Rafal Wojtczuk and Joanna Rutkowska - Black Hat

More documents

Recommendations

Info

First we start “trusted” Xen (built by root@) ...<strong>and</strong> seal some secret to PCR17/18/19
Page 1: Attacking Intel ® Trusted Executio
Page 4 and 5: Intel ® Trusted Execution Technolo
Page 6 and 7: TPM 1.2 Passive I/O device (master-
Page 8 and 9: PCR “extend” operation PCRN+1 =
Page 10 and 11: TPM seal/unseal example # echo 'Sec
Page 12 and 13: Both seal/unseal and quote operatio
Page 14 and 15: BIOS ROM BIOS FLASH BOOT LOADER OS
Page 16 and 17: Example #1: Disk Encryption Disk en
Page 18 and 19: So, a malware can sniff it…
Page 20 and 21: Example #2: User’s Picture Test :
Page 22 and 23: Problems with SRTM
Page 24 and 25: Dynamic Root of Trust Measurement (
Page 26 and 27: A VMM we want to load (Currently un
Page 28 and 29: TXT bottom line TXT late launch can
Page 30 and 31: GRUB (1 st stage) GRUB (2 nd stage)
Page 34: Now we boot “untrusted” Xen (co
Page 37 and 38: Now some live demos...
Page 40: Tboot Demo #2: booting an untrusted
Page 43 and 44: So what is this all for?
Page 45 and 46: It’s all about TPM PCRs and secre
Page 47 and 48: Launch time protection vs. runtime
Page 49 and 50: Theoretically runtime-protection sh
Page 51 and 52: Attacking TXT
Page 53 and 54: Q: What is more privileged than a h
Page 55 and 56: Q: Is this SMM some new thing? A: N
Page 57 and 58: SMM gets loaded before Late Launch.
Page 59 and 60: Q: Does TXT reload SMM on SENTER ex
Page 61 and 62: Oh...
Page 63 and 64: Let’s have a look at the actual S
Page 65: ... and the shorter version...
Page 69 and 70: Wait! But how to infect the SMM han
Page 71: Let’s take a look at the live dem
Page 74 and 75: So how we can get into SMM memory (
Page 76 and 77: 2006: Loic Duflot (not an attack ag
Page 78 and 79: So, how did we get around this vici
Page 83 and 84:
Meet Atmel 26DF321 SPI-flash
Page 85 and 86:
Looks promising, but...
Page 87 and 88:
So, we used a different approach…
Page 89 and 90:
Memory Remapping on Q35 chipset TOU
Page 91:
#define TSEG_BASE 0x7e500000 u64 ta
Page 96 and 97:
Intel patched the bug in August 200
Page 98 and 99:
VU#127284
Page 100 and 101:
We have provided Intel with the det
Page 102 and 103:
We suspect it might affect all rece
Page 104 and 105:
Intel contacted CERT CC informing t
Page 106 and 107:
We plan to discuss the details of t
Page 108 and 109:
More on the TXT Design Problem
Page 110 and 111:
SMM Transfer Monitor (STM) Communic
Page 112 and 113:
Intel Who should write an STM? OEMs
Page 114 and 115:
Intel told us they do have STM spec
Page 116 and 117:
Intel might be right claiming that
Page 118 and 119:
We cannot make our mind on this unt
Page 120 and 121:
Summary
Page 122:
http://invisiblethingslab.com
show all

Rafal Wojtczuk and Joanna Rutkowska - Black Hat

Create successful ePaper yourself

Delete template?

Save as template?