hands-on-security.com

Overview

This training guides you through the whole process involved for a successful BitLocker TPM bus sniffing attack. Within two days you will be given the necessary knowledge about micro soldering, notebook internals, TPM basics, logic analyzers, basic forensic data acquisition and some BitLocker theory. In the end you will not just be able to conduct the attack against a test notebook which you can take home, but also fully understand what you are actually doing and applying it to your devices.

As a nice little extra you will learn how to deal with tamper protection switches, and we will show you how to decrypt the BitLocker recovery password with the sniffed data for complete pwnage and the eye-popping finding in your endpoint security report. All special hardware required for the attack will be part of your hardware kit which you also take home at the end of the course.

The training is built up as a step-by-step guidance to conduct the attack. For each step you will be provided with the necessary theoretical background before you solve the step hands-on.

On the first day you will start with soldering your own attack adapters which will be used later on. After the warmup with the soldering iron you will learn how to micro solder on test boards. The hands-on experience is followed by a theoretical block taking you deep within the internals of modern portable computers. With the help of schematics, boardviews and datasheets you will get familiar with the process of finding a TPM within your target device. As those documents are not for all target devices available, you will also first conduct a manual search approach on your test device. Having located the TPM within your test device you are now ready to solder your attack adapter to the TPMs fine pins.

Having prepared the test device on the first day, we now need to get our attacking tools ready. On the second day you will learn how to work with a logic analyzer to conduct bus sniffing attacks in general. The learnt theory will then be applied, and you will end the hardware attacking part with grabbing the TPMs communication. Before being able to extract the key material from the communication you will learn about the BitLocker basics and where to look for the Volume Master Key (VMK) in the TPMs communication. Equipped with this knowledge you are now ready to extract your BitLocker VMK and decrypt your test device's data.

Key Takeaways

• The attendees will be taught and trained the necessary skills to defeat TPM-only BitLocker Implementations completely on their own.
• The attendees will learn how to work with logic analyzers to undertake common bus sniffing attacks.
• The attendees will be familiar with hardware related tasks like micro soldering, notebook disassembly, searching for and identifying specific components on a computer main board.

Who should take this Course

This course is for the average digital forensics analyst, the forensic practitioner, security researcher and system administrator who needs to circumvent BitLocker with TPM-only. But also for the penetration tester actually required to proof the severity of his finding if the client uses TPM-only BitLocker setups and for anyone who wants to take their hardware skills to the next level.

Student Requirements

Students should bring the necessary motivation for hands-on hardware hacking. This course is about getting your hands dirty ;)

What Students Should Bring

Students are required to bring a notebook capable of running a virtual Win7 machine. The host operating system further shall be capable of running DreamSourceLab's DSView and python3. In order to be able to communicate with the provided Logic Analyzer at least one USB 3.0 A port is required. It should be clear, that you need admin/root access on this device and have the permission to install additional software.

What Students Will Be Provided With

You will receive a complete kit worth of approx. 900 USD containing:

• detailed slide set
• python scripts to extract VMKs and decrypt BitLocker recovery passwords
• test data to check your software installations
• extensive hardware kit in a handy box including
  • U3Pro16 logic analyzer
  • microsolder station
  • custom TPM attack adapters
  • super thin coated wires
  • test device equipped with a TPM chip to attack (notebook)

Trainers

As a forensic practitioner Joel has been extracting data of countless mobile devices, hard drives and computers. In the latest years he started to focus more on IoT devices, car forensics and has in depth knowledge about flash memory forensics. His manual skills with micro soldering, taking devices apart and building custom electronics are extraordinary.

Pascal (@pascal_gujer) started as an Electrical Engineer with the intention of tackling information security from the hardware side. With his recently accomplished MSc in Advanced Security and Digital Forensics he educationally completed this path. In his master thesis about Microsoft’s Default BitLocker Implementation, he developed an own way to undertake the TPM Bus Sniffing attack with maximum visibility for the attacker. Pascal has more than six years of experience as a Digital Forensics Expert and has been involved in many hardware hacking and pentesting jobs.

Text

This is bold and this is strong. This is italic and this is emphasized. This is ^superscript text and this is _subscript text. This is underlined and this is code: for (;;) { ... }. Finally, this is a link.

Heading Level 2

Heading Level 3

Heading Level 4

Heading Level 5

Heading Level 6

Blockquote

Fringilla nisl. Donec accumsan interdum nisi, quis tincidunt felis sagittis eget tempus euismod. Vestibulum ante ipsum primis in faucibus vestibulum. Blandit adipiscing eu felis iaculis volutpat ac adipiscing accumsan faucibus. Vestibulum ante ipsum primis in faucibus lorem ipsum dolor sit amet nullam adipiscing eu felis.

Preformatted

i = 0;

while (!deck.isInOrder()) {
    print 'Iteration ' + i;
    deck.shuffle();
    i++;
}

print 'It took ' + i + ' iterations to sort the deck.';

Lists

Unordered

• Dolor pulvinar etiam.
• Sagittis adipiscing.
• Felis enim feugiat.

Alternate

• Dolor pulvinar etiam.
• Sagittis adipiscing.
• Felis enim feugiat.

Ordered

1. Dolor pulvinar etiam.
2. Etiam vel felis viverra.
3. Felis enim feugiat.
4. Dolor pulvinar etiam.
5. Etiam vel felis lorem.
6. Felis enim et feugiat.

Icons

• Twitter
• Facebook
• Instagram
• Github

Actions

• Default
• Default

• Default
• Default

Table

Default

Alternate

Buttons

• Primary
• Default

• Default
• Small

• Icon
• Icon

• Disabled
• Disabled

Form