Hardware security boundaries are really difficult to support and correctly design. On modern x86 platforms exist a lot of different hardware components. It's clear they should be included in the usual threat model's obvious external paths, but what if the attacker can compromise one of the trusted components? We have previously seen when researchers compromise TPM and start the initial point of the attack from inside of trusted boundary. All these points create concerns on the current threat modeling process because after attacker crosses a trusted boundary, the attack surface significantly changes. Does this mean the attack surface is dynamic and not static?
In our presentation, we focus on reverse engineering Embedded Controller (EC) from one of the recent Lenovo Thinkpad laptops, attacks from EC trusted boundary the main platform firmware (BIOS) and we manage to bypass Intel BIOS Guard technology (Lenovo specific implementation). We will present multiple topics across security boundaries problems on x86 platforms, as well as demonstrate platform design problems with trust to third-party components as EC and show the real attacks from OS-level to EC/from EC to BIOS.
This research targeting reverse engineering topics of EC firmware are based on ARC processor architecture, the internals of EC architecture and specific operating modes to support SMI-handlers on EC side (include BIOS Guard). Also, we reverse engineered the most interesting parts of communications and relations between BIOS and EC. The attack surface from EC with attacker perspective is quite large and can include DMA attacks, disclose of PCI memory space to attack devices and the possibility of persistent rootkit/implant installation.
Alex Matrosov is a leading offensive security researcher at NVIDIA. He has more than two decades of experience with reverse engineering, advanced malware analysis, firmware security, and exploitation techniques. Before joining NVIDIA, Alex served as Principal Security Researcher at Intel Security Center of Excellence (SeCoE), spent more than six years in the Intel Advanced Threat Research team, and was Senior Security Researcher at ESET. Alex has authored and co-authored numerous research papers, and is a frequent speaker at security conferences, including REcon, Zeronigths, Black Hat, DEFCON, and others. Additionally, he is awarded by Hex-Rays for open-source plugin HexRaysCodeXplorer which is developed and supported since 2013 by REhint's team.
Alexandre Gazet is currently an information security researcher at Airbus Security Research Team after having previously worked as a senior security researcher at Quarkslab. He specializes in reverse engineering, low-level and embedded systems security. He has spoken at security conferences worldwide, i.e., REcon (Canada), Hack In The Box ((Malaysia, Netherlands), SSTIC (France), etc. He is also a co-author of the reverse engineering textbook, Practical Reverse Engineering: x86, x64, Windows kernel, and obfuscation, published by John Wiley & Sons.