Bytes in Disguise: Abusing Non-Volatile Memory
Mickey Shkatov and Jesse Michael demonstrate abusing non-volatile memory chips in laptop trackpads and USB-C monitors to store stealthy malware payloads.
Summary
The Hidden Nooks of Non-Volatile Memory
Modern computers contain dozens of independent non-volatile memory (NVM) chips across motherboards, trackpads, keyboards, and USB-C peripheral displays.
Auditing Auxiliary Peripheral Controllers
Mickey Shkatov and Jesse Michael investigate undocumented flash storage regions inside everyday laptop hardware components.
Achieving Persistence Without Triggering Side Effects
The authors demonstrate storing arbitrary data and executable code in unused peripheral flash memory, remaining completely undetected by host operating system antivirus tools.
Firmware Integrity Verification and Defenses
Mitigating NVM abuse requires implementing cryptographic firmware signing and hardware write-protect locking on all peripheral microcontrollers.
Related talks
Main Stage·30 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael answer community questions regarding non-volatile memory chips, peripheral firmware modification, and detection.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.