Protecting Data In-Use from Firmware and Physical Attacks
summary
Survey of concrete exploits and countermeasures: SMM bootkits that persist below the OS, hard‑drive firmware tampering, DMA exfiltration via off‑the‑shelf PCI cards and Thunderbolt chassis, and a cold boot attack (aerosol freeze) with anecdotal ~75% success; nonvolatile RAM can persist memory for years. Demonstrations include memory bus analyzers and network‑adapter implants; mitigations evaluated are verified boot, TXT/TPM measurements, IOMMU for DMA, and upcoming hardware roots like SGX and EPID, with practical limits and attack costs noted.
AI-written summary · about
chapters (18)
- 0:00Start
- 2:17NSA ANT
- 3:33System Management Mode
- 6:14GINSU
- 6:50The Notorious Tribble
- 7:36Do-it-Yourself PCle Attack
- 8:37Firewire & Thunderbolt
- 10:12Memory Bus Analyzers
- 10:45Cold Boot Attack
- 11:42Non-Volatile RAM
- 12:57Diagnostics Tools
- 13:44Verified Boot
- 14:55Trusted Execution Technology
- 15:58TXT Attack Vectors
- 17:30IOMMU
- 21:42Software-Based Attestation
- 22:16Enhanced Privacy ID (EPID)
- 23:01Software Guard Extensions (SGX)
related talks
49mBreaking Hardware-Enforced Security With Hypervisors
39mTOCTOU Attacks Against Secure Boot And BootGuard
01h 07mPEW PEW PEW: Designing Secure Boot Securely
37mPreventing DMA Attacks from Thunderbolt Devices
21mIndustrial IoT security issues and countermeasures
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
51mFirmware Cartography: Charting the Course for Modern Server Compromise
34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations