19 ms·
From stolen laptop to inside the company network
- renewiltord 5y agoAh, very clever. Targeting the TPM to bypass FDE. Looks like having a disk encryption password is key. I used to have my boot partition encrypted with the same password as my primary user and it looks like even that would have thwarted this.
- thegeomaster 5y ago> I used to have my boot partition encrypted with the same password as my primary user You say that as if it's not a good idea, but in the absence of external factors (password being used elsewhere or a hash stored somewhere e.g. for corporate SSO), using the same password shouldn't really diminish the security of your setup.
- pengaru 5y agoYou're more frequently entering the primary user password (screen unlocking, logins, sudo...) so there are substantially more opportunities to observe it either visually like over the shoulder or from camera footage, or through a compromised machine fully online. Generally the FDE is unlocked in an offline and minimally functional state, and being a one-time entry @boot kind of thing it's far more practical to secure with things like a temporarily connected crypto hardware dug out of your bag or somesuch. There's clearly some value in making them different.
- PenguinCoder 5y agoReally good article. It's interesting that TPM communicate is over SPI and also unencrypted. Goes to show you're only as strong as the weakest link.
- MisterTea 5y agoThat's how the original "unhackable" Xbox was broken. The encrypted firmware was decrypted by hardware in the south-bridge but sent unencrypted to the RAM via the open hyper transport bus. So someone hooked a fast logic analyzer to the bus and read the firmware during boot.
- monocasa 5y agoWell, the encrypted second stage firmware was decoded in software by a plaintext ROM stored in the southbridge that contained the keys. That 512 byte southbridge ROM also didn't do quality asymmetric crypto, so by dumping the RC4 key (and in later revisions the TEA hash digest) they were able to decrypt the main firmware in flash and replace it with arbitrary code. With today's consoles, it's sort of assumed that the attackers will get read access to the first stage boot loader, so they use public keys to validate any stages not originating from the CPU die itself. Then attackers can't replace follow on stages even with read access to the first stage.
- mappu 5y agoMany devices don't have a physically separate TPM but only use an fTPM on the CPU, which would block this attack.
- lostmsu 5y agoSounds like fTPM might be preferred to separate modules.
- deleted 5y ago[deleted]
- fmakunbound 5y agoSo would it be more secure to enter in the bitlocker passphrase at boot rather than rely on tpm?
- staticassertion 5y agoIt depends. My expectation is that the TPM holds a key that's used for FDE, and if you have a password that password is used to get that key. So the password will only increase security if it's used to encrypt the TPM's key, but if it's just used to authenticate to the TPM, it wouldn't. Someone more familiar with TPM 2.0 could likely answer this authoritatively, but my assumption is that it's the latter. Properly leveraging TPM 2.0 features would likely be the best way to solve this problem.
- MonaroVXR 5y agoNot all laptops are the same, so it depends on the laptop as well.
- INTPenis 5y agoThat TPM hack was really impressive engineering. But I kept scrolling through to figure out what the next step was and it turns out the VPN software establishes a tunnel before authentication as a "feature". So while the TPM hack was very impressive, this article only gives me a sense of safety for our own corporate laptops.
- mattashii 5y agoWell, only insofar that you trust that your own corporate laptops don't contain sensitive data on the disk. I am really happy to know my laptop isn't vulnerable to this (luks-based system), but I am very concerned with the potential (in)security of my collegues' laptops due to common use of corporate laptop hardware for software development and technical customer support.
- imwillofficial 5y agoSend this article to your security team. Hopefully they will appreciate the backup.
- INTPenis 5y agoTrue we have only started using password managers in the last 6 years or so. But what I meant was that a proper VPN with forced MFA setup and strict ACL makes most of those credentials useless.
- outworlder 5y ago> this article only gives me a sense of safety for our own corporate laptops. Keep in mind that it was a sanitized laptop with no actual data on it, built for the test. A random employee's laptop? Probably has all sorts of goodies. Don't get complacent.
- exhilaration 5y agoA random employee's laptop? Probably has all sorts of goodies. Don't get complacent. Like a PASSWORDS.txt file on the desktop which said employee uses as a password manager.
- teddyh 5y agoThe first step is to actually encrypt your drives. Far too few people and places even do this step. Either use the OS-provided solution (Like LUKS, FileVault, or BitLocker), or use a cross-OS solution like Veracrypt <https://veracrypt.fr/ https://veracrypt.fr/>. Secondly, to avoid the problem in this article, you should have an external password necessary to unlock the drive; not a TPM. This is, of course, not what most people do, since typing in passwords is tedious. However, if you mostly need to boot up the laptop when connected to a specific network (e.g. on company premises), and it’s acceptable to require a manually typed password when the laptop is not present at that location, and if you use a Debian-based OS, there is a solution! Shameless plug: https://www.recompile.se/mandos https://www.recompile.se/mandos
- imwillofficial 5y agoIt's a sad state of affairs when Veracrypt is one of the top contenders for tools to use. We need a fresh batch of properly maintained privacy tools.
- teddyh 5y agoFeel free to recommend something else from this list: https://en.wikipedia.org/wiki/Comparison_of_disk_encryption_software https://en.wikipedia.org/wiki/Comparison_of_disk_encryption_...
- codetrotter 5y agohttps://security.stackexchange.com/questions/242427/is-native-openzfs-on-freebsd-block-level-encryption-secure https://security.stackexchange.com/questions/242427/is-nativ... > [...] it appears that OpenZFS encryption is far stronger than LUKS or VeraCrypt encryption. > LUKS and VeraCrypt use the XTS mode of encryption, which is not authenticated, and is vulnerable to some limited recovery of information when an attacker can have access to the encrypted data at different times. On the other hand OpenZFS encryption is authenticated and at the state of the art. Also, you should take care to disable compression when encrypting with OpenZFS.
- imwillofficial 5y agoA fantastic and thorough write up of taking a company laptop and breaking into a corp network. They even used a few methods and tools I hadn't heard of before. A fun read for the security folks. (Or anyone security adjacent)
- mjevans 5y agoThe 'stolen laptop' attack vector, as well as 'evil maid' attacks are my general security nightmare in professional environments. Users are told how the security works, but OpSec is _difficult_. Which means it'll only take that one time the user is lazy and an attacker gets lucky.
- mabbo 5y ago> as well as 'evil maid' attacks Coworkers of mine did a recruiting trip to <untrusted country> and were told by corporate: do not bring your laptops. We'll provide you with laptops when you get there to use for the week. Any laptop you bring stays there because we don't trust that you didn't leave it alone in a hotel room at some point. And if that happens, we presume it's compromised.
- hoppyhoppy2 5y agoYou can do real damage even without this level of sophistication or physical access: my state's largest hospital system had a month-long computer outage because of a ransomware attack. It was traced back to an employee opening a malicious email attachment on a hospital-owned laptop while they were on vacation. It brought down the medical records systems and cost the hospital between $40 million and $50 million (mostly in lost revenue because they basically had to cancel non-emergency visits and procedures across multiple locations for a month). Quite an expensive email! https://vtdigger.org/2021/07/21/malware-on-employees-company-computer-led-to-cyber-attack-on-uvm-medical-center/ https://vtdigger.org/2021/07/21/malware-on-employees-company...
- robocat 5y ago> It was traced back to an employee opening a malicious email attachment on a hospital-owned laptop while they were on vacation. That is such a lame “cause”. What was the actual underlying cause - i.e. what was it that allowed a malicious email to pwn the laptop?
- deleted 5y ago[deleted]
- dmurray 5y agoAgreed - I don't like the way we've shifted responsibility to the hapless employee away from whoever wrote, purchased and approved the vulnerable piece of software that actually was exploited here.
- raxxorrax 5y agoThis is most often the cause for ransomware and it mostly is just an executable. Exploits in PDF/Word/image viewer are quite rare.
- robocat 5y agoHow many employees need to be able to run executables from their email? If they somehow need to be able to do that, I presume there is normally some form of sandboxing?
- tyingq 5y ago"All BIOS settings were locked with a password" This is trivial to override for every laptop I've ever had, with sites like https://bios-pw.org/ https://bios-pw.org/ You have to read carefully, like doing "<ctrl><enter>" and not just "<enter>", but it's worked many times for me. Source code is here: https://github.com/bacher09/pwgen-for-bios https://github.com/bacher09/pwgen-for-bios I do see that Lenovo (brand of laptop in the article) isn't on their list, though many others are.
- qmarchi 5y agoMany newer models of laptops, especially those being deployed in the enterprise have the ability to reset the BIOS locked out as well, to prevent explicitly the attacks suggested in the OP.
- jonathantf2 5y agoMost enterprise machines (Lenovo Think, HP Pro/Elite and Dell OptiPlex/Vostro) will have a hardened BIOS that you can't reset unless you have proof of purchase of the machine.
- tyingq 5y agoI've used it specifically on 2 of those. No issues.
- bkallus 5y agoFor HP this is not true. In college I rescued 2 HP EliteBooks from the e-waste bin and both had locked BIOSes. It was as simple as buying a cheap SPI programmer (I got a CH341A-based one) and dumping the BIOS chip, then unlocking the dump with a tool called HPUnlocker, and reflashing it. Didn't even need to solder because the programmer came with a chip clip. These were EliteBook 840 G2s, but modern EliteBooks are still vulnerable to this.
- userbinator 5y agoAt least for Lenovo/IBM, that's what they want you to think; but anyone with knowledge of the third-party repair industry knows that isn't true at all: http://www.thinkwiki.org/wiki/maintenance#Recovering_BIOS_passwords http://www.thinkwiki.org/wiki/maintenance#Recovering_BIOS_pa....
- ufmace 5y agoSomething like half of the comments are recommending using a password for the FDE key instead of the TPM. I thought that it wasn't normally recommended to use a hand-entered key directly, since they wouldn't be expected to have enough entropy for FDE. The better solution would be to store it on a TPM behind a password, where the password check happens inside the TPM, and it can destroy the FDE key after too many wrong attempts. And uh, not send the password unencrypted to the OS over an interface that can be tapped with electrical leads on the motherboard.
- mjg59 5y agoUsing a password with a per-filesystem salt and a modern key derivation function will be just fine here - the key derivation is expensive enough that brute forcing the key isn't practical, even assuming relatively weak passwords.
- escalt 5y agoThe way I understand full disk encryption (with LUKS at least) is that the device generates a random key which does the data encryption/decryption and the user entered password is used exclusively to encrypt that key. This allows encrypting the key with thousands of iterations (the number is picked in a way that it takes a few seconds on the currently used CPU). That way you can use a very slow encryption algorithm (meaning it's very slow to brute force) to get the actual key, which can then be used for fast encryption of the actual data. This approach also allows changing passwords or using multiple passwords without rewriting the entire drive, since just the key has to be re-encrypted
- ufmace 5y agoAh yeah that makes more sense. I suppose managing FDE key via TPM is theoretically / ideally more secure, but has a lot more attack surface. Probably not many TPM implementations have been attacked enough publicly for anyone to be confident they're actually more secure than a regular password with good modern KDF.
- grege 5y agoWhy they used that (clever) sticky-keys trick instead of cracking password in the SAM database (the local admin password), sorry if my question is dumb.
- lexicality 5y agobecause the sticky-keys trick takes 30 seconds and cracking a password is variable
- grege 5y agoOk thanks I got it
- N00bN00b 5y agoI think that's incorrect. They couldn't log in, because that VPN tunnel is only open before logging in. So they had to gain access while on the login screen.
- N00bN00b 5y agoI think that's incorrect. They couldn't log in, because that VPN tunnel is only open before logging in. So they had to gain access while on the login screen.
- grege 5y agoAh yeah really good point, thanks.
- deleted 5y ago[deleted]
- yuuta 5y agoThe plain text SPI seems to be guilty. Could fTPM help?
- mjg59 5y agoYes, this is a (rare) case where fTPM has better security properties. For context: fTPM refers to a software-based implementation of a TPM running in an execution environment the OS has no direct access to. On Intel hardware, this is on the Management Engine - depending on the specific CPU range, this will either be on the CPU package or in the motherboard chipset. On AMD systems, it's running in the Platform Security Processor, a separate ARM core that's on the CPU package. For ARM systems, it's generally running on the main execution cores but in the TrustZone environment. In all these scenarios the TPM code is running in the same environment as a bunch of other code that exposes some additional attack surface, so seems less appealing than a discrete TPM. On the other hand, the sort of attack described here is probably impractical unless you have much higher end equipment.
- deleted 5y ago[deleted]
- mjg59 5y agoThings that would mitigate this to some extent: 1) Requiring an additional factor for disk encryption in addition to the TPM data. You want the TPM to be involved in order to be able to detect whether the boot environment has been modified and refuse to hand over the key in that case, but this case is an example of why automatically handing over the FDE key at boot isn't ideal 2) The use of parameter encryption. TPMs support the establishment of sessions that include key exchange, and can then encrypt responses sent to the OS. This isn't ideal - verifying that you're communicating with a real TPM is somewhat convoluted at this point, so someone with physical access can interpose the TPM and MITM the key exchange. This is a substantially more invasive attack, though. I'm surprised that Windows isn't doing this by default, which makes me suspect that there may be some corner cases that make this more difficult than I imagine. 3) Storing the VPN credentials in hardware. Once the attackers had access to the filesystem, they could simply copy the credentials. If the VPN key were actually generated on the TPM then this could be avoided. In order to get on the VPN, the attackers would have had to modify the filesystem in order to let them put the disk back in the original machine and boot it. This would mean they'd need to retain access to the machine for as long as they wanted VPN access, which increases the chances that the machine's absence would be noted and its credentials revoked. 4) Requiring user auth before any amount of VPN access is granted. It's a lot easier to manage systems if they join the VPN without requiring that a user authenticate to the remote endpoint, but this is kind of a failure of the VPN model - once you're on the VPN, you've got access to everything on the VPN that doesn't require auth, and there's probably (for one reason or another) a lot of that. As mentioned elsewhere in the comments, using an fTPM (ie, one that's running on the Management Engine or in the Platform Security Processor) would avoid this (there's no convenient low speed bus for you to probe in that case), but I'm kind of reluctant to argue that the tradeoff is worth it.
- jnwatson 5y agoFor me, your number 2 was the biggest disappointment. That Bitlocker doesn't use TPM session encryption is a big failure in my mind.
- not2b 5y agoGood job describing the breakin to the laptop, but I was disappointed when I read that after bootup it auto-connects to the corporate network, nothing like Okta or Yubikey or something else needed as an authentication step. That made things too easy and seems like bad security practice.
- mabbo 5y agoPin + Yubikey. Not certain whether you can use a Yubikey without a pin, but I think it's important to specify: something you have plus something you know. The reason: the newer yubikeys don't ever leave the usb port. Mine is almost impossible to remove. And if this attack is based on a stolen laptop then chances are the yubikey comes with it. https://www.amazon.com/dp/B07HBDX2CM https://www.amazon.com/dp/B07HBDX2CM
- vitus 5y agoThe standard trick that I've seen used for removing a Yubikey Nano is threading a paperclip through that little hole, and tugging. Incidentally, you can also use a paperclip (a chain, even) to trigger a touch without having to touch the key directly.
- yencabulator 5y ago> Not certain whether you can use a Yubikey without a pin You can choose, no pin / pin once after plugging in / pin on every use.
- krzyk 5y agoYubikey is not something popular in enterprises. At least not the ones I worked for. I only heard about it because Google uses it (or something similar).
- deepfriedrice 5y agoAmazon uses it
- not2b 5y ago
- djrogers 5y agoNicely done! This should be a good reminder to everyone who utilizes a pre-logon VPN to treat that environment as if it were already compromised. I've set up a ton of these, and never in my wildest nightmares would I give the pre-logon user access to anything they could use to move laterally in the org. For those who aren't familiar with this, (for Palo Alto at least) there is a specific user assigned to pre-logon tunnels, and that user is supposed to be locked down - tight. Once a user authenticates fully to AD/okta/whatever, then the userID on the tunnel is swapped for the correct one, and your permissions become what they should be. Worth nothing that this is set up with firewall rules based on LDAP/AD user groups/UserIDs, so it's easy to configure, but probably easy to make mistakes.
- geocrasher 5y agoTwo things that I took away from this: 1) Physical access = Pwned 2) Determined attacker = Pwned
- elric 5y agoI'm assuming (or hoping) that access to this "internal network" doesn't automagically mean access to services on this network? Surely you require authentication for pretty much everything?
- raxxorrax 5y agoI think in most cases ransomware starts to encrypt network drives. You are automatically authenticated with your domain account. Rigid rights management would help, but security competes with ease of access.
- pluto7777 5y agoIf you want your story to be read, you should chose contrasting colors instead of light grey against a white page. Why am I even having to say it?
- gz5 5y agoThere will always be a way in a network. The question is can we eliminate the network? Now that computers in a LAN/WAN barely 'talk' to each other, and the apps are rarely on the same network as the users' computers, is there enough value in networking the computers relative to the risk of creating a valuable target for attackers? Consider for example what the business case for attackers would look like if their target was an island of one. Of course networks have benefits such as simpler ways for IT or MSPs to manage devices and updates, shared auth structures, directories and policies, etc. If we look at all those benefits, and consider the alternatives, are they worth the risk of a network in today's topologies with today's threat vectors?
- lmm 5y agoI've been saying for about 10 years now: make your network public, and use actual authentication on things that need access control. Visitors using your wifi? No problem, since your wifi is just another part of the internet as far as your threat model is concerned.
- teddyh 5y agoYes! I concur wholeheartedly, and I regret that I have but one upvote to give. To contribute something, here is RFC 3724, "The Rise of the Middle and the Future of End-to-End: Reflections on the Evolution of the Internet Architecture": https://www.rfc-editor.org/rfc/rfc3724.html https://www.rfc-editor.org/rfc/rfc3724.html
- djrogers 5y agoThat’s really the whole idea behind BeyondCorp (Google’s model) and numerous other Software Defined Perimeter and Identity Aware Proxy architectures. There is actually a pretty big shift in corporate networks going on right now, originally driven by IaaS and SaaS adoption (if your applications and data don’t live in your own data center, what is your ‘private network’ doing for you?). This change has been massively accelerated by WFH/COVID in the past 18 months.
- ecesena 5y agoAny idea how hard would the equivalent be on a mac?
- rhacker 5y agoCompany networks still exist?
- basicplus2 5y agoThe "CMOS" on the same bus as the TPM was Macronix Serial Multi I/O (MXSMIO™) Flash https://www.mxic.com.tw/en-us/products/NOR-Flash/Serial-NOR-Flash/Pages/spec.aspx?p=MX25L12873F&m=Serial+NOR+Flash&n=PM1914 https://www.mxic.com.tw/en-us/products/NOR-Flash/Serial-NOR-...
- lostmsu 5y agoThe issue is not the CMOS chip, it is how the motherboard vendor choose to connect it.
- basicplus2 5y agoYes i know... i was just surprised it was referred to as the "CMOS" my curiosity got the better of me and i looked it up and thought other people might be curious too, and I thought it might save people time if I gave the details
- jaclaz 5y agoBut the connection only make "easier" to connect to much larger pins, a determined attacker would be able to connect to the SPI bus even on the teeny-tiny TPM cheap directly, it's only a matter of having some more sophisticated hardware, risking doing a chip-off, etc. Only as an example (and not actually usable in this case unless a chip-off is done), there is what I call a cross-breed between an octopus and a acupuncturist: https://blog.acelaboratory.com/pc-3000-flash-spider-board-adapter-how-to-use-it.html https://blog.acelaboratory.com/pc-3000-flash-spider-board-ad...
- bruce343434 5y ago>Trojaned PDFs Excuse me, but what? What code executes when reading a pdf?
- kccqzy 5y agoThe code in a PDF reader executes when reading a PDF. So, things like evince, Preview.app and their dependencies. These things may have bugs that can be vectors of attack. (Not sure if your question meant code inside a PDF? If so, you'll find that PDFs can contain JavaScript which is executed when opened.)
- bruce343434 5y agoUgh, didn't know about that. Do you know if there exist any tools that can strip PDFs from all this bs? Also, I assume most readers are actually sane enough not to run any pdf scripts?
- npteljes 5y agoYour best bet is using up to date software.
- deleted 5y ago[deleted]
- excalibur 5y agoI'm honestly surprised it was this hard to hack. Seems to me without a bitlocker password the hard drive automatically decrypts at boot, rendering the encryption completely irrelevant. The low hanging fruit should be finding a way through the windows login.
- ryankrage77 5y agoThe utilman.exe trick relies on having write access to the filesystem, something you cannot do while the machine is off (disk is encrypted) or at the login screen (system is live, you can't mount the disk). Mounting a disk from a hibernating system doesn't work either, in my experience. Of course, there are other ways to defeat Windows logon, but they're presumably more difficult.
- api 5y agoThis sort of thing is a reminder that your internal network should be kept as clean and secure as possible. Perimeters (physical or virtual) are nice but they're only a first line of defense. So many people have this mental model of a castle with a moat and inside the network it's unpassworded database servers and control panels, the same default password everywhere, etc.
- phendrenad2 5y agoIt always bothered me that companies issue developers laptops. Why not desktops? Sure, it enables the free-wheeling, hot-desking, impromptu meeting culture that exists in most software development teams, but is that a good thing?
- retox 5y agoI'm a dev that previously had a high powered desktop, then COVID happened and I had to move the desktop home with a friend from the office because I don't drive. The standard desktop builds didn't include the VPN settings because desktops don't move, right? Now I have a laptop I can WFH from and take into the office when I do, and it has higher specs than the desktop (VR more-than-capable) because we don't update hardware piecemeal due to leasing it. The only benefit of having a desktop for me would be to allow for more HDD bays internally.
- camtarn 5y agoBoth the companies I've worked for issued a desktop, for primary development, and a laptop, for WFH and on-call.