Trusted Execution
1 Lecture Embedded System Security Dynamic Root of Trust and Execution Prof. Dr.-Ing. Ahmad-Reza Sadeghi System Security Lab Technische Universität Darmstadt (CASED) Germany Summer Term 2014 Dynamic Root
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
FIPS 140 2 Non Proprietary Security Policy: Kingston Technology DataTraveler DT4000 Series USB Flash Drive
FIPS 140 2 Non Proprietary Security Policy Kingston Technology Company, Inc. DataTraveler DT4000 G2 Series USB Flash Drive Document Version 1.8 December 3, 2014 Document Version 1.8 Kingston Technology
ios Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33
ios Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33 Why care about ios Security? 800M 800 million ios devices activated 130 million in last year 98%
SkyRecon Cryptographic Module (SCM)
SkyRecon Cryptographic Module (SCM) FIPS 140-2 Documentation: Security Policy Abstract This document specifies the security policy for the SkyRecon Cryptographic Module (SCM) as described in FIPS PUB 140-2.
Firmware security features in HP Compaq business notebooks
HP ProtectTools Firmware security features in HP Compaq business notebooks Embedded security overview... 2 Basics of protection... 2 Protecting against unauthorized access user authentication... 3 Pre-boot
Creating a More Secure Device with Windows Embedded Compact 7. Douglas Boling Boling Consulting Inc.
Creating a More Secure Device with Windows Embedded Compact 7 Douglas Boling Boling Consulting Inc. About Douglas Boling Independent consultant specializing in Windows Mobile and Windows Embedded Compact
Strategies for Firmware Support of Self-Encrypting Drives
presented by Strategies for Firmware Support of Self-Encrypting Drives UEFI Winter Plugfest February 21-23, 2011 Presented by Jeff Bobzin (Insyde Software, Inc.) Updated 2011-06-01 UEFI Plugfest February
Software-based TPM Emulator for Linux
Software-based TPM Emulator for Linux Semester Thesis Mario Strasser Department of Computer Science Swiss Federal Institute of Technology Zurich Summer Semester 2004 Mario Strasser: Software-based TPM
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy 21 June 2010 Table of Contents Introduction Module Specification Ports and Interfaces Approved Algorithms Test Environment Roles
UEFI Spec Version 2.4 Facilitates Secure Update
presented by UEFI Spec Version 2.4 Facilitates Secure Update UEFI Summerfest July 15 19, 2013 Presented by Jeff Bobzin Insyde Software Updated 2011 06 01 UEFI Summerfest July 2013 www.uefi.org 1 Agenda
The PC Boot Process - Windows XP.
The PC Boot Process - Windows XP. Power supply switched on. The power supply performs a selftest. When all voltages and current levels are acceptable, the supply indicates that the power is stable and
DriveLock and Windows 8
Why alone is not enough CenterTools Software GmbH 2013 Copyright Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise