Stolen Laptops - Advanced Physical Attack Methodologies Against Modern Systems

Explore advanced physical attack methodologies against modern laptops in this comprehensive conference talk that demonstrates why encryption at rest is insufficient protection in 2025. Learn how offensive security teams penetrate well-hardened laptops during "stolen laptop scenarios" without power or credentials, beginning with an examination of the organizational impact from compromised devices through extracted domain credentials, tickets, certificates, cookies, and sensitive data. Discover direct-memory access (DMA) attacks including their physical and logical implementations, defenses, and bypass techniques through an overview of PCI Express technology and DMA hardware utilizing FPGA boards. Watch practical demonstrations of attacks against modern laptops alongside countermeasures introduced by hardware vendors and methods attackers use to circumvent these protections. Delve into BIOS/UEFI security and its relationship to DMA attacks, including exploitation of pre-boot environments and physical attacks against BIOS EEPROM chips using universal programmers. Examine encryption at rest technologies, specifically BitLocker and TPM implementation, understanding why these measures prove insufficient against attackers with physical access, culminating in an exploit demonstration that compromises Windows OS from UEFI via DMA even when all modern countermeasures are enabled. Master open-source tools including PCILeech, MemProcFS, and UEFITool, along with closed-source solutions like XGPro, while learning proper configurations that can limit or eliminate these attack vectors.