Physical security testing and hardware attack techniques. Use this skill whenever the user mentions physical access, BIOS/UEFI password recovery, hardware security testing, cold boot attacks, DMA attacks, BadUSB/HID implants, BitLocker bypass, chassis intrusion switches, or IR sensor bypass. Trigger for any physical penetration testing scenario, hardware forensics, or security assessment involving direct device access.
Physical security testing and hardware attack techniques. Use this skill whenever the user mentions physical access, BIOS/UEFI password recovery, hardware security testing, cold boot attacks, DMA attacks, BadUSB/HID implants, BitLocker bypass, chassis intrusion switches, or IR sensor bypass. Trigger for any physical penetration testing scenario, hardware forensics, or security assessment involving direct device access.
Hardware Physical Access Attacks
A comprehensive guide for physical security testing and hardware-based attack techniques. This skill covers BIOS/UEFI manipulation, memory attacks, HID implants, and physical bypass methods.
When to Use This Skill
Use this skill when:
Testing physical security controls on devices
Recovering or bypassing BIOS/UEFI passwords
Performing hardware-based penetration testing
Analyzing memory dumps or cold boot scenarios
Working with HID/BadUSB implants
Bypassing BitLocker or other disk encryption
Exploiting physical device vulnerabilities
Conducting security assessments with physical access
BIOS/UEFI Password Recovery
Method 1: Hardware Reset
CMOS Battery Removal:
Power off the device and disconnect all power sources
Open the chassis to access the motherboard
Locate the CMOS battery (typically CR2032 coin cell)
Remove the battery and wait 30 minutes
Reinstall the battery and power on
BIOS settings including passwords will be reset to defaults
Jumper Reset:
Locate the CMOS clear jumper on the motherboard (often labeled CLR_CMOS, CLEAR, or JBAT1)
RAM retains data for 1-2 minutes after power loss. This can be extended to 10+ minutes with cooling.
Cold Boot Attack Procedure
Prepare the system:
Ensure target system is running with sensitive data in memory
Have a bootable USB with memory dump tools ready
Cool the RAM (optional but recommended):
Use compressed air or liquid nitrogen
Apply cooling to RAM modules while system is running
This extends data retention time
Create memory dump:
# Force reboot into memory dump mode# On Windows: Ctrl+Alt+Del → Restart while holding Shift# On Linux: Use magic SysRq key (Alt+SysRq+b)# Boot from Live USB and dump memorysudoddif=/dev/mem of=/root/memory.dump bs=1M
# orsudoddif=/dev/ram0 of=/root/memory.dump bs=1M
Analyze the dump:
# Install Volatility
pip install volatility
# Identify OS and profile
volatility -f memory.dump imageinfo
# Extract passwords and credentials
volatility -f memory.dump --profile=Win10x64 hashdump
volatility -f memory.dump --profile=Win10x64 credentials
Direct Memory Access (DMA) Attacks
INCEPTION Tool
INCEPTION enables physical memory manipulation through DMA interfaces:
Compatible Interfaces:
FireWire (IEEE 1394)
Thunderbolt
ExpressCard
PCMCIA
Attack Procedure:
# Clone and build INCEPTION
git clone https://github.com/SecurityInnovation/INCEPTION.git
cd INCEPTION
make
# Execute attack (requires physical DMA access)
./inception --target <device>
Capabilities:
Bypass login by patching memory
Inject arbitrary code
Extract encryption keys
Modify running processes
Limitations:
Ineffective against Windows 10+ with DMA protection
Requires physical access to DMA-capable ports
May trigger security alerts
Live CD/USB System Access
Windows Binary Replacement
Replace sethc.exe (Sticky Keys):
# Boot from Live USB# Mount Windows partitionsudo mount /dev/sdXY /mnt
# Backup originalsudocp /mnt/windows/system32/sethc.exe /mnt/windows/system32/sethc.exe.bak
# Replace with cmd.exesudocp /mnt/windows/system32/cmd.exe /mnt/windows/system32/sethc.exe
# Set permissionssudochown root:root /mnt/windows/system32/sethc.exe
# Tools required:# - Elcomsoft Forensic Disk Decryptor# - Passware Kit Forensic# Process memory dump
elcomsoft-fdd -i memory.dump -o recovery_keys.txt
Social Engineering Recovery Key
Add a new recovery key with all zeros:
# Convince user to run:
manage-bde -protectors -add C: -RecoveryPassword
# When prompted, enter: 00000000000000000000000000000000
Chassis Intrusion Switch Exploitation
Framework 13 Example
Reset Pattern:
1. Power on device (EC must be running)
2. Remove bottom cover to access intrusion switch
3. Press and hold switch for 2 seconds
4. Release and wait 2 seconds
5. Repeat cycle 10 times total
6. Reassemble and reboot
7. BIOS NVRAM will be wiped
Total time: ~40 seconds
Tools required: Screwdriver only
Generic Exploitation
Research vendor-specific reset patterns (forums, documentation)
Power on target to activate EC
Access intrusion/maintenance switch
Execute vendor-specific toggle pattern
Reboot - firmware protections cleared
Boot Live USB for post-exploitation
Detection & Mitigation
For Defenders:
Monitor chassis-intrusion events in management console
Apply tamper-evident seals on screws/covers
Keep devices in physically controlled areas
Disable maintenance switch reset features where possible
Require cryptographic authorization for NVRAM resets
IR Sensor Bypass
No-Touch Exit Sensor Attack
Sensor Characteristics:
Near-IR LED emitter with TV-remote style receiver
Requires 4-10 pulses at ~30 kHz carrier
Plastic shroud prevents direct emitter-receiver view
