1
00:00:00,000 --> 00:00:03,090
- These speakers really
need no introduction,

2
00:00:03,090 --> 00:00:04,530
but they will introduce themselves

3
00:00:04,530 --> 00:00:06,150
and let's give them the
big DEF CON welcome.

4
00:00:06,150 --> 00:00:08,006
Come on. Let us hear.

5
00:00:08,006 --> 00:00:09,415
(audience applauding)

6
00:00:09,415 --> 00:00:10,248
Gentlemen.

7
00:00:14,010 --> 00:00:16,653
- Thank everyone for
coming, all 12 of you.

8
00:00:19,620 --> 00:00:22,223
Before we begin, did it move? Gosh.

9
00:00:23,283 --> 00:00:24,660
Here you go.

10
00:00:24,660 --> 00:00:26,206
So before we begin,

11
00:00:26,206 --> 00:00:29,602
thank you for coming for
our talk, to our talk.

12
00:00:29,602 --> 00:00:33,390
We're gonna try to be quick
'cause we have a lot of slides

13
00:00:33,390 --> 00:00:36,540
and a lot of content.

14
00:00:36,540 --> 00:00:39,060
And, oops.

15
00:00:39,060 --> 00:00:42,270
And, yeah.

16
00:00:42,270 --> 00:00:44,640
And a couple of trigger
warnings before we begin,

17
00:00:44,640 --> 00:00:46,680
there's a lot of "Lord
of the Ring" content

18
00:00:46,680 --> 00:00:47,724
in the slide deck.

19
00:00:47,724 --> 00:00:51,540
If you have a problem with
it, it's your problem.

20
00:00:51,540 --> 00:00:52,593
Go see a therapist.

21
00:00:53,880 --> 00:00:57,060
There might be a few animations
that have flickering lights

22
00:00:57,060 --> 00:00:58,980
if anyone has sensitivity for that.

23
00:00:58,980 --> 00:01:02,850
And I might probably will curse a lot

24
00:01:02,850 --> 00:01:06,240
and we're gonna mention
a lot of Microsoft.

25
00:01:06,240 --> 00:01:09,000
If anyone is sensitive to
that, please let us know.

26
00:01:09,000 --> 00:01:10,683
If you work at Microsoft,

27
00:01:12,035 --> 00:01:14,220
if you wanna raise your hand,

28
00:01:14,220 --> 00:01:16,236
so I know who to aim this at.

29
00:01:16,236 --> 00:01:17,190
(audience laughing)

30
00:01:17,190 --> 00:01:18,810
No one.

31
00:01:18,810 --> 00:01:19,893
Anyone at Dell?

32
00:01:21,270 --> 00:01:23,667
Okay. So there's a lot of Dell
and Microsoft in the deck.

33
00:01:23,667 --> 00:01:25,140
And we're gonna try and make it fun

34
00:01:25,140 --> 00:01:28,140
and entertaining for you guys.

35
00:01:28,140 --> 00:01:30,750
Quick introductions. I'm
Mickey, that's Jesse.

36
00:01:30,750 --> 00:01:33,150
That's our Twitters. We work
at a company called Eclypsium.

37
00:01:33,150 --> 00:01:34,140
Moving on.

38
00:01:34,140 --> 00:01:38,310
The agenda, we're gonna be boring

39
00:01:38,310 --> 00:01:40,890
for the first 10, 15 minutes.

40
00:01:40,890 --> 00:01:41,940
I do apologize.

41
00:01:41,940 --> 00:01:44,430
Some of this information
is not very exciting.

42
00:01:44,430 --> 00:01:45,930
It's not very wow,

43
00:01:45,930 --> 00:01:48,540
but we're gonna try to keep
it as simple as possible.

44
00:01:48,540 --> 00:01:51,690
So even if you don't know
anything about BIOS or security

45
00:01:51,690 --> 00:01:54,418
or anything in the Secure
Boot flow or whatever,

46
00:01:54,418 --> 00:01:57,060
you still can get an understanding,

47
00:01:57,060 --> 00:01:58,660
where basic understanding of it.

48
00:02:00,210 --> 00:02:02,398
I promise it will pick up towards the end.

49
00:02:02,398 --> 00:02:04,353
He's smiling 'cause he knows why.

50
00:02:05,670 --> 00:02:08,010
We're gonna talk about the
vulnerabilities we found

51
00:02:08,010 --> 00:02:10,260
and all the demos and everything

52
00:02:10,260 --> 00:02:11,093
that we have to do about it.

53
00:02:11,093 --> 00:02:13,890
And the summary, we were
gonna discuss the experience

54
00:02:13,890 --> 00:02:16,080
of how everything went through

55
00:02:16,080 --> 00:02:17,220
with the disclosure of the patching,

56
00:02:17,220 --> 00:02:18,370
the fixing, everything.

57
00:02:19,380 --> 00:02:21,150
All right. So what's Secure Boot?

58
00:02:21,150 --> 00:02:24,210
Secure Boot is the thing
that secures a boot.

59
00:02:24,210 --> 00:02:26,250
Everyone needs it. It's awesome.

60
00:02:26,250 --> 00:02:27,083
Use it.

61
00:02:28,140 --> 00:02:29,460
How it works.

62
00:02:29,460 --> 00:02:30,810
When you power on your computer,

63
00:02:30,810 --> 00:02:33,630
usually in normal boot sequence,

64
00:02:33,630 --> 00:02:35,730
you power on your computer.

65
00:02:35,730 --> 00:02:36,833
There's some magic happening.

66
00:02:36,833 --> 00:02:38,310
Then the firmware starts running.

67
00:02:38,310 --> 00:02:41,370
The firmware then finishes its run,

68
00:02:41,370 --> 00:02:43,920
hands it off to the assigned bootloader

69
00:02:43,920 --> 00:02:45,390
that is assigned in the firmware.

70
00:02:45,390 --> 00:02:48,180
Then the bootloader goes
and starts loading the chain

71
00:02:48,180 --> 00:02:50,189
for starting the OS, whatever OS it is.

72
00:02:50,189 --> 00:02:53,910
So for Windows, you have a
boot manager for Windows.

73
00:02:53,910 --> 00:02:56,970
That EFI, that's usually
the bootloader that I use.

74
00:02:56,970 --> 00:03:01,380
And then there's other winload.efi,

75
00:03:01,380 --> 00:03:02,790
and all kinds of other files

76
00:03:02,790 --> 00:03:05,220
that go in the path and the sequence.

77
00:03:05,220 --> 00:03:06,120
It changes with GRUB.

78
00:03:06,120 --> 00:03:07,770
For example, there's a different sequence

79
00:03:07,770 --> 00:03:09,390
for GRUB and so on.

80
00:03:09,390 --> 00:03:11,343
Where the secure part comes in,

81
00:03:12,270 --> 00:03:16,530
you have the firmware itself
that can get verified before.

82
00:03:16,530 --> 00:03:18,450
So there's all kinds of
technologies that do all that.

83
00:03:18,450 --> 00:03:23,190
I'm not gonna dull you with,
like bore you with the details.

84
00:03:23,190 --> 00:03:25,350
But once authenticated,

85
00:03:25,350 --> 00:03:27,750
secure firmware is booted and loaded.

86
00:03:27,750 --> 00:03:30,690
It goes and checks,
passes the checks along

87
00:03:30,690 --> 00:03:32,220
and checks that the bootloader is signed

88
00:03:32,220 --> 00:03:34,110
and it's verified and everything's okay.

89
00:03:34,110 --> 00:03:37,170
And the bootloader continues the checks

90
00:03:37,170 --> 00:03:39,180
with whatever enforcement mechanism it has

91
00:03:39,180 --> 00:03:40,357
and then the Windows said,

92
00:03:40,357 --> 00:03:42,900
"Yay, I'm good. I'm authenticated."

93
00:03:42,900 --> 00:03:47,900
And in this slide deck, we're
gonna focus on this part.

94
00:03:53,790 --> 00:03:56,483
That's all I wanna say. Sorry,
kind of ran through this.

95
00:03:58,170 --> 00:04:01,200
- So to, let's we talked
about it at a high level.

96
00:04:01,200 --> 00:04:03,090
Let's look at some architecture

97
00:04:03,090 --> 00:04:05,910
and implementation details for a second.

98
00:04:05,910 --> 00:04:08,310
UEFI firmware is very modular.

99
00:04:08,310 --> 00:04:11,283
It's designed to run
on a bunch of systems.

100
00:04:12,390 --> 00:04:13,560
When your laptop boots up,

101
00:04:13,560 --> 00:04:17,640
there may be 500 different
executables in the SPI flash

102
00:04:17,640 --> 00:04:20,400
on your motherboard that
could potentially run

103
00:04:20,400 --> 00:04:22,770
before the operating system even loads.

104
00:04:22,770 --> 00:04:27,270
And in order to provide
all this modularity

105
00:04:27,270 --> 00:04:31,080
and functionality, one of the
key mechanisms is the concept

106
00:04:31,080 --> 00:04:33,213
of protocols of protocol interfaces.

107
00:04:34,050 --> 00:04:37,890
It's essentially, if a
module or executable wants

108
00:04:37,890 --> 00:04:41,490
to provide a service or
some kind of capability

109
00:04:41,490 --> 00:04:43,590
that is then going to be used later,

110
00:04:43,590 --> 00:04:45,720
it will register a protocol interface

111
00:04:45,720 --> 00:04:47,520
that's identified by a GUID.

112
00:04:47,520 --> 00:04:50,880
So there's a well-defined set
of GUIDs in specification.

113
00:04:50,880 --> 00:04:53,100
OEMs will have their own additional GUIDs,

114
00:04:53,100 --> 00:04:57,210
but essentially, code
will register a protocol

115
00:04:57,210 --> 00:05:02,210
and then later, code will then
look up or locate protocol.

116
00:05:02,910 --> 00:05:06,150
And then that protocol
interface is essentially

117
00:05:06,150 --> 00:05:09,150
just a structure that has
function pointers in it

118
00:05:09,150 --> 00:05:11,130
and it can have private data,

119
00:05:11,130 --> 00:05:12,930
but that's a key thing to understand

120
00:05:12,930 --> 00:05:15,393
about how all this is tied together.

121
00:05:18,030 --> 00:05:20,190
So for the Secure Boot checks,

122
00:05:20,190 --> 00:05:22,440
it's also built in kind
of a modular fashion

123
00:05:22,440 --> 00:05:26,040
where there's different pieces of code

124
00:05:26,040 --> 00:05:27,434
that will do different types of checks.

125
00:05:27,434 --> 00:05:31,890
And those will register
with a single point

126
00:05:31,890 --> 00:05:34,950
of where the check is
going to be performed.

127
00:05:34,950 --> 00:05:37,130
It's essentially, it'll go
through all these callbacks,

128
00:05:37,130 --> 00:05:42,130
but the mechanism for executing
those security policies

129
00:05:42,810 --> 00:05:45,030
is registered in a protocol.

130
00:05:45,030 --> 00:05:46,830
There's a security ARC protocol

131
00:05:46,830 --> 00:05:48,840
and security ARC-2 protocol,

132
00:05:48,840 --> 00:05:53,280
where if you look up that
protocol by a well-known GUID,

133
00:05:53,280 --> 00:05:55,710
you'll basically get a structure

134
00:05:55,710 --> 00:05:57,030
that has a function point or two.

135
00:05:57,030 --> 00:05:58,470
The function that will be called

136
00:05:58,470 --> 00:06:02,013
in order to go do all these
checks during the boot process.

137
00:06:03,270 --> 00:06:05,174
Some of these things that
are going to be called

138
00:06:05,174 --> 00:06:08,430
during the boot process are
things like doing measurements

139
00:06:08,430 --> 00:06:12,270
into the TPM, or cryptographic
signature verification.

140
00:06:12,270 --> 00:06:14,430
And there are some other
things that can be registered

141
00:06:14,430 --> 00:06:15,330
as part of these checks,

142
00:06:15,330 --> 00:06:17,834
but those are the key ones
that we're most interested in.

143
00:06:17,834 --> 00:06:19,560
So there's measured boot

144
00:06:19,560 --> 00:06:22,200
versus verified boot or Secure Boot,

145
00:06:22,200 --> 00:06:24,570
which is doing the
cryptographic verification.

146
00:06:24,570 --> 00:06:27,390
Another thing is that
we're primarily focusing

147
00:06:27,390 --> 00:06:29,790
on DXE here for this use,

148
00:06:29,790 --> 00:06:33,420
but there is pre-EFI
initialization that happens before.

149
00:06:33,420 --> 00:06:35,010
And there can be some measurements

150
00:06:35,010 --> 00:06:36,693
during that phase as well.

151
00:06:37,740 --> 00:06:41,190
Here's kind of a high level
view of the UEFI boot process

152
00:06:41,190 --> 00:06:43,200
where you have different phases,

153
00:06:43,200 --> 00:06:45,210
like the initial power on
starts at the beginning

154
00:06:45,210 --> 00:06:48,784
at the left there with
security phase, then PEI,

155
00:06:48,784 --> 00:06:52,110
and then DXE or driver
execution environment

156
00:06:52,110 --> 00:06:56,883
is the biggest phase and it
has the most functionality.

157
00:06:56,883 --> 00:06:59,640
It's also the thing that runs

158
00:06:59,640 --> 00:07:03,446
and does a boot device selection
and loads your bootloader,

159
00:07:03,446 --> 00:07:06,627
and passes off execution
to the bootloader.

160
00:07:06,627 --> 00:07:11,627
So focusing on that area a
little bit, PEI core does things

161
00:07:13,181 --> 00:07:16,620
and then it passes off
execution to DXE core.

162
00:07:16,620 --> 00:07:17,910
DXE core will then set up things

163
00:07:17,910 --> 00:07:21,360
like runtime services
table, boot services table,

164
00:07:21,360 --> 00:07:24,600
and then it acts as a
dispatcher where it will then go

165
00:07:24,600 --> 00:07:28,470
and load different
executables and run those.

166
00:07:28,470 --> 00:07:30,758
And as part of that loading operation,

167
00:07:30,758 --> 00:07:32,940
it will call this function

168
00:07:32,940 --> 00:07:34,860
in the security architecture protocol

169
00:07:34,860 --> 00:07:38,610
in order to trigger these checks
that have been registered.

170
00:07:38,610 --> 00:07:41,010
And that's also used for
boot device selection

171
00:07:41,010 --> 00:07:42,780
and loading the bootloader

172
00:07:42,780 --> 00:07:45,093
in order to continue that chain of trust.

173
00:07:49,500 --> 00:07:52,830
- Most of the boring sleepy stuff is done.

174
00:07:52,830 --> 00:07:53,970
So bear with us.

175
00:07:53,970 --> 00:07:56,913
If you're sleeping, if you're
falling asleep, wake up.

176
00:07:58,473 --> 00:07:59,910
Now, the interesting part.

177
00:07:59,910 --> 00:08:03,060
Some of the cool things that we know of

178
00:08:03,060 --> 00:08:04,350
that happened in the past few years

179
00:08:04,350 --> 00:08:07,504
were known Secure Boot bypasses.

180
00:08:07,504 --> 00:08:11,010
One of them, which is
funny is the Golden Key,

181
00:08:11,010 --> 00:08:13,380
which was released a few years back.

182
00:08:13,380 --> 00:08:16,230
I don't remember exactly when
by Longhorn and Slipstream.

183
00:08:18,692 --> 00:08:21,450
I'm gonna butcher names, so
I just put Twitter handles

184
00:08:21,450 --> 00:08:24,990
and screenshots in the deck.

185
00:08:24,990 --> 00:08:28,770
If I mispronounce the names, apologies.

186
00:08:28,770 --> 00:08:32,880
Syd Bizkut is the one
who did the screenshot

187
00:08:32,880 --> 00:08:35,850
of how it looks when
he used the golden key.

188
00:08:35,850 --> 00:08:40,850
What it is in fact, basically
is it's a debug feature

189
00:08:41,070 --> 00:08:43,920
that allows you to install
a Secure Boot debug policy

190
00:08:43,920 --> 00:08:45,015
from Windows.

191
00:08:45,015 --> 00:08:47,520
But the funny thing was that,

192
00:08:47,520 --> 00:08:50,070
that binary was signed by Microsoft.

193
00:08:50,070 --> 00:08:53,340
So that was essentially
a Microsoft-handed bypass

194
00:08:53,340 --> 00:08:54,573
to Secure Boot.

195
00:08:56,820 --> 00:09:00,273
The source for this, the zip
is in the GitHub for this talk.

196
00:09:01,800 --> 00:09:03,720
One of the other research,

197
00:09:03,720 --> 00:09:06,420
one of the researchers that
did the golden key, Slipstream,

198
00:09:06,420 --> 00:09:11,420
they gave a talk two
months ago in CCCamp, camp.

199
00:09:12,540 --> 00:09:14,373
I highly recommend you go watch it.

200
00:09:15,960 --> 00:09:19,290
It contains a class of issues.

201
00:09:19,290 --> 00:09:21,660
A lot of information is contained there.

202
00:09:21,660 --> 00:09:25,860
I'm not gonna go into deeper
details because it's a lot.

203
00:09:25,860 --> 00:09:27,450
I highly recommend you go see it.

204
00:09:27,450 --> 00:09:30,510
There's also the repo that
he released, the slides,

205
00:09:30,510 --> 00:09:33,030
and the talk is not available yet,

206
00:09:33,030 --> 00:09:35,573
but it will be because they're
still editing that video.

207
00:09:37,830 --> 00:09:40,650
One of the other, well, in my eyes,

208
00:09:40,650 --> 00:09:43,421
it was the most famous Secure Boot bypass

209
00:09:43,421 --> 00:09:48,421
that I've seen so far
was the Kaspersky bypass.

210
00:09:48,570 --> 00:09:51,480
So we all know of Kaspersky antivirus.

211
00:09:51,480 --> 00:09:55,034
They had a rescue disc.

212
00:09:55,034 --> 00:09:58,113
For those of you who are gen
Z, that's the round thing.

213
00:10:00,000 --> 00:10:02,610
It's what you use to boot off here,

214
00:10:02,610 --> 00:10:05,910
put your computer off if
something happens or whatever.

215
00:10:05,910 --> 00:10:08,820
So Kaspersky said, "You
know what? We wanna be good.

216
00:10:08,820 --> 00:10:11,550
We're gonna do this Secure Boot right way.

217
00:10:11,550 --> 00:10:15,030
So if our customers using
Secure Boot, you can use that.

218
00:10:15,030 --> 00:10:18,150
You can use this disc without
having the user go into BIOS."

219
00:10:18,150 --> 00:10:20,877
Because in consumer software

220
00:10:20,877 --> 00:10:25,392
or programming products for consumers,

221
00:10:25,392 --> 00:10:28,020
you really don't want
the users to go into BIOS

222
00:10:28,020 --> 00:10:32,941
because it's really hard
to explain to someone,

223
00:10:32,941 --> 00:10:35,107
it's hard enough to explain to someone,

224
00:10:35,107 --> 00:10:36,030
"Click here, click that,

225
00:10:36,030 --> 00:10:38,217
then go into BIOS and
select that feature."

226
00:10:39,150 --> 00:10:44,100
Anyway, so they had this disc,
the disc was using a shim.

227
00:10:44,100 --> 00:10:46,440
So that shim is basically a binary

228
00:10:46,440 --> 00:10:47,700
that is signed by Microsoft.

229
00:10:47,700 --> 00:10:50,730
And that binary contains a CA

230
00:10:50,730 --> 00:10:53,580
and a certificate verification mechanism

231
00:10:53,580 --> 00:10:56,880
to check subsequent files that it loads.

232
00:10:56,880 --> 00:10:58,770
So the shim is signed on Microsoft.

233
00:10:58,770 --> 00:11:00,330
The shim then loads another binary

234
00:11:00,330 --> 00:11:01,953
that was signed by Kaspersky.

235
00:11:02,880 --> 00:11:04,597
In this entire process,

236
00:11:04,597 --> 00:11:08,970
it was discovered the GRUB
was loading unsigned modules,

237
00:11:08,970 --> 00:11:12,460
and there was a module loaded
that changed the file policy

238
00:11:14,250 --> 00:11:17,550
that allowed you to
load unsigned binaries.

239
00:11:17,550 --> 00:11:18,960
So you could bypass Secure Boot.

240
00:11:18,960 --> 00:11:21,690
You just take the whole file system,

241
00:11:21,690 --> 00:11:23,940
the whole file structure for GRUB.

242
00:11:23,940 --> 00:11:25,980
Copy it over to the EFI system partition,

243
00:11:25,980 --> 00:11:29,220
and change the boot order to that.

244
00:11:29,220 --> 00:11:30,213
And your golden.

245
00:11:33,450 --> 00:11:37,200
Another one that we
discovered while back was,

246
00:11:37,200 --> 00:11:38,970
we called it boothole.

247
00:11:38,970 --> 00:11:41,790
Basically, you find a bug in GRUB

248
00:11:41,790 --> 00:11:44,282
that allows you to do code execution.

249
00:11:44,282 --> 00:11:48,180
That is a short history of things.

250
00:11:48,180 --> 00:11:50,670
Basically, you can see by the years.

251
00:11:50,670 --> 00:11:53,970
There was one bug in 2015.
There was, we added, in 2020,

252
00:11:53,970 --> 00:11:56,550
we added some and others
added on top of us.

253
00:11:56,550 --> 00:11:58,110
2021, there were eight more.

254
00:11:58,110 --> 00:12:02,250
In 2022, there's just one for
now, as far as I can tell.

255
00:12:02,250 --> 00:12:06,450
But you can definitely see that
there is more attention put

256
00:12:06,450 --> 00:12:08,280
onto that area.

257
00:12:08,280 --> 00:12:09,113
Right. Yeah.

258
00:12:10,980 --> 00:12:12,360
If you wanna read more on that,

259
00:12:12,360 --> 00:12:16,410
I highly recommend go to
the GRUB, what's it called?

260
00:12:16,410 --> 00:12:18,138
The mailing list.

261
00:12:18,138 --> 00:12:20,163
There are links posted also.

262
00:12:23,340 --> 00:12:26,850
One last thing, not directly
Secure Boot bypasses,

263
00:12:26,850 --> 00:12:29,550
but can be used to bypass Secure Boot.

264
00:12:29,550 --> 00:12:31,950
There are vulnerabilities
that are being discovered

265
00:12:31,950 --> 00:12:34,540
on a regular basis, so
to speak, in firmware,

266
00:12:34,540 --> 00:12:39,540
where if you can code execution
in SMM, you can disable.

267
00:12:39,870 --> 00:12:41,640
Obviously, you can do horrible things,

268
00:12:41,640 --> 00:12:44,640
but you can also affect Secure Boot.

269
00:12:44,640 --> 00:12:46,980
Some of these examples are
the binary vulnerabilities,

270
00:12:46,980 --> 00:12:50,175
Sentinel One, ESET, Lenovo's ESET.

271
00:12:50,175 --> 00:12:54,950
And BSSA One is a good example
for debugging production.

272
00:12:54,950 --> 00:12:58,710
It tends to be a lot of
that happening in firmware,

273
00:12:58,710 --> 00:13:03,710
where you have code that is
not necessarily coded off.

274
00:13:05,130 --> 00:13:09,150
It's still there, but it's not dead code.

275
00:13:09,150 --> 00:13:12,720
You can still reach it in certain ways,

276
00:13:12,720 --> 00:13:16,230
but the vendors don't
really tend to remove it.

277
00:13:16,230 --> 00:13:19,743
In general, getting firmware versions,

278
00:13:19,743 --> 00:13:24,090
a lot of firmware versions is a big pain.

279
00:13:24,090 --> 00:13:27,314
So deploying a firmware version
to your fleet of devices.

280
00:13:27,314 --> 00:13:32,314
If you're Dell or HP or
Lenovo, you risk a lot.

281
00:13:32,370 --> 00:13:36,540
If you mess up one thing
and you end up breaking,

282
00:13:36,540 --> 00:13:38,857
I don't know, 100,000 computers,

283
00:13:38,857 --> 00:13:41,250
you end up paying for those.

284
00:13:41,250 --> 00:13:44,163
It's a lot of money for a software bug.

285
00:13:47,190 --> 00:13:49,710
So why care, right?

286
00:13:49,710 --> 00:13:51,960
Why do we need to even bypass Secure Boot?

287
00:13:51,960 --> 00:13:55,260
So we're all hackers and we
do security and stuff, right?

288
00:13:55,260 --> 00:13:58,500
So we want to have our
boots and roots embedded

289
00:13:58,500 --> 00:14:00,600
in the computer and have all our stuff.

290
00:14:00,600 --> 00:14:02,257
It's like off the old.

291
00:14:02,257 --> 00:14:03,757
Everybody knows, like,

292
00:14:03,757 --> 00:14:06,270
"Yeah, root kits, boot kits, security.

293
00:14:06,270 --> 00:14:11,270
Yeah. what's the APT or
adversaries, malicious actors.

294
00:14:12,270 --> 00:14:14,280
What's the word for today?

295
00:14:14,280 --> 00:14:17,630
There isn't even a minor attack
category for pre-OS boots.

296
00:14:17,630 --> 00:14:20,730
Stealth and persistence,
that's all you want, right?

297
00:14:20,730 --> 00:14:23,100
But I wanna talk a little bit more

298
00:14:23,100 --> 00:14:28,007
about the other side of things,
the normal people. Right?

299
00:14:29,481 --> 00:14:33,450
If you take aside security for
a second, how dare we, right?

300
00:14:33,450 --> 00:14:35,938
So let's put aside that
for a second and think,

301
00:14:35,938 --> 00:14:40,560
"Where else do we have a use
for a Secure Boot bypass?"

302
00:14:40,560 --> 00:14:43,020
So surprisingly, well, or unsurprisingly,

303
00:14:43,020 --> 00:14:45,630
if you're a gamer and you're cheating,

304
00:14:45,630 --> 00:14:47,910
anyone here cheats? Raise their hand.

305
00:14:47,910 --> 00:14:50,089
I hate you and you.

306
00:14:50,089 --> 00:14:52,590
(audience laughing)

307
00:14:52,590 --> 00:14:54,090
If you're cheating in multiplayer games,

308
00:14:54,090 --> 00:14:55,560
I especially hate you.

309
00:14:55,560 --> 00:14:58,980
So that's a big motivator.

310
00:14:58,980 --> 00:15:02,400
Turns out the cybersecurity
industry in 2021

311
00:15:02,400 --> 00:15:07,180
made about $130 billion in market share.

312
00:15:07,180 --> 00:15:10,470
The gaming e-sports was 155,

313
00:15:10,470 --> 00:15:12,521
or something like that, 160 billion.

314
00:15:12,521 --> 00:15:14,940
Anyway, it's a lot of aliens.

315
00:15:14,940 --> 00:15:19,132
It's huge. They're kind
of similar in amount,

316
00:15:19,132 --> 00:15:21,720
but there is a lot of money in gaming.

317
00:15:21,720 --> 00:15:26,597
And surprisingly, you can see these popups

318
00:15:26,597 --> 00:15:28,444
and notifications coming in

319
00:15:28,444 --> 00:15:32,190
regarding this specific
thing from the game.

320
00:15:32,190 --> 00:15:34,729
So this screenshot right
there on the right,

321
00:15:34,729 --> 00:15:37,960
I took it from Twitter where
a user was complaining, like,

322
00:15:37,960 --> 00:15:40,470
"Ugh, I can't play my game now."

323
00:15:40,470 --> 00:15:43,833
They demand TPM 2, and
that Secure Boot is on.

324
00:15:46,890 --> 00:15:50,880
Where have we ever heard TPM
and Secure Boot enforcement

325
00:15:50,880 --> 00:15:53,040
outside of an enterprise?

326
00:15:53,040 --> 00:15:55,290
It's unheard of.

327
00:15:55,290 --> 00:15:57,180
But now, anti-cheat.

328
00:15:57,180 --> 00:16:00,063
Anyone here from the gaming
industry anti-cheats?

329
00:16:02,880 --> 00:16:04,995
Keep doing the good work.

330
00:16:04,995 --> 00:16:08,220
Anti-cheats, I swear
to you, they are like,

331
00:16:08,220 --> 00:16:11,073
in some cases, they're insanely clever.

332
00:16:12,420 --> 00:16:13,503
So listen up.

333
00:16:15,630 --> 00:16:19,286
So in the open source community,

334
00:16:19,286 --> 00:16:22,863
there's Matti and there's Samuel Tulach.

335
00:16:24,030 --> 00:16:26,820
Samuel has, or Sam, I don't
know how, I'll say Samuel.

336
00:16:26,820 --> 00:16:27,920
Let's just say Samuel.

337
00:16:29,790 --> 00:16:33,720
Those two GitHub repos are very, very good

338
00:16:33,720 --> 00:16:37,650
if you are interested into
doing the pre-OS research

339
00:16:37,650 --> 00:16:39,400
and Secure Boot and all that stuff.

340
00:16:41,220 --> 00:16:46,220
The Samuel Tulach example here is a driver

341
00:16:46,290 --> 00:16:48,360
that loads during boot that allows you

342
00:16:48,360 --> 00:16:52,860
to communicate with the runtime
environment from the OS.

343
00:16:52,860 --> 00:16:54,543
So basically, you bypass the,

344
00:16:55,920 --> 00:16:58,140
you don't really need Ring 0.

345
00:16:58,140 --> 00:17:01,200
You can get direct memory access

346
00:17:01,200 --> 00:17:06,200
and do all kinds of things using hooks.

347
00:17:06,267 --> 00:17:08,880
Anyway, I'm not only
getting into that too much

348
00:17:08,880 --> 00:17:09,960
'cause that's not the point of the talk,

349
00:17:09,960 --> 00:17:13,110
but highly recommend you go look at it.

350
00:17:13,110 --> 00:17:14,910
He has also YouTube videos

351
00:17:14,910 --> 00:17:19,910
and it's extensively used
in the cheating forums.

352
00:17:21,090 --> 00:17:24,787
The other one, the Matti
one, the EfiGuard DXE,

353
00:17:27,210 --> 00:17:31,680
it's a very robust repository
that has a lot of features,

354
00:17:31,680 --> 00:17:33,877
including driver signature
enforcement bypasses.

355
00:17:33,877 --> 00:17:36,900
And it is maintained. It
is actively maintained.

356
00:17:36,900 --> 00:17:41,900
So highly recommend using
that for development,

357
00:17:42,090 --> 00:17:44,250
for learning, for trying to do new things,

358
00:17:44,250 --> 00:17:45,483
and so on and so forth.

359
00:17:46,470 --> 00:17:48,325
Now, that's the open
source, the good guys,

360
00:17:48,325 --> 00:17:51,060
the ones that wanna, "Hey
look, you can do this.

361
00:17:51,060 --> 00:17:53,760
Everyone here, let's
learn something together."

362
00:17:53,760 --> 00:17:56,856
And then there's those who
wanna make money off of it.

363
00:17:56,856 --> 00:18:01,533
There are cheats like this
one. It's called w3cheats.

364
00:18:02,580 --> 00:18:06,810
It's a website. If you go to
w3cheats.com or org or net,

365
00:18:06,810 --> 00:18:08,917
whatever XYZ it's called today. I forgot.

366
00:18:08,917 --> 00:18:13,917
And they sell you a file scheme.

367
00:18:17,310 --> 00:18:19,874
Basically, it's a file
structure of a bootloader

368
00:18:19,874 --> 00:18:22,500
that you put on the USB
and you boot off the USB.

369
00:18:22,500 --> 00:18:23,880
You select what kind of cheat you want,

370
00:18:23,880 --> 00:18:26,010
Apex Legends, Apex Legend, whatever other.

371
00:18:26,010 --> 00:18:28,470
I don't play Apex, so I don't
know what the versions is.

372
00:18:28,470 --> 00:18:33,210
And the CS:GO. If you play
CS:GO, my heart goes out to you.

373
00:18:33,210 --> 00:18:36,310
That's like the most abused
platform ever for cheaters

374
00:18:37,170 --> 00:18:38,763
from what we've seen, at least.

375
00:18:40,260 --> 00:18:44,363
So there's a video there
that their support published

376
00:18:44,363 --> 00:18:45,900
about how you do this.

377
00:18:45,900 --> 00:18:50,010
How do you get us to give you a license?

378
00:18:50,010 --> 00:18:54,060
You pay 30 or 40 euros and you
have to tell them who you are

379
00:18:54,060 --> 00:18:55,410
so they can assign a license key to you.

380
00:18:55,410 --> 00:18:57,912
They do it by getting a hardware ID.

381
00:18:57,912 --> 00:19:00,660
To do that, you have to plug in this USB.

382
00:19:00,660 --> 00:19:02,700
Is it playing? Yeah.

383
00:19:02,700 --> 00:19:05,460
You plug this USB, you have
to say, go to the boot order,

384
00:19:05,460 --> 00:19:08,640
go boot from this UEFI USB partition.

385
00:19:08,640 --> 00:19:10,920
And then it goes, it
loads their bootloader

386
00:19:10,920 --> 00:19:13,597
and then gives you a menu,
"Which one do you wanna cheat?"

387
00:19:13,597 --> 00:19:15,541
"Oh, I want the w3 hardware ID."

388
00:19:15,541 --> 00:19:17,041
They write it to a text file.

389
00:19:17,041 --> 00:19:19,682
Then you get the USB stick out.

390
00:19:19,682 --> 00:19:24,570
You send that hardware ID to
their, well, in their website,

391
00:19:24,570 --> 00:19:26,493
there's a text box, you put it there.

392
00:19:27,990 --> 00:19:30,270
And then you get a user.
They know who you are.

393
00:19:30,270 --> 00:19:31,103
It's a unique ID.

394
00:19:31,103 --> 00:19:34,571
And then you can pay and
cheat to your heart's content.

395
00:19:34,571 --> 00:19:39,571
That was the most
simplistic cheating website,

396
00:19:39,874 --> 00:19:42,901
about 300, 400 users.

397
00:19:42,901 --> 00:19:45,513
This one, holy crap.

398
00:19:47,130 --> 00:19:50,340
You go to their website,
the FaceIT cheats.

399
00:19:50,340 --> 00:19:55,340
It's like a full on normal product.

400
00:19:55,350 --> 00:19:58,320
There's like a portfolio
of things you can buy.

401
00:19:58,320 --> 00:20:03,180
You can get a spoofer. You
can get a premium cheat,

402
00:20:03,180 --> 00:20:04,350
a cheat plus spoofer.

403
00:20:04,350 --> 00:20:08,075
But the one I want to
focus on is the URAN.

404
00:20:08,075 --> 00:20:12,450
I don't know why it's called
URAN, not IRAN or whatever,

405
00:20:12,450 --> 00:20:15,930
but that one popped up into our radar

406
00:20:15,930 --> 00:20:17,640
because it uses a bootloader.

407
00:20:17,640 --> 00:20:22,640
And it has capability
of adding code execution

408
00:20:23,490 --> 00:20:24,363
before the boot.

409
00:20:25,890 --> 00:20:27,640
Highly recommend looking into that.

410
00:20:28,830 --> 00:20:30,423
A few other small examples.

411
00:20:31,710 --> 00:20:35,910
The other games that I didn't
mention are listed here.

412
00:20:35,910 --> 00:20:40,910
So ZwHax is a cheating gaming,
gaming-cheating website

413
00:20:41,400 --> 00:20:42,750
that's no longer available.

414
00:20:44,160 --> 00:20:47,650
Exodus Production, and
what's it called? Sellix.

415
00:20:50,577 --> 00:20:53,430
Also, the ZW product had a leak.

416
00:20:53,430 --> 00:20:58,430
So their source code leaked
for their Valorant ESP Aimbot.

417
00:21:00,570 --> 00:21:01,403
Go have fun.

418
00:21:02,850 --> 00:21:05,297
And I'm gonna wrap up
this gaming part with,

419
00:21:05,297 --> 00:21:07,287
one of the most important
things I can tell you

420
00:21:07,287 --> 00:21:09,674
if you're in a security community,

421
00:21:09,674 --> 00:21:11,257
Hombre said it best.

422
00:21:11,257 --> 00:21:12,090
"If you have a question

423
00:21:12,090 --> 00:21:14,220
about some Windows kernel data structure,

424
00:21:14,220 --> 00:21:16,350
there's a 50% chance the
best person to talk to

425
00:21:16,350 --> 00:21:18,777
is a 16 year old on a game-hacking forum."

426
00:21:20,790 --> 00:21:23,572
UnKnoWnCheaTs is one of
those game hacking forums.

427
00:21:23,572 --> 00:21:25,143
Holy crap.

428
00:21:26,610 --> 00:21:30,420
I've seen more technical
discussions in the forum there

429
00:21:30,420 --> 00:21:32,160
than I've seen anywhere else

430
00:21:32,160 --> 00:21:35,490
for deep kernel structures and pointers.

431
00:21:35,490 --> 00:21:38,133
And they analyze the games intensely.

432
00:21:40,680 --> 00:21:42,843
Okay. Now, switching gears a little bit.

433
00:21:44,610 --> 00:21:47,700
We know that Secure Boot is a problem.

434
00:21:47,700 --> 00:21:51,870
If we find an issue, how do
we usually deal with this?

435
00:21:51,870 --> 00:21:54,240
So the simplest way is by design,

436
00:21:54,240 --> 00:21:56,580
there is something called DBX,

437
00:21:56,580 --> 00:22:00,150
which is the revocation database

438
00:22:00,150 --> 00:22:02,610
for whatever hashes you
don't want the system to load

439
00:22:02,610 --> 00:22:03,633
for the binaries.

440
00:22:05,190 --> 00:22:08,970
The best example for how this can go wrong

441
00:22:08,970 --> 00:22:13,970
was when the Kaspersky Rescue
Disk bootloader issue came up,

442
00:22:14,670 --> 00:22:18,330
Microsoft issued an update
that lasted about a week

443
00:22:18,330 --> 00:22:20,250
before they pulled it.

444
00:22:20,250 --> 00:22:23,310
And they pulled it because a
lot of systems were not booting

445
00:22:23,310 --> 00:22:24,750
and there were problems with it

446
00:22:24,750 --> 00:22:26,274
and there were issues with it.

447
00:22:26,274 --> 00:22:29,220
Anyway, I'm gonna let you guess

448
00:22:29,220 --> 00:22:31,560
what happened this time around,

449
00:22:31,560 --> 00:22:33,360
but yeah, no secret.

450
00:22:33,360 --> 00:22:35,010
They patched it with Windows thing.

451
00:22:35,010 --> 00:22:39,057
Anyway, so there's by
design, there's a DBX.

452
00:22:39,057 --> 00:22:41,010
You update it. That's how
it's supposed to work.

453
00:22:41,010 --> 00:22:43,290
That's from the UFI specifications.

454
00:22:43,290 --> 00:22:44,640
That's how it was designed.

455
00:22:45,690 --> 00:22:47,340
So how you undo this?

456
00:22:47,340 --> 00:22:48,690
Let's say you had a fix deployed,

457
00:22:48,690 --> 00:22:49,523
but you don't want to.

458
00:22:49,523 --> 00:22:50,670
And you're a cheater and they hate you,

459
00:22:50,670 --> 00:22:51,660
and you wanna play this game

460
00:22:51,660 --> 00:22:53,933
and you wanna use this
bootloader or whatever.

461
00:22:55,350 --> 00:22:58,980
This is an example of how
it works on a Dell laptop.

462
00:22:58,980 --> 00:23:01,560
So what you do is you go into BIOS.

463
00:23:01,560 --> 00:23:03,960
This should work on most systems.

464
00:23:03,960 --> 00:23:05,557
You go into BIOS, you go like,

465
00:23:05,557 --> 00:23:07,920
"I'm gonna go into the Secure Boot menu.

466
00:23:07,920 --> 00:23:09,650
And in the Secure Boot
menu, I'm gonna tell it,

467
00:23:09,650 --> 00:23:11,720
'I wanna load my custom keys.'"

468
00:23:13,020 --> 00:23:15,660
So you go and you say,
"Enable custom mode."

469
00:23:15,660 --> 00:23:17,550
And then you go and you select DBX.

470
00:23:17,550 --> 00:23:20,452
And then you say, "Delete
DBX. I don't want it."

471
00:23:20,452 --> 00:23:24,240
And then you go like, "You
know what? I changed my mind.

472
00:23:24,240 --> 00:23:25,587
Disabled the custom mode."

473
00:23:26,580 --> 00:23:29,220
What happened there was,
you basically told the BIOS

474
00:23:29,220 --> 00:23:32,670
to go with its BIOS level permissions

475
00:23:32,670 --> 00:23:35,100
to exchange the current value of DBX

476
00:23:35,100 --> 00:23:38,610
with a default value that
came with the firmware.

477
00:23:38,610 --> 00:23:42,720
Right. So now, if your DBX was
updated and it was included

478
00:23:42,720 --> 00:23:46,620
with hashes that were like,
the GRUB, for example,

479
00:23:46,620 --> 00:23:48,630
had the bootloader hash
was included in there

480
00:23:48,630 --> 00:23:50,040
and now, you can't boot it.

481
00:23:50,040 --> 00:23:53,370
You go, you tell the
BIOS like, "Delete it."

482
00:23:53,370 --> 00:23:54,810
And then it deletes it.

483
00:23:54,810 --> 00:23:56,606
So the action is done at that point.

484
00:23:56,606 --> 00:23:58,890
When you go and you revert
back to normal mode,

485
00:23:58,890 --> 00:24:02,490
it doesn't bring back the updated DBX.

486
00:24:02,490 --> 00:24:03,790
It just stays the default.

487
00:24:06,450 --> 00:24:08,417
So things can be undone.

488
00:24:08,417 --> 00:24:09,250
Okay.

489
00:24:10,800 --> 00:24:12,852
Fun parts, vulnerabilities,

490
00:24:12,852 --> 00:24:14,310
"Lord of the Ring" caused me

491
00:24:14,310 --> 00:24:16,353
of how a vulnerability is exploited.

492
00:24:18,150 --> 00:24:18,983
There you go.

493
00:24:18,983 --> 00:24:21,420
If you know the movie,
you know what it means.

494
00:24:21,420 --> 00:24:24,321
We have three vulnerabilities

495
00:24:24,321 --> 00:24:27,840
that we categorize in
two separate classes.

496
00:24:27,840 --> 00:24:29,520
One class that we're gonna start with

497
00:24:29,520 --> 00:24:32,733
is the signed UEFI Shell.

498
00:24:34,007 --> 00:24:39,007
A UEFI Shell is basically like a DOS Shell

499
00:24:39,060 --> 00:24:40,560
or a command prompt shell

500
00:24:40,560 --> 00:24:44,490
that the UEFI framework gives you to use.

501
00:24:44,490 --> 00:24:49,490
In this case, we found two products

502
00:24:49,500 --> 00:24:53,190
that have their own bootloader
signed, their own shim

503
00:24:53,190 --> 00:24:55,260
that loads among other files

504
00:24:55,260 --> 00:24:57,420
that are signed by that company.

505
00:24:57,420 --> 00:25:01,560
One of them is a UEFI
shell. So Secure Boot is on.

506
00:25:01,560 --> 00:25:03,000
It gets a bootloader that's trusted.

507
00:25:03,000 --> 00:25:03,833
The bootloader goes like,

508
00:25:03,833 --> 00:25:05,070
"Oh, fine. What do you
want me to load now?"

509
00:25:05,070 --> 00:25:06,960
And we tell him, "Go load that file."

510
00:25:06,960 --> 00:25:09,277
Or it's a hardcoded path
in that shim that goes,

511
00:25:09,277 --> 00:25:10,740
"Ah, next file to load is this."

512
00:25:10,740 --> 00:25:13,080
And you just rename the shell

513
00:25:13,080 --> 00:25:16,293
to whatever next file it's
expecting and it'll just load it.

514
00:25:18,690 --> 00:25:20,130
So what can you do with it?

515
00:25:20,130 --> 00:25:23,700
So the UEFI shell is inherently comes

516
00:25:23,700 --> 00:25:25,233
with a lot of tools in it.

517
00:25:26,640 --> 00:25:29,190
Obviously, DIR list files,

518
00:25:29,190 --> 00:25:30,930
good change directories, the usual stuff,

519
00:25:30,930 --> 00:25:34,830
but it also has cool things,
like write to memory.

520
00:25:34,830 --> 00:25:38,210
You can talk to PCI devices, IO ports.

521
00:25:38,210 --> 00:25:40,710
What else am I missing?

522
00:25:40,710 --> 00:25:42,458
All kinds of stuff.

523
00:25:42,458 --> 00:25:44,280
- Yeah. Wait.

524
00:25:44,280 --> 00:25:46,230
Yeah. Basically there's a bunch of,

525
00:25:46,230 --> 00:25:48,600
it's more of a debug tool that's,

526
00:25:48,600 --> 00:25:50,520
doesn't usually ship with both systems,

527
00:25:50,520 --> 00:25:53,790
but you can find on some,
but it's not usually signed,

528
00:25:53,790 --> 00:25:56,186
but it has things like
read-write physical memory,

529
00:25:56,186 --> 00:26:00,690
list handles, find the addresses
that things are loaded at,

530
00:26:00,690 --> 00:26:01,680
other things like that.

531
00:26:01,680 --> 00:26:04,353
And it's a really useful tool to have.

532
00:26:06,300 --> 00:26:07,900
- Not good if you want security.

533
00:26:09,450 --> 00:26:12,180
The beautiful part of it is in,

534
00:26:12,180 --> 00:26:14,100
by default, in the UEFI shell,

535
00:26:14,100 --> 00:26:17,010
it looks for a startup.nsh script.

536
00:26:17,010 --> 00:26:18,870
So if you do want to have a backdoor

537
00:26:18,870 --> 00:26:23,460
or something automated on a
system, you can put a script in

538
00:26:23,460 --> 00:26:24,900
and it will just execute
it every time it boots.

539
00:26:24,900 --> 00:26:27,180
So it waits five, usually
waits five seconds,

540
00:26:27,180 --> 00:26:28,740
executes the script, and then it runs.

541
00:26:28,740 --> 00:26:32,976
In the GitHub, there is an
example of a script in the demos

542
00:26:32,976 --> 00:26:35,610
that searches all the drives

543
00:26:35,610 --> 00:26:38,130
for the Windows boot manager and loads it,

544
00:26:38,130 --> 00:26:40,230
if you wanna use your own boot sequence

545
00:26:40,230 --> 00:26:41,730
and then just pop the Windows.

546
00:26:43,260 --> 00:26:44,130
A couple of demos.

547
00:26:44,130 --> 00:26:49,130
So this one is available in the GitHub.

548
00:26:50,430 --> 00:26:54,270
So all you need is QEMU.

549
00:26:54,270 --> 00:26:56,970
Download this. This is like
10 megs or there's 8 megs.

550
00:26:56,970 --> 00:26:59,880
It's a QEMU image of VMF image of a BIOS

551
00:26:59,880 --> 00:27:02,790
that has the Secure Boot enabled.

552
00:27:02,790 --> 00:27:05,100
So if you wanna play with it
in a controlled environment

553
00:27:05,100 --> 00:27:07,290
and debug with it and
play with it, the scripts,

554
00:27:07,290 --> 00:27:09,840
everything you're gonna see is in there.

555
00:27:09,840 --> 00:27:12,633
So please feel free to just
download and play with it.

556
00:27:14,112 --> 00:27:17,130
You boot the system. It
boots into UEFI shell.

557
00:27:17,130 --> 00:27:18,821
That's how it looks.

558
00:27:18,821 --> 00:27:22,650
I go into the drive. I try to run the EFI.

559
00:27:22,650 --> 00:27:23,880
It says, no access denied.

560
00:27:23,880 --> 00:27:25,680
I run the patch.

561
00:27:25,680 --> 00:27:28,830
And I try to run it again and it runs it.

562
00:27:28,830 --> 00:27:30,420
Right. We're gonna talk further.

563
00:27:30,420 --> 00:27:32,100
Later on, we're gonna talk
exactly what the patch is

564
00:27:32,100 --> 00:27:33,213
and how it's done.

565
00:27:35,340 --> 00:27:38,070
In a more of a real world environment,

566
00:27:38,070 --> 00:27:39,720
this is how it's done.

567
00:27:39,720 --> 00:27:40,983
If you have,

568
00:27:42,900 --> 00:27:47,900
this is a Dell 5520, Dell added to 5520.

569
00:27:48,003 --> 00:27:52,777
So you have a computer, you go into it.

570
00:27:52,777 --> 00:27:53,613
Okay.

571
00:27:54,998 --> 00:27:56,280
We check.

572
00:27:56,280 --> 00:27:59,283
We we're not lying. This
is Secure Boot enabled.

573
00:28:00,180 --> 00:28:01,013
Right.

574
00:28:07,500 --> 00:28:08,613
Restart.

575
00:28:12,450 --> 00:28:14,160
One time boot menu.

576
00:28:14,160 --> 00:28:15,963
We select the USB to boot from.

577
00:28:19,140 --> 00:28:21,300
Don't be scared with all the drives.

578
00:28:21,300 --> 00:28:23,430
Dell has a lot of partitions.

579
00:28:23,430 --> 00:28:26,400
We tried to run the file.
It says, does not recognize.

580
00:28:26,400 --> 00:28:27,900
We patch it.

581
00:28:27,900 --> 00:28:30,570
And then we run the file
again. It says, "Hello, world."

582
00:28:30,570 --> 00:28:32,460
Then there was like, "Okay,
we hackers, we have to do,

583
00:28:32,460 --> 00:28:34,910
put in a skull, ASCII
skull. We got ASCII skull."

584
00:28:35,910 --> 00:28:37,680
And now, we just continue
to boot into Windows.

585
00:28:37,680 --> 00:28:40,350
Right. We slowly type
boot manager for Windows

586
00:28:40,350 --> 00:28:44,790
and we're back in business.

587
00:28:44,790 --> 00:28:48,630
And we need to show you that
Secure Boot is still on.

588
00:28:48,630 --> 00:28:50,550
All right. We obviously show
that Secure Boot is off.

589
00:28:50,550 --> 00:28:51,383
Wait. Wait.

590
00:28:51,383 --> 00:28:52,413
Don't clap yet.

591
00:29:01,260 --> 00:29:02,765
And Secure Boot is on.

592
00:29:02,765 --> 00:29:03,933
Thank you.

593
00:29:03,933 --> 00:29:07,100
(audience applauding)

594
00:29:09,750 --> 00:29:14,750
Well, I don't know
exactly why it stays on,

595
00:29:16,560 --> 00:29:20,043
but it's funny.

596
00:29:20,997 --> 00:29:23,504
Now, to the best one, right?

597
00:29:23,504 --> 00:29:24,750
That's the last.

598
00:29:24,750 --> 00:29:25,950
So we said two categories, right?

599
00:29:25,950 --> 00:29:27,990
One was the UEFI signed shells.

600
00:29:27,990 --> 00:29:30,420
The other one, I don't
know how to call it.

601
00:29:30,420 --> 00:29:34,002
It's basically do whatever you want.

602
00:29:34,002 --> 00:29:39,002
This bootloader, this shim
is signed by Microsoft.

603
00:29:40,800 --> 00:29:44,507
And in it, we're gonna
show you in a second.

604
00:29:44,507 --> 00:29:46,147
When we looked at it, it was like,

605
00:29:46,147 --> 00:29:47,640
"What the hell is going on?"

606
00:29:47,640 --> 00:29:52,537
It basically looks for that
file name, the shdmgr.ef_,

607
00:29:54,090 --> 00:29:55,980
and loads it and runs it.

608
00:29:55,980 --> 00:29:59,733
But it does it manually to
bypass the security checks,

609
00:30:00,960 --> 00:30:02,360
which like, "What the hell?"

610
00:30:03,690 --> 00:30:07,080
So we looked in it. 73 kilobytes, right?

611
00:30:07,080 --> 00:30:08,927
Tiny file. Throw it into Binja.

612
00:30:08,927 --> 00:30:10,110
Look at it.

613
00:30:10,110 --> 00:30:11,790
And it's like, start image.

614
00:30:11,790 --> 00:30:14,430
And the new, EFI there's
load image and start image.

615
00:30:14,430 --> 00:30:16,140
There's no underscores. It's
load image, start image.

616
00:30:16,140 --> 00:30:21,060
And even if we ran the EFI
plugin to pass everything

617
00:30:21,060 --> 00:30:23,550
to make it look nice,
you would still see it,

618
00:30:23,550 --> 00:30:24,660
like load image, start image.

619
00:30:24,660 --> 00:30:28,080
But when we saw this, it
was like, "Okay. What?

620
00:30:28,080 --> 00:30:30,150
why is there a custom
start image program?"

621
00:30:30,150 --> 00:30:33,540
And in there, you'd see
that it looks to follow up

622
00:30:33,540 --> 00:30:36,600
and jumps to the start of the code in it.

623
00:30:36,600 --> 00:30:41,600
This is a much better bypass
from an adversarial perspective

624
00:30:42,570 --> 00:30:47,460
or game cheat perspective,

625
00:30:47,460 --> 00:30:49,230
because you don't have
to have the full GRUB

626
00:30:49,230 --> 00:30:50,310
and all the files and everything

627
00:30:50,310 --> 00:30:52,710
to copy a bajillion files over.

628
00:30:52,710 --> 00:30:54,600
Just need the one file.

629
00:30:54,600 --> 00:30:55,860
That's it.

630
00:30:55,860 --> 00:31:00,552
And caveat here, 73 kilobytes
is the sample that we have.

631
00:31:00,552 --> 00:31:04,741
We don't know how many samples
there are of this bootloader

632
00:31:04,741 --> 00:31:08,433
'cause Microsoft doesn't tell you.

633
00:31:10,050 --> 00:31:12,114
We'll get into that in a second.

634
00:31:12,114 --> 00:31:15,668
There are samples of this that
are even smaller than that,

635
00:31:15,668 --> 00:31:18,622
it's like 36 or 40 something kilobytes,

636
00:31:18,622 --> 00:31:20,970
but we haven't gotten
a chance to use them.

637
00:31:20,970 --> 00:31:22,323
We got this. It works.

638
00:31:24,210 --> 00:31:28,563
Even if it is patched, you
could revert it and have fun.

639
00:31:31,710 --> 00:31:36,710
Oh, so part of the releasing
GitHub is that we wrote a tool

640
00:31:37,639 --> 00:31:40,650
that we're gonna describe
in a second, that does,

641
00:31:40,650 --> 00:31:43,860
we call it un-SecureBoot or un-SB.

642
00:31:43,860 --> 00:31:45,060
Basically, what it does,

643
00:31:45,060 --> 00:31:48,180
it looks for the security
two architecture protocol

644
00:31:48,180 --> 00:31:50,310
and the security arch protocol,

645
00:31:50,310 --> 00:31:55,310
and finds those handlers, find
the pointers to the handles.

646
00:31:56,520 --> 00:31:58,563
And we'll, it's the next slide.

647
00:31:59,850 --> 00:32:00,683
You wanna talk about this?

648
00:32:00,683 --> 00:32:01,516
- Yeah.

649
00:32:01,516 --> 00:32:04,920
So one of the reasons that
we wanted to have this tool

650
00:32:04,920 --> 00:32:07,590
that what we're gonna talk
about right here is that,

651
00:32:07,590 --> 00:32:10,050
that bootloader that we just talked about,

652
00:32:10,050 --> 00:32:11,850
just the next single file

653
00:32:11,850 --> 00:32:15,180
that you load will be unsigned code.

654
00:32:15,180 --> 00:32:18,240
I don't want to write my own
loader to load other stuff

655
00:32:18,240 --> 00:32:20,370
if I wanna run a bunch of other things.

656
00:32:20,370 --> 00:32:22,677
If I want to use the
standard UEFI load image

657
00:32:22,677 --> 00:32:25,410
and start image, it'll go
through the security checks

658
00:32:25,410 --> 00:32:27,450
and disable me from loading

659
00:32:27,450 --> 00:32:30,090
or prevent me from loading
additional unsigned code.

660
00:32:30,090 --> 00:32:33,720
So although we have unsigned
code running initially,

661
00:32:33,720 --> 00:32:35,790
we wanna make it easy
for us to just go ahead

662
00:32:35,790 --> 00:32:37,112
and run whatever we want

663
00:32:37,112 --> 00:32:40,380
without writing our own
loader like these guys did.

664
00:32:40,380 --> 00:32:43,500
So I mentioned the protocols before

665
00:32:43,500 --> 00:32:44,850
that security architecture protocol

666
00:32:44,850 --> 00:32:46,851
and security two protocol,

667
00:32:46,851 --> 00:32:49,456
you can literally just
call locate protocol

668
00:32:49,456 --> 00:32:50,700
and give it the GUID,

669
00:32:50,700 --> 00:32:52,500
and it'll give you a
pointer to the structure

670
00:32:52,500 --> 00:32:55,276
that has a function that will be called

671
00:32:55,276 --> 00:32:57,219
when it's doing the security check.

672
00:32:57,219 --> 00:33:00,796
So you literally can just write,

673
00:33:00,796 --> 00:33:02,700
like patch it here directly.

674
00:33:02,700 --> 00:33:05,670
There's no memory
protection at this point,

675
00:33:05,670 --> 00:33:08,880
UEFI is essentially
running single-threaded

676
00:33:08,880 --> 00:33:13,110
and doing callbacks instead of
having any kind of isolation

677
00:33:13,110 --> 00:33:14,850
between processes and things like that.

678
00:33:14,850 --> 00:33:18,330
So we can literally just
do reference the pointer

679
00:33:18,330 --> 00:33:21,150
to this function, patch whatever we want.

680
00:33:21,150 --> 00:33:24,480
In this case, we just wrote
two instructions to do,

681
00:33:24,480 --> 00:33:27,270
move 0 RAX in return.

682
00:33:27,270 --> 00:33:31,650
And that 0 is essentially
the EFI success value.

683
00:33:31,650 --> 00:33:34,710
And because the security check
that something else is going

684
00:33:34,710 --> 00:33:37,920
to call is gonna just get EFI success,

685
00:33:37,920 --> 00:33:39,960
it'll go ahead and run whatever you want,

686
00:33:39,960 --> 00:33:41,490
no matter if the signature is broken

687
00:33:41,490 --> 00:33:43,530
or a signature doesn't exist or whatever.

688
00:33:43,530 --> 00:33:45,720
So it's a really easy fix.

689
00:33:45,720 --> 00:33:50,160
This also prevents further
measurements into the TPM

690
00:33:50,160 --> 00:33:53,670
from this point forward
until the bootloader

691
00:33:53,670 --> 00:33:56,910
or something else starts
taking over that process.

692
00:33:56,910 --> 00:33:59,280
So any measurements and
anything that you run

693
00:33:59,280 --> 00:34:00,998
in the UEFI environment

694
00:34:00,998 --> 00:34:03,240
from the point that you
overwrite this function

695
00:34:03,240 --> 00:34:05,850
is not gonna be measured
into the TPM anymore.

696
00:34:05,850 --> 00:34:06,683
So at that point,

697
00:34:06,683 --> 00:34:10,740
we can just call the boot
services functions to load image,

698
00:34:10,740 --> 00:34:14,400
and start image and run whatever we want.

699
00:34:14,400 --> 00:34:17,940
So there, you don't need to
write any fancy shell code,

700
00:34:17,940 --> 00:34:20,006
like search through structures

701
00:34:20,006 --> 00:34:22,470
or do egg hunting or anything like that.

702
00:34:22,470 --> 00:34:25,350
You can just patch the pointer

703
00:34:25,350 --> 00:34:26,730
because you get a pointer.

704
00:34:26,730 --> 00:34:28,860
You can basically look up
a pointer to the function

705
00:34:28,860 --> 00:34:30,697
that you wanna patch, override that,

706
00:34:30,697 --> 00:34:33,542
and then just run whatever you want.

707
00:34:33,542 --> 00:34:37,500
- So if you look at the code,
run you through this example.

708
00:34:37,500 --> 00:34:41,820
The first part is you
patched the handlers.

709
00:34:41,820 --> 00:34:45,120
And from that point on, you
can run whatever you want.

710
00:34:45,120 --> 00:34:47,310
This is also in the GitHub.

711
00:34:47,310 --> 00:34:49,936
We load a shell binary,

712
00:34:49,936 --> 00:34:53,460
but the shell that we load is a one

713
00:34:53,460 --> 00:34:56,340
that we patched off all
the console, console out.

714
00:34:56,340 --> 00:34:58,890
So it's like a silent shell,

715
00:34:58,890 --> 00:35:01,440
which allows you to
script whatever you want

716
00:35:01,440 --> 00:35:04,530
without anything showing on the screen.

717
00:35:04,530 --> 00:35:06,483
It's handy if you want to use it.

718
00:35:07,710 --> 00:35:09,616
And you can do whatever calls you want.

719
00:35:09,616 --> 00:35:12,360
You can even be done, patch it back,

720
00:35:12,360 --> 00:35:15,663
and then can resume
operations if you'd like.

721
00:35:17,520 --> 00:35:22,080
And now, we're gonna switch
it a little bit to software.

722
00:35:22,080 --> 00:35:24,420
But before that, if you're in Windows

723
00:35:24,420 --> 00:35:27,480
and you want to mount
the EFI system partition

724
00:35:27,480 --> 00:35:29,490
and change files, change a bootloader,

725
00:35:29,490 --> 00:35:32,820
you need to be admin, right?

726
00:35:32,820 --> 00:35:37,820
But the, what's it's, it's called service?

727
00:35:38,280 --> 00:35:39,650
Well, Microsoft.

728
00:35:39,650 --> 00:35:42,780
- Microsoft has a Windows
servicing criteria

729
00:35:42,780 --> 00:35:45,720
where they decide these are
the types of vulnerabilities

730
00:35:45,720 --> 00:35:47,250
that they will fix.

731
00:35:47,250 --> 00:35:49,440
They do not consider UAC bypass

732
00:35:49,440 --> 00:35:52,200
to be a serviceable vulnerability.

733
00:35:52,200 --> 00:35:53,910
They might fix it at
some point in the future,

734
00:35:53,910 --> 00:35:54,780
but they might not.

735
00:35:54,780 --> 00:35:59,780
So going from user to admin
is not exactly difficult.

736
00:36:00,450 --> 00:36:03,109
- Yeah. And there's a lot
of examples for this online.

737
00:36:03,109 --> 00:36:04,823
There's UACMe on GitHub.

738
00:36:04,823 --> 00:36:08,250
There's a set of what, 60 or 90 examples

739
00:36:08,250 --> 00:36:11,100
of how to bypass UAC.

740
00:36:11,100 --> 00:36:15,480
But in our case, we found something

741
00:36:15,480 --> 00:36:18,420
that we're gonna call LOL Installers.

742
00:36:18,420 --> 00:36:22,710
Anyone here familiar with LOL
binaries? Raise your hand.

743
00:36:22,710 --> 00:36:24,930
LOLBins, have you heard that term?

744
00:36:24,930 --> 00:36:26,190
Okay, cool. There's a lot of people.

745
00:36:26,190 --> 00:36:29,940
So for those who did not,
LOLBins are basically binaries

746
00:36:29,940 --> 00:36:31,980
that are already exist in
the system that are trusted,

747
00:36:31,980 --> 00:36:35,013
but you can use them to side
load something that's not.

748
00:36:35,991 --> 00:36:37,680
But in this case,

749
00:36:37,680 --> 00:36:40,320
what I call LOL Installer
has to match a criteria.

750
00:36:40,320 --> 00:36:43,491
Now, it's not the lame DLL load

751
00:36:43,491 --> 00:36:46,080
and the DLL side load shit, no.

752
00:36:46,080 --> 00:36:47,850
This has to be considered.

753
00:36:47,850 --> 00:36:50,940
The LOL Installer has
to be a sign installer

754
00:36:50,940 --> 00:36:55,940
from a major brand, major
OEM that blindlessly load,

755
00:36:56,190 --> 00:36:57,843
loads an unsigned executable.

756
00:36:58,890 --> 00:37:01,413
If you match that, that's a LOL Installer.

757
00:37:03,540 --> 00:37:07,980
This example, we started
with a real tech on the left.

758
00:37:07,980 --> 00:37:10,080
We found one of those.
It's a setup for a driver.

759
00:37:10,080 --> 00:37:11,973
That's from real tech.

760
00:37:12,840 --> 00:37:15,660
It looks nice. You go,
you send a phish email.

761
00:37:15,660 --> 00:37:18,010
Look, you had to install
this real tech driver,

762
00:37:19,050 --> 00:37:21,210
but it looks lame 'cause
the icon is crappy.

763
00:37:21,210 --> 00:37:25,470
So we found a Microsoft
one, so super, super legit.

764
00:37:25,470 --> 00:37:27,480
By the way, both of
these are in the GitHub.

765
00:37:27,480 --> 00:37:32,130
If you wanna play with a UAC arbitrary,

766
00:37:32,130 --> 00:37:35,328
UAC bin, LOL, whatever,

767
00:37:35,328 --> 00:37:38,250
there's a Microsoft example in the GitHub.

768
00:37:38,250 --> 00:37:40,410
What it does, it's set up that DXE.

769
00:37:40,410 --> 00:37:42,720
You run, pops up that logo,

770
00:37:42,720 --> 00:37:45,150
which you're gonna see
in a second in a demo,

771
00:37:45,150 --> 00:37:47,910
and runs stuff in as admin.

772
00:37:47,910 --> 00:37:51,390
So again, how did this work?

773
00:37:51,390 --> 00:37:56,390
How do we infect a system using this?

774
00:37:56,951 --> 00:38:00,330
So this is the same Dell, 5520.

775
00:38:00,330 --> 00:38:02,730
We boot it up. Normal.

776
00:38:02,730 --> 00:38:05,730
You see there's nothing on the
screen. There's no red skull.

777
00:38:07,020 --> 00:38:07,953
We log in.

778
00:38:08,910 --> 00:38:09,843
We check email.

779
00:38:11,340 --> 00:38:16,110
Oh look, we have an email from
microsoft@update.management.

780
00:38:16,110 --> 00:38:18,300
We must install this attachment.

781
00:38:18,300 --> 00:38:20,790
Oh, what is this? Click on it.

782
00:38:20,790 --> 00:38:24,304
It's too old. I must enable
content to view what's in it.

783
00:38:24,304 --> 00:38:25,710
Okay.

784
00:38:25,710 --> 00:38:26,820
I click on it. What happens?

785
00:38:26,820 --> 00:38:30,180
Oh, look at that. Very suspicious.

786
00:38:30,180 --> 00:38:31,290
I must not trust this.

787
00:38:31,290 --> 00:38:32,850
What is this? Is this signed?

788
00:38:32,850 --> 00:38:34,560
Yeah. Looks legit.

789
00:38:34,560 --> 00:38:36,600
I'm not sure what I'm looking for

790
00:38:36,600 --> 00:38:38,460
and the certificate's okay.

791
00:38:38,460 --> 00:38:39,293
Right. I'm a dumb user.

792
00:38:39,293 --> 00:38:40,470
What do I know?

793
00:38:40,470 --> 00:38:41,591
Click yes.

794
00:38:41,591 --> 00:38:44,370
Oh, this must be related to
this update that they gave me.

795
00:38:44,370 --> 00:38:45,203
I don't know.

796
00:38:46,320 --> 00:38:47,370
It's installing something.

797
00:38:47,370 --> 00:38:50,310
Driver's update, set up installing.

798
00:38:50,310 --> 00:38:51,150
Okay. I'll wait.

799
00:38:51,150 --> 00:38:52,560
Oh, crap. It's gonna sign me out.

800
00:38:52,560 --> 00:38:53,971
Done.

801
00:38:53,971 --> 00:38:56,193
It's IT's will.

802
00:38:57,330 --> 00:38:59,340
So we have a red skull.

803
00:38:59,340 --> 00:39:01,533
The bootloaders have been swapped.

804
00:39:05,160 --> 00:39:10,160
And also did the usual
WPBT Microsoft backdoor

805
00:39:10,898 --> 00:39:13,710
where you drop a file.

806
00:39:13,710 --> 00:39:17,163
You can check out WPBT
contents later online.

807
00:39:18,090 --> 00:39:22,683
So now, we booted with
the implant infected.

808
00:39:26,400 --> 00:39:30,750
So we check the device security.
Secure Boot is still on.

809
00:39:30,750 --> 00:39:32,550
Everything's fine.

810
00:39:32,550 --> 00:39:33,573
Looking good.

811
00:39:34,500 --> 00:39:35,763
It's not over yet. Wait.

812
00:39:38,700 --> 00:39:40,380
There's no detections, no infections.

813
00:39:40,380 --> 00:39:42,090
The virus is good.

814
00:39:42,090 --> 00:39:43,620
All right. I can keep working.

815
00:39:43,620 --> 00:39:46,473
I was, it just gotta
scare. I'm just paranoid.

816
00:39:49,200 --> 00:39:51,050
But there's an executable in startup.

817
00:39:53,490 --> 00:39:55,800
So we switched to the
attacker perspective.

818
00:39:55,800 --> 00:39:57,180
Of course, all hackers run Windows

819
00:39:57,180 --> 00:39:58,380
even if they're running malware.

820
00:39:58,380 --> 00:40:03,123
And then they run this DcRat
tool that we found on GitHub.

821
00:40:04,440 --> 00:40:07,530
Anyway, there's a connect
back to that machine.

822
00:40:07,530 --> 00:40:09,900
We look at it and we
can do a remote screen.

823
00:40:09,900 --> 00:40:14,900
And there you have a remote
rat implanted from a bootloader

824
00:40:15,720 --> 00:40:17,253
on a system from an email.

825
00:40:18,660 --> 00:40:20,060
And secure boot is still on.

826
00:40:22,688 --> 00:40:23,521
Thank you.

827
00:40:23,521 --> 00:40:26,688
(audience applauding)

828
00:40:28,548 --> 00:40:30,404
All right. Be quick.

829
00:40:30,404 --> 00:40:31,508
- Yeah. Yeah.

830
00:40:31,508 --> 00:40:33,720
So we gave this example,

831
00:40:33,720 --> 00:40:37,020
but there's also things like BitLocker.

832
00:40:37,020 --> 00:40:39,330
BitLocker is doing
measurements of the TPM.

833
00:40:39,330 --> 00:40:41,010
It'll decrypt the drive

834
00:40:41,010 --> 00:40:44,790
when it has the right
measurements into the system.

835
00:40:44,790 --> 00:40:49,320
So BitLocker is also only
available in Windows Pro.

836
00:40:49,320 --> 00:40:50,812
It isn't in Windows Home.

837
00:40:50,812 --> 00:40:54,723
Not everybody even turns on
BitLocker in the first place.

838
00:40:55,650 --> 00:40:59,040
So we have some protections here,

839
00:40:59,040 --> 00:41:03,403
but it is not universal
throughout the system.

840
00:41:03,403 --> 00:41:08,100
Also, like we said, once
we patch the system,

841
00:41:08,100 --> 00:41:09,750
it's no longer doing those measurements,

842
00:41:09,750 --> 00:41:13,050
at least until Windows
picks up and takes it over.

843
00:41:13,050 --> 00:41:15,840
But there's some other things we can do

844
00:41:15,840 --> 00:41:18,360
related to suspending BitLocker,

845
00:41:18,360 --> 00:41:23,360
and there's a kind of fun demo
that we'll show in a second

846
00:41:23,910 --> 00:41:27,540
that there have been some changes recently

847
00:41:27,540 --> 00:41:28,530
in the latest Windows

848
00:41:28,530 --> 00:41:31,320
that prevent the thing
we're about to show,

849
00:41:31,320 --> 00:41:33,690
but I think it's still pretty interesting.

850
00:41:33,690 --> 00:41:36,783
- Yeah. So I think we have one last video.

851
00:41:37,920 --> 00:41:39,810
But by the way, if
anyone has any questions

852
00:41:39,810 --> 00:41:41,880
and wanna interrupt,
feel free to interrupt.

853
00:41:41,880 --> 00:41:42,713
Right.

854
00:41:43,980 --> 00:41:46,560
So how would we do this if you
wanna do the TPM avoidance?

855
00:41:46,560 --> 00:41:48,499
So let's assume you already
have infected the system

856
00:41:48,499 --> 00:41:50,610
prior to BitLocker.

857
00:41:50,610 --> 00:41:52,365
Right. You have a bootloader persistence

858
00:41:52,365 --> 00:41:56,790
and you patch the handlers,
but after you patch them,

859
00:41:56,790 --> 00:41:57,623
TPM doesn't measure.

860
00:41:57,623 --> 00:41:59,850
So you can change that binary afterwards.

861
00:41:59,850 --> 00:42:01,520
Right. You can switch
it off to a new payload,

862
00:42:01,520 --> 00:42:05,875
keep your rat maintain or
whatever if your nation state.

863
00:42:05,875 --> 00:42:07,233
Plug your ears.

864
00:42:09,240 --> 00:42:11,940
So how does this really, how
does translate to real life?

865
00:42:11,940 --> 00:42:13,530
I know it's fancy in a graph.

866
00:42:13,530 --> 00:42:17,013
In an example, it kind of looks like this.

867
00:42:18,150 --> 00:42:19,440
You boot, there's a smiling, right?

868
00:42:19,440 --> 00:42:22,620
This is a symbolic.
This is the version one

869
00:42:22,620 --> 00:42:27,093
of the bootloader payload
that's currently on the system.

870
00:42:28,680 --> 00:42:29,973
You boot into Windows.

871
00:42:39,270 --> 00:42:40,503
Right. BitLocker's on.

872
00:42:42,810 --> 00:42:43,893
Secure Boot's on.

873
00:42:45,720 --> 00:42:47,460
So we open a shell.

874
00:42:47,460 --> 00:42:49,950
This is to show you how on, it's a,

875
00:42:49,950 --> 00:42:53,250
an attacker will do it more
stealthily, but visually,

876
00:42:53,250 --> 00:42:55,530
you mount the EFI system
partition like this.

877
00:42:55,530 --> 00:42:57,993
mount vault, drive name/s.

878
00:42:58,920 --> 00:43:01,260
We take the startup script
that we have already placed

879
00:43:01,260 --> 00:43:02,370
as an attacker.

880
00:43:02,370 --> 00:43:05,370
We edited in notepad 'cause we're lit.

881
00:43:05,370 --> 00:43:07,563
And do we have smiley.efi.

882
00:43:09,150 --> 00:43:11,820
We changed that to, this
is a bug in the demo.

883
00:43:11,820 --> 00:43:14,550
I didn't remember if it
was red skull or red_skull,

884
00:43:14,550 --> 00:43:16,020
so at to list the files.

885
00:43:16,020 --> 00:43:21,020
So red_skull.efi, change the file name,

886
00:43:21,300 --> 00:43:25,410
put it back, save it to the EFI
system partition and reboot.

887
00:43:25,410 --> 00:43:27,810
Theoretically, TPM should catch this,

888
00:43:27,810 --> 00:43:29,490
and because different binary

889
00:43:29,490 --> 00:43:30,630
would cause different measurements

890
00:43:30,630 --> 00:43:33,060
and BitLocker should go into recovery.

891
00:43:33,060 --> 00:43:36,150
However, got five minutes? Six?

892
00:43:36,150 --> 00:43:36,983
- [Staff] Five.

893
00:43:36,983 --> 00:43:37,816
- Okay.

894
00:43:40,410 --> 00:43:41,403
Then we reboot.

895
00:43:44,022 --> 00:43:44,903
All right. Reboot.

896
00:43:48,147 --> 00:43:49,710
And we see the red skull.

897
00:43:49,710 --> 00:43:52,293
But this point, BitLocker
recovery should kick in,

898
00:43:55,470 --> 00:43:56,749
but it doesn't.

899
00:43:56,749 --> 00:43:59,053
- [Audience Member] Whoop.

900
00:43:59,053 --> 00:44:00,598
Is that a whoop?

901
00:44:00,598 --> 00:44:01,770
(Mickey and Jesse laughing)

902
00:44:01,770 --> 00:44:02,603
Thank you.

903
00:44:07,260 --> 00:44:09,483
So yeah. Then we go and check everything.

904
00:44:10,321 --> 00:44:12,780
The BitLocker is on and Secure Boot is on.

905
00:44:12,780 --> 00:44:14,040
Trust me, it's on.

906
00:44:14,040 --> 00:44:15,440
I'm gonna skip a little bit.

907
00:44:16,890 --> 00:44:19,470
We have five slides in five minutes.

908
00:44:19,470 --> 00:44:21,520
I'm gonna try to rush these a little bit.

909
00:44:22,530 --> 00:44:25,309
That's the link for the Microsoft patch.

910
00:44:25,309 --> 00:44:29,643
What they did was they issued
a DBX update and a DB update.

911
00:44:31,530 --> 00:44:33,663
You can go get the update

912
00:44:33,663 --> 00:44:36,420
that was issued in the past Tuesday.

913
00:44:36,420 --> 00:44:38,857
In that page, there is
this reference to say,

914
00:44:38,857 --> 00:44:41,007
"If you have credential guard enabled,"

915
00:44:43,110 --> 00:44:45,540
sorry, "If do not have
credential guard enabled,

916
00:44:45,540 --> 00:44:47,850
you need to suspend BitLocker
for one restart cycle

917
00:44:47,850 --> 00:44:50,160
and you can see you change
the reboot count to one.

918
00:44:50,160 --> 00:44:52,410
But if you have credential guard enabled,

919
00:44:52,410 --> 00:44:55,031
you need to suspend BitLocker
for two restart cycles,

920
00:44:55,031 --> 00:44:57,990
but you put the reboot count to three."

921
00:44:57,990 --> 00:44:59,233
I don't know how this math works,

922
00:44:59,233 --> 00:45:02,730
but it's what the website says.

923
00:45:02,730 --> 00:45:04,710
It's funny. And it's also the
command line you wanna use

924
00:45:04,710 --> 00:45:08,250
as an attacker to suspend BitLocker,

925
00:45:08,250 --> 00:45:11,133
and re-register your own
to bootloader or whatever.

926
00:45:13,140 --> 00:45:15,287
Fun story. You want something to say?

927
00:45:15,287 --> 00:45:17,490
- Just to follow up on that a sec,

928
00:45:17,490 --> 00:45:22,490
this command to register
BitLocker or suspend BitLocker,

929
00:45:24,090 --> 00:45:25,410
you can use that as an attacker

930
00:45:25,410 --> 00:45:28,110
where when you replace
the legitimate bootloader

931
00:45:28,110 --> 00:45:29,850
with your malicious bootloader,

932
00:45:29,850 --> 00:45:32,850
you just suspend BitLocker, reboot,

933
00:45:32,850 --> 00:45:35,680
and it will measure your
malicious bootloader

934
00:45:38,340 --> 00:45:41,956
into the BitLocker measurements
so then after that,

935
00:45:41,956 --> 00:45:44,190
you need to have your
malicious bootloader.

936
00:45:44,190 --> 00:45:45,625
And if you replace it with the legit one,

937
00:45:45,625 --> 00:45:48,003
then you'll go into BitLocker recovery.

938
00:45:51,270 --> 00:45:52,145
- Yeah.

939
00:45:52,145 --> 00:45:56,580
So if you run Windows,
you can get the updates

940
00:45:56,580 --> 00:45:58,560
since August 9th patch Tuesday.

941
00:45:58,560 --> 00:46:01,233
If you don't run Windows, you're fucked.

942
00:46:02,730 --> 00:46:06,000
Sorry for my French. I told
you where I warned you.

943
00:46:06,000 --> 00:46:08,883
What happened was there
was a update released,

944
00:46:10,710 --> 00:46:15,570
but Microsoft didn't explicitly
release a DBX binary.

945
00:46:15,570 --> 00:46:19,050
Usually, what you do is you
get it from the UEFI forum,

946
00:46:19,050 --> 00:46:21,630
which a group of people who
dedicate a lot of their time

947
00:46:21,630 --> 00:46:23,820
to make sure that all the
OEMs and all the vendors

948
00:46:23,820 --> 00:46:28,410
like Dell, HP and Lenovo, all
the MSI, ASRock have a copy

949
00:46:28,410 --> 00:46:30,450
of the latest version so
they can update their BIOS

950
00:46:30,450 --> 00:46:33,900
and update all the systems,
and it's a big landscape.

951
00:46:33,900 --> 00:46:35,820
There's a lot of vendors out there.

952
00:46:35,820 --> 00:46:37,143
And if you run Linux then.

953
00:46:40,230 --> 00:46:43,320
So how do you avoid the bypasses?

954
00:46:43,320 --> 00:46:46,080
So there are things out
there that can block you

955
00:46:46,080 --> 00:46:46,913
from avoiding the bypass.

956
00:46:46,913 --> 00:46:51,090
The easiest one is just put
a password on your BIOS.

957
00:46:51,090 --> 00:46:52,539
If you really care about this,

958
00:46:52,539 --> 00:46:56,100
if you tend to have
your laptop or computer,

959
00:46:56,100 --> 00:46:57,240
I don't know how your computer be away

960
00:46:57,240 --> 00:46:58,803
from your line of sight,

961
00:47:03,450 --> 00:47:06,203
you just put a password on the
BIOS, then don't forget it.

962
00:47:08,280 --> 00:47:12,660
HP Sure Start has mechanisms to check.

963
00:47:12,660 --> 00:47:16,800
It's a special solution they have.

964
00:47:16,800 --> 00:47:19,620
It's a custom chip on the
board that does checks

965
00:47:19,620 --> 00:47:20,820
with the golden image,

966
00:47:20,820 --> 00:47:23,310
and does a lot of nifty cool stuff,

967
00:47:23,310 --> 00:47:24,660
but it's enterprise, right?

968
00:47:24,660 --> 00:47:26,220
So again, remember,

969
00:47:26,220 --> 00:47:30,840
we're also talking about this
threat for Windows Home users

970
00:47:30,840 --> 00:47:33,390
and non-corporate and enterprise people

971
00:47:33,390 --> 00:47:34,410
that use this as gaming,

972
00:47:34,410 --> 00:47:38,283
and 15 year olds that wanna
play Apex Legends all day.

973
00:47:40,740 --> 00:47:43,290
Or you can use hardware
from a closed garden,

974
00:47:43,290 --> 00:47:44,880
like Microsoft Surface.

975
00:47:44,880 --> 00:47:45,900
It's all, there are verticals.

976
00:47:45,900 --> 00:47:48,300
So they control the firmware,
the bootloaders, everything.

977
00:47:48,300 --> 00:47:52,053
They have their own trust chain.

978
00:47:52,920 --> 00:47:55,740
It's great. If you really
wanna do that for Windows,

979
00:47:55,740 --> 00:47:58,024
if you wanna be a secure,
you have a question?

980
00:47:58,024 --> 00:48:00,066
- [Audience Member]
Yeah. How does that work

981
00:48:00,066 --> 00:48:02,187
with secured-core PCs?"

982
00:48:02,187 --> 00:48:03,020
- So the question was,

983
00:48:03,020 --> 00:48:05,250
"How does this work
with secured-core PCs?"

984
00:48:05,250 --> 00:48:06,480
You mean, replacing the bootloader?

985
00:48:06,480 --> 00:48:09,953
- [Audience Member] I mean,
(speaking away from mic)

986
00:48:10,962 --> 00:48:11,795
- Yeah.

987
00:48:11,795 --> 00:48:12,780
- [Audience Member] There's that.

988
00:48:12,780 --> 00:48:16,470
- So secure-core PC is
a name Microsoft gives

989
00:48:16,470 --> 00:48:19,383
to a set of features that are enabled.

990
00:48:20,669 --> 00:48:23,767
Is it like something you can
go into Windows and check,

991
00:48:23,767 --> 00:48:26,010
"Is this a secured-core PC?"

992
00:48:26,010 --> 00:48:27,513
No? I don't know.

993
00:48:28,410 --> 00:48:30,270
It's a title.

994
00:48:30,270 --> 00:48:31,440
I don't, there's some,

995
00:48:31,440 --> 00:48:33,780
you can find documentations
for certain models and things,

996
00:48:33,780 --> 00:48:37,530
but yeah, we can talk about
this later in the Q and A.

997
00:48:37,530 --> 00:48:38,400
You wanna?

998
00:48:38,400 --> 00:48:40,890
- So just to follow up, one
thing that they are doing

999
00:48:40,890 --> 00:48:45,270
with Secured-core PC is, this is all,

1000
00:48:45,270 --> 00:48:47,450
bootloaders are signed by the Microsoft UA

1001
00:48:47,450 --> 00:48:50,340
of a third party certificate of authority.

1002
00:48:50,340 --> 00:48:52,920
And they're having OEMs
disable that by default

1003
00:48:52,920 --> 00:48:54,663
for Secure-core PC systems.

1004
00:48:57,210 --> 00:48:59,490
- So let's see. So Microsoft's response.

1005
00:48:59,490 --> 00:49:01,320
I think you kind of get the drift.

1006
00:49:01,320 --> 00:49:04,093
They get the DBX update.

1007
00:49:04,093 --> 00:49:06,270
They issue, not on just the DBX update,

1008
00:49:06,270 --> 00:49:08,370
they also add a DB update,

1009
00:49:08,370 --> 00:49:11,430
which means they add
another CA to the chain

1010
00:49:11,430 --> 00:49:15,030
that allows other bootloaders
that are assigned by that CA.

1011
00:49:15,030 --> 00:49:17,490
If you ask me right
now, "What's in the DBX?

1012
00:49:17,490 --> 00:49:18,540
What's in the DB?"

1013
00:49:18,540 --> 00:49:21,600
I would love to tell you, I asked.

1014
00:49:21,600 --> 00:49:24,780
I asked multiple times, multiple people,

1015
00:49:24,780 --> 00:49:26,940
I still have no answer.

1016
00:49:26,940 --> 00:49:31,620
Microsoft will not share
information with us,

1017
00:49:31,620 --> 00:49:34,143
or I guess, maybe it's just us,

1018
00:49:35,310 --> 00:49:40,020
with us about what
signatures are being added,

1019
00:49:40,020 --> 00:49:42,528
what is provoked, what
binaries have they signed

1020
00:49:42,528 --> 00:49:46,230
that are now not good.

1021
00:49:46,230 --> 00:49:48,750
They just say, oh, they don't say.

1022
00:49:48,750 --> 00:49:51,060
We asked but we assume that
they just don't wanna share

1023
00:49:51,060 --> 00:49:53,315
that information because
it's Microsoft signing this.

1024
00:49:53,315 --> 00:49:57,420
Keep in mind, Microsoft is the one signing

1025
00:49:57,420 --> 00:50:00,300
all the bootloaders for the shim.

1026
00:50:00,300 --> 00:50:01,200
So everything that loads,

1027
00:50:01,200 --> 00:50:04,170
Canonical and Fedora, and
all the GRUB, it's signed by,

1028
00:50:04,170 --> 00:50:06,150
there's a shim signed by Microsoft.

1029
00:50:06,150 --> 00:50:08,250
There is an open source committee
that does all that stuff,

1030
00:50:08,250 --> 00:50:12,096
but there's a CA for Microsoft
UFI that sits in your,

1031
00:50:12,096 --> 00:50:13,473
everyone's firmware.

1032
00:50:14,610 --> 00:50:16,050
And the vendor response, I didn't hear.

1033
00:50:16,050 --> 00:50:17,520
I didn't hear anything from the vendors.

1034
00:50:17,520 --> 00:50:20,515
We have Microsoft as a focal point.

1035
00:50:20,515 --> 00:50:23,760
We talked to Microsoft on
this, and then we added cert

1036
00:50:23,760 --> 00:50:26,301
because Microsoft wouldn't issue us CVs.

1037
00:50:26,301 --> 00:50:30,000
So we just asked them
to help us with the CVs.

1038
00:50:30,000 --> 00:50:32,310
And we kind of assumed that
Microsoft will quarterback all

1039
00:50:32,310 --> 00:50:34,947
this and make sure that
they would notify everyone

1040
00:50:34,947 --> 00:50:36,270
that's basically affected

1041
00:50:36,270 --> 00:50:40,353
by their firmware signing capabilities.

1042
00:50:41,530 --> 00:50:42,723
Crickets.

1043
00:50:44,490 --> 00:50:45,360
But is it over?

1044
00:50:45,360 --> 00:50:47,760
It's done, and it's, but
kinda, but it's not done, done.

1045
00:50:47,760 --> 00:50:51,420
Why? Found these tweets yesterday.

1046
00:50:51,420 --> 00:50:54,045
Apparently, some people are already seeing

1047
00:50:54,045 --> 00:50:56,013
this update fails.

1048
00:50:57,420 --> 00:51:00,360
They try to have this update
be done automatically.

1049
00:51:00,360 --> 00:51:03,750
In some cases, in net Dell
and the lower example.

1050
00:51:03,750 --> 00:51:05,940
There's a guy trying to update his Dell

1051
00:51:05,940 --> 00:51:07,590
and it's not updating.

1052
00:51:07,590 --> 00:51:08,423
He's found a solution.

1053
00:51:08,423 --> 00:51:11,550
You have to turn Secure
Boot off, apply the update,

1054
00:51:11,550 --> 00:51:14,433
and then turn on Secure Boot on again.

1055
00:51:16,740 --> 00:51:19,103
Okay. You try to turn it
off and turn it on again.

1056
00:51:20,610 --> 00:51:24,660
It's possible that within a
week, if it this goes worse,

1057
00:51:24,660 --> 00:51:27,720
since it just came out three days ago,

1058
00:51:27,720 --> 00:51:29,670
that Microsoft will pull this update.

1059
00:51:29,670 --> 00:51:31,590
I don't know. I hope not.

1060
00:51:31,590 --> 00:51:35,500
So everyone can just live boot
Windows to update your DBX

1061
00:51:36,720 --> 00:51:37,553
if you want to.

1062
00:51:38,670 --> 00:51:39,783
And our Linux system.

1063
00:51:40,851 --> 00:51:43,020
Second to last slide.

1064
00:51:43,020 --> 00:51:44,787
With the 302 vulnerability,

1065
00:51:44,787 --> 00:51:47,774
that's the bootloader that loads anything.

1066
00:51:47,774 --> 00:51:49,860
You can just go have fun.

1067
00:51:49,860 --> 00:51:50,730
If you're researching,

1068
00:51:50,730 --> 00:51:54,930
if you wanna play with pre-boot
stuff, if you wanna load,

1069
00:51:54,930 --> 00:51:57,090
I don't know, tools or
debug tools or hypervisor,

1070
00:51:57,090 --> 00:51:58,144
whatever you want,

1071
00:51:58,144 --> 00:52:00,757
go take it. It's in that GitHub,

1072
00:52:00,757 --> 00:52:04,170
OneBootloaderToLoadThemAll, and YOLO.

1073
00:52:05,763 --> 00:52:07,923
(upbeat music)

1074
00:52:07,923 --> 00:52:09,786
That's it. Thank you.

1075
00:52:09,786 --> 00:52:12,953
(audience applauding)

1076
00:52:14,663 --> 00:52:17,700
Q and A will be right here
in the hallway outside

1077
00:52:17,700 --> 00:52:19,150
if you want to ask questions.