BootPwn: Breaking Secure Boot by Experience [ATTEND ONLINE CyberWeek 2022]

Deliverables

During the training we will provide you with the following:

• cloud-based virtual machine with all the required tooling installed
• access to the exercise modules and instructions
• walk through videos for the hands-on exercises

We will also provide you the following in order to continue with the exercises after the training:

• offline virtual machine with all tooling preinstalled
• ability to copy the exercise modules and instructions
• ability to run the exercise modules forever

Format

This BootPwn experience will be given in a hybrid format where attendees are able to join in-person and online at the same time. Attendees need to select the desired format before the start of the training.

• Option1: The in-person format requires attendees to join us on-site in Abu Dhabi for 3 days full of lectures and practical exercises. The lectures and support are provided in-person using a classroom setting.
• Option 2: The online format requires attendees to join us online for 3 days full of lectures and practical exercises. The lectures from the in-person classroom are virtually streamed using Zoom. Support is provided virtually via Discord.

Both formats include an optional 4^th day which may be used by the attendees to complete the left-over exercises. During this day, for both formats, only online support is available via Discord. No in-person presence is available from the trainers nor required by the attendees.

Topics Covered

• Secure Boot introduction
• Secure Boot fundamentals
  – Embedded technology
  – Flash image parsing
  – Cryptography (e.g. authentication or decryption)

• Secure Boot attack surface
• Real-world Secure Boot attacks
• Identify Secure Boot vulnerabilities by analyzing
  – Design information
  – Flash dumps
  – Source code
  – Binary code

• Exploit Secure Boot vulnerabilities related to
  – Insecure designs
  – Vulnerable software
  – Using weak or incorrect cryptography
  – Too flexible configurations
  – Incorrect checks
  – Insecure parsing
  – Vulnerable hardware
  – Anti-Rollback
  – Fault injection