Breaking the Chain of Trust
Channel: FIRST
Date: 2021-06-17

Speakers: Alex Bazhaniuk (Eclypsium, US), Jesse Michael (Eclypsium, US), Mickey Shkatov (Eclypsium, US)

Despite recent advances, the boot process of most PCs continues to be one small issue away from a complete loss of trust. We’ve seen UEFI Secure boot, hardware roots of trust (such as Intel Boot Guard), and even complex custom microcontrollers add robustness, but the architectural weakness remains that each line of code in any of these boot components can break the rest of the chain. In this talk, we will cover this architecture and recent improvements. Then, we will outline the "BootHole" vulnerability as an example that breaks the chain. Finally, we will discuss defensive measures that can be used to detect and respond to this type of attack. In addition, we will cover forensic and incident response playbook for firmware and hardware attacks. 

About the Speakers
Alex has been performing security research and product security for a number of years at Intel Corporation. Alex has presented his research at well-known security conferences and he also teaches popular trainings in firmware security.

Jesse Michael is an experienced security researcher focused on vulnerability detection and mitigation who has worked at all layers of modern computing environments from exploiting worldwide corporate network infrastructure down to hunting vulnerabilities inside processors at the hardware design level. His primary areas of expertise include reverse engineering embedded firmware and exploit development. He has also presented research at DEF CON, Black Hat, PacSec, Hackito Ergo Sum, Ekoparty, and BSides Portland.

Mickey has been doing security research for almost a decade, one of specialties is simplifying complex concepts and finding security flaws in unlikely places. He has seen some crazy things and lived to tell about them at security conferences all over the world, his past talks range from web pentesting to black badges and from hacking cars to BIOS firmware.