Stolen Laptops - A brief overview of modern physical access attacks

Stolen Laptops: A Brief Overview of Modern Physical Access Attacks

Speaker: Pierre-Nicolas Allard-Coutu (Bell Canada — STIRT)

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=IVDxu09Qk2g

Reading time: ~8 minutes

TL;DR

Pierre-Nicolas Allard-Coutu, senior penetration tester at Bell Canada's STIRT team, delivers a fast-paced, technically detailed breakdown of how modern laptops are compromised in physical access ("stolen laptop") scenarios. Encryption at rest alone is not sufficient protection in 2025. The talk covers the full attack chain: BitLocker TPM-only mode as a prerequisite attack surface, Direct Memory Access (DMA) attacks via FPGA hardware connected to M.2 PCIe ports, the PCILeech framework and its ecosystem, IOMMU countermeasures, and practical techniques attackers use to circumvent them. It is both a practitioner's guide and an organizational wake-up call.

Introduction

Laptops are the universal organizational asset. Every employee has one. Each device is potentially loaded with Active Directory credentials, Kerberos tickets, NTLM hashes, cloud tokens, cached emails, and local files — a complete foothold into an organization's broader infrastructure. The conventional wisdom is that BitLocker encryption at rest makes a stolen laptop safe. Allard-Coutu's thesis is direct: that assumption is wrong in 2025, and organizations relying on it are operating with a dangerously outdated threat model.

The "stolen laptop scenario" is a defined pentest service offering: the tester assumes unlimited physical access to a target device, has reasonable time to work, and knows the device has been previously used by a real employee with live credentials against the target organization. The goal is maximum realistic impact — gaining SYSTEM-level code execution and extracting everything of value. The talk is structured as a progressive tour from the most accessible attacks to the most sophisticated, with countermeasures and attacker circumventions woven in at each layer.

The Attack Surface: Why BitLocker TPM-Only Mode Matters

BitLocker is the dominant Windows encryption-at-rest implementation. Its most common enterprise configuration uses a Trusted Platform Module (TPM) — either a discrete chip or a firmware implementation — to hold the volume encryption key. When the machine boots, the TPM validates the integrity of the boot chain and releases the key automatically. No PIN, no password, no user interaction required.

This is a significant convenience feature, and it is also the central attack surface. Because Windows decrypts and boots automatically, an attacker who has physical access to a powered-on or recently-powered-off machine does not need to know any credentials to reach a running, decrypted Windows session. They only need to reach memory before the session is locked — or to force a state in which memory remains accessible.

Allard-Coutu notes that organizations frequently justify the absence of pre-boot PINs by citing user-experience concerns and support overhead. But the operational tradeoff is severe: TPM-only BitLocker provides robust protection against mounting the drive externally, but essentially no protection against an adversary with physical access and the right hardware.

▶ Watch: BitLocker TPM-Only Mode and Attack Surface (4:00)

Direct Memory Access Attacks: The Core Technique

Direct Memory Access (DMA) is a performance optimization that allows peripheral devices to read and write system memory without routing every operation through the CPU. High-bandwidth devices — GPUs, NVMe SSDs, network cards — rely on DMA to avoid CPU bottlenecks. The mechanism that enables this is PCI Express (PCIe), the high-speed serial expansion bus that connects peripheral components to the system.

The attack is conceptually simple: connect a malicious device to the target machine's PCIe network, and use the DMA capability to read and write kernel memory directly. In practice, this means writing shellcode, manipulating process structures, or patching Windows authentication functions — all without loading a driver, triggering EDR sensors, or interacting with the operating system through any software interface.

The device used is an FPGA — a field-programmable gate array. Not a microcontroller. FPGAs are capable of high-throughput parallel processing, which is why they are well-suited to scanning and manipulating large volumes of system memory rapidly. Allard-Coutu notes that commercially available FPGAs suitable for DMA attacks cost $200–$300 at the high end, with newer cheaper options entering the market. The necessary M.2 adapters to connect the FPGA to a laptop's internal PCIe port add perhaps another $5–$10.

▶ Watch: DMA Attack Theory and FPGA Hardware (8:00)

PCIe Form Factors and PCILeech

Full-size PCIe slots do not appear on modern laptops. The relevant form factors are M.2 variants (M.2a, M.2b, M.2e, M.2m) and Thunderbolt. Allard-Coutu clarifies a common point of confusion: despite online claims that different M.2 keying configurations are not cross-compatible for attack purposes, the right adapters make all M.2 variants usable as PCIe attack surfaces. Thunderbolt is excluded from the talk because it is significantly more complex and typically receives additional hardening from vendors; it deserves its own dedicated presentation.

The standard software toolkit for DMA research and exploitation is PCILeech, created by researcher Ulf Frisk. PCILeech provides the framework for communicating with the target machine over DMA, and is extended by the MemProcFS project, which provides a filesystem abstraction over memory — making memory navigation intuitive for analysts accustomed to file-system-based tooling. On top of these foundations, community-developed memory modules handle specific attack primitives: patching the Windows logon function to remove the password requirement, dumping LSASS, extracting NTLM hashes and Kerberos tickets, and achieving arbitrary code execution.

Allard-Coutu describes a practical workflow: plug the FPGA into an M.2 port (disconnecting a non-essential device if all ports are occupied — a second SSD or a Wi-Fi card), connect the FPGA to a Linux attack machine via USB, run PCILeech, and issue the desired attack commands. The process can be completed in minutes by a practitioner familiar with the tooling.

▶ Watch: PCILeech, MemProcFS, and Practical Workflow (10:00)

IOMMU: The Countermeasure and Its Circumvention

The primary hardware countermeasure against DMA attacks is the IOMMU — Input-Output Memory Management Unit. The IOMMU restricts which memory regions a given peripheral device is allowed to access, enforcing a permission boundary between DMA-capable devices and the rest of system memory. When properly configured and enforced, the IOMMU prevents an attacker-controlled FPGA from reading or writing arbitrary kernel addresses, because the device is only permitted to access the memory ranges explicitly allocated to it.

The challenge is that IOMMU enforcement is not universal, not always enabled by default, and subject to a range of bypass techniques. Allard-Coutu covers the attacker's response to IOMMU protection: techniques that exploit initialization windows before IOMMU enforcement activates, vulnerabilities in specific IOMMU implementations, and configurations in which the IOMMU is present but not correctly enabled in firmware or operating system policy. The countermeasure arms race is ongoing, and the current state of the field favors attackers with patience and access to detailed firmware documentation.

The BIOS/UEFI attack surface is also addressed. Firmware-level configuration controls many of the security properties that determine whether DMA attacks succeed — boot order, Secure Boot enforcement, IOMMU policy, and pre-boot authentication requirements. An attacker with physical access and time can interact with the firmware directly if it is not password-protected, potentially reconfiguring the machine in ways that make subsequent attacks easier.

▶ Watch: IOMMU Countermeasures and Bypass Techniques (24:00)

What Attackers Walk Away With

The framing device throughout the talk is explicit: the reason organizations should care about this attack class is not the elegance of the technique but the value of what it yields. A successfully compromised laptop provides SYSTEM-level code execution and access to everything on the device. In practice, this means:

• Active Directory credentials — enabling lateral movement and scope change into the broader enterprise environment
• Cloud credentials — for any cloud services the employee was authenticated to
• DCC hashes, NTLM hashes, and Kerberos tickets — crackable or replayable for further access
• Local administrator credentials — particularly valuable in organizations not using LAPS, where the same local admin password may be reused across the entire fleet
• Cached emails, files, and browsing artifacts — for intelligence gathering or escalation

Allard-Coutu dismisses EDR as a meaningful defense once an attacker has physical access and local administrator privileges, explaining the technique for disabling EDR drivers via Windows Recovery mode before any offensive tooling is run. The point is not that EDR is useless — it is that EDR is a software control, and software controls are subservient to physical access.

▶ Watch: Post-Exploitation Loot and EDR Bypass (2:00)

Notable Quotes

"If you're not opening the chassis of your target computer that you're pen testing against, you're doing it wrong. You need to be voiding warranties up in here."

"Encryption at rest is NOT enough in 2025. I can't tell you how many times I've heard organizations say, 'We don't care about someone stealing a laptop because our stuff is encrypted.' This is not enough."

"Once you have admin and physical access, EDR doesn't matter."

"If it fits, it works. Don't let anybody tell you otherwise."

Key Takeaways

• Encryption at rest alone is insufficient. TPM-only BitLocker protects the drive from external mounting but leaves the running system exposed to DMA attacks during normal operation.
• Pre-boot authentication is a meaningful control. A BitLocker PIN or passphrase requirement prevents the automatic decryption that makes DMA attacks viable during the boot window.
• DMA attack hardware is cheap and accessible. An FPGA plus adapters costs well under $400 and connects to any modern laptop via M.2 PCIe ports.
• PCILeech and MemProcFS lower the skill floor. Pre-built memory modules handle most common attack primitives, making this technique accessible to practitioners without deep kernel development backgrounds.
• IOMMU is the right countermeasure — but implementation matters. Enabling and correctly configuring IOMMU in firmware policy is the primary technical defense. Verify it is actually enforced, not merely present.
• Physical access defeats EDR. Any EDR product that relies on kernel drivers can be disabled by an attacker with physical access and local admin privileges before offensive tooling is deployed.
• The stolen laptop scenario yields organization-wide access. The endpoint is not the target — it is the key to the broader environment via credential extraction and lateral movement.