Dark Mentor LLC

Dark Mentor LLC

Corrupting the young and old alike.

About Us

Dark Mentor LLC was started in 2018 as a low-level-security consultancy, specializing in full-stack bluetooth security, firmware security, and security education.

Focus Areas

Bluetooth Security

Maddest of the mad skillz

Firmware Security

Darkest of the dark skillz

Education & Mentorship

Coolest of the cool skillz

Past Publications

The ESP32 "backdoor" that wasn't
This post refutes the claim that researchers found a “backdoor” in ESP32 Bluetooth chips. What the researchers highlight (vendor-specific HCI commands to read & write Controller memory) is a common design pattern found in other Bluetooth chips from other vendors as well, such as Broadcom, Cypress, and Texas Instruments. Vendor-specific commands in Bluetooth effectively constitute a “private API”, and a company’s choice to not publicly document their private API does not constitute a “backdoor”.
Xeno Kovah
Crowdsourcing Bluetooth identity, to understand Bluetooth vulnerability

Bluetooth vulnerability assessment is still in the dark ages. We still don’t have a good handle on all the devices that are …
Xeno Kovah
Cite DistrictCon Slides (PDF) DistrictCon Presentation Video Blue2thprinting Code CLUES Schema/Data BTIDES Schema
Bluetooth Low Energy - Full Stack Attack
4 day class covering the full Bluetooth Low Energy (BLE) protocol stack from the bottom (PHY) up to the top (GATT). The core of the class is built around playing with a game application on an Android phone, talking via Bluetooth to an IoT-type piece of hardware, and analyzing the communication between them. The 4th day is focused on assessing a cutomized Ultra-Vulnerable Peripheral firmware, running on Zephyr RTOS, which has had vulnerabilities introduced into it which are representative of vulnerabilities found in the past across many other platforms.
Veronica Kovah, Xeno Kovah
RISC-V Assembly
3 day class covering RISC-V RV32I/RV64I assembly, including the “M” extensions. Class is built on Linux with a QEMU RISC-V emulated environment, with code debugged by GDB. Option also exists to use real RISC-V hardware. Option also exists to use Ghidra Software Reverse Engineering (SRE) tool as a debugger.
Xeno Kovah
C/C++ Source Code Auditing, for developers, and vulnerability hunters
Variable-length class (1-5 days). This class teaches how to find vulnerabilities in source code, and then how to prevent, detect, or mitigate them. The class teaches vulnerability pattern recognition by walking students through real CVEs. The class structure was originally created for Apple’s internal training for their developers when Xeno worked there.
Xeno Kovah
Intel x86-64 Firmware Attack & Defense
2 day class covering Intel x86-64 firmware. Class is focused on exploring the baseline security mechanisms provided by Intel to protect the Serial Peripheral Interface (SPI) flash chip where the Unified Extensible Firmware Interface (UEFI) Basic Input Output System (BIOS) is stored on modern systems.
Xeno Kovah
Intel x86-64 OS Internals
2 day class covering Intel x86-64 OS Internals like privilege rings, model-specific registers (MSRs), segmentation, paging, system calls, interrupts, port IO, and breakpoints. Class is run in Windows with WinDbg-based kernel debugging.
Xeno Kovah
Intel x86-64 Assembly
3 day class covering Intel x86-64 assembly. Includes options to run with Windows and WinDbg or Linux and GDB. Option also exists to use Ghidra Software Reverse Engineering (SRE) tool as a debugger.
Xeno Kovah
Blue2thprinting (blue-[tooth)-printing]: answering the question of 'WTF am I even looking at?!'

If one wants to know (for attack or defense) whether a Bluetooth (BT) device is vulnerable to unauthenticated remote over-the-air …
Xeno Kovah
Cite -=Kovah Cut=- (1h40m) Full Presentation Video -=Kovah Cut=- (1h40m) Slides (PDF) Hardwear.io Slides (PDF) Hardwear.io Presentation Video H2HC Slides (PDF) ShmooCon Slides (PDF) ShmooCon Presentation Video (MP4) Blue2thprinting Code
Open Wounds: The last 5 years have left Bluetooth to bleed

Over the past 20 years there have been 3 waves of Bluetooth (BT) security research. The first wave peaked in 2004, and rather abruptly …
Xeno Kovah
Cite Hack.lu Slides (PDF) Hack.lu Presentation Video
It Was Harder to Sniff Bluetooth Through My Mask During the Pandemic...

During the pandemic I took up Bluetooth (BT) sniffing as a way to get out of the house. I didn’t know what was out there for BT …
Xeno Kovah
Cite -=Kovah Cut=- (2h) Full Presentation Slides -=Kovah Cut=- (2h) Full Presentation Video Hack in the Box Slides (PDF) Hack in the Box Conference Presentation Video Hacktivity Slides (PDF) Hackfest Slides (PDF) SecTor Slides (PDF) Sniffing code
Finding New Bluetooth Low Energy Exploits via Reverse Engineering Multiple Vendors' Firmwares
Bluetooth Low Energy (BLE) has seen widespread product adoption and a renewed interest from a security community whose interest in …
Veronica Kovah
Cite Slides (PDF) Whitepaper (PDF) PoC Exploit Code Conference Presentation Video
BIOS Necromancy: Utilizing “Dead Code” for BIOS Attacks

During our work towards trying to help secure firmware, we have begun to discover a trend. There are situations where unused “dead …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Thunderstrike 2: Sith Strike
In this work we teamed up with Trammell Hudson to improve upon his previous Thunderstrike proof of concept. Previously it required …
Trammell Hudson, Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video Demo Video 1 - Thunderstrike 2 'firmworm' propagation video Demo Video 2 - Bricking MacMini without a need for an exploit
Are You Giving Firmware Attackers a Free Pass?
Yes. Yes you are. Because you’re not patching away the vulnerabilities we and others have found and disclosed, and you’re not …
Xeno Kovah, Corey Kallenberg
Cite Slides (PDF)
How Many Million BIOSes Would you Like to Infect?
Because people don’t ever patch their BIOSes, it is extremely likely that the vast majority of systems in the wild are vulnerable to at …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Demo Video 1 - Infecting ASUS Demo Video 2 - Infecting HP Demo Video 3 - Attacking TAILS Demo Video 4 - Bricking a Gigabyte motherboard with “DualUEFI” backup BIOS, which is supposed to prevent bricking
Betting BIOS Bugs Won’t Bite Y’er Butt?
Survey of some of the many BIOS level vulnerabilities that have come out in the past few years, for those who were not following the …
Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video
Analyzing UEFI BIOS from Attacker and Defender Viewpoints
In 2013, MITRE released Copernicus 1, a best-effort system to capture a raw dump of the BIOS and whether it appears to be possible for …
Xeno Kovah, John Butterworth, Corey Kallenberg, Sam Cornwell
Cite Slides (PDF) Conference Presentation Video
What Would it Take to Enable Global Firmware Vulnerability Checking & Integrity Checking?
A Microsoft-targeted discussion of what they could do to improve the state of firmware security, e.g. by performing vulnerability and …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Into the Unknown: How to Detect BIOS Attackers
Talks targeted at encouraging Anti-Virus vendors to start checking for malware at the BIOS level, and to encourage Mandiant customers …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (VirusBulletin - PDF) Slides (MIRCon - PDF)
Extreme Privilege Escalation on Windows 8/UEFI Systems
Public disclosure of two vulnerabilities (VU#552286) that allow a ring 3 attacker to feed a UEFI system a fake BIOS update, cause a …
Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
SENTER Sandman: Using Intel TXT to Attack BIOSes
A description of how Intel TXT’s SMI suppression behavior can be used to subvert a BIOS protection mechanism. Also a discussion of on …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Setup For Failure: Defeating Secure Boot
Disclosure of a vulnerability (VU#758382) with the “Setup” UEFI non-volatile variable on some systems. Manipulation of this variable …
Corey Kallenberg, Sam Cornwell, Xeno Kovah, John Butterworth
Cite Slides (Merged with Intel, PDF) Slides (Unmerged with Intel, PDF) Whitepaper (PDF) Conference Presentation Video
Copernicus 2: SENTER the Dragon!
Discussion of how a SMM MitM attacker (“Smite’em”) can subvert all software-based BIOS capture utilities (including our own …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Smiteem defeating BIOS reading tools demo video Copernicus 2 demo video
Defeating Signed BIOS Enforcement
While there had been previous attacks, against BIOS, they often relied on having a BIOS that was wide open. Only a single previous …
Corey Kallenberg, John Butterworth, Xeno Kovah, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Mapping Free & Open Source Deep Technical Training to the NICE Framework
Discussing some of the limitations of the NIST NICE framework, as determined by trying to map the OpenSecurityTraining.info classes to …
Xeno Kovah
Cite Slides (PDF)
BIOS Chronomancy: Fixing the Core Root of Trust for Measurement
(The first appearance at NoSuchCon in May 2013 did not include a discussion of VU#912156, but subsequent talks did.) Discussed how the …
John Butterworth, Corey Kallenberg, Xeno Kovah, Amy Herzog
Cite Slides (PDF) Whitepaper (PDF) Copernicus Binary Executable (ZIP) Conference Presentation Video
Copernicus: Question your assumptions about BIOS security
Discussion of how Copernicus could be used for enterprise-wide assessment of BIOS vulnerabilities, and integrity checking BIOSes to …
Xeno Kovah, Corey Kallenberg, John Butterworth, Amy Herzog
Cite Code
Timing-Based Attestation: Sexy Defense, or the Sexiest?
Explaining how Timing-Based Attestation (or Software-Based Attestation as it’s known when you don’t use special hardware) is an …
Xeno Kovah, Corey Kallenberg
Cite Conference Presentation Video
No More Hooks: Trustworthy Detection of Code Integrity Attacks
Making the “New Results for Timing-Based Attestation” paper content accessible to a Defcon audience.
Xeno Kovah, Corey Kallenberg, Chris Weathers, Amy Herzog, Matthew Albin, John Butterworth
Cite Slides (PDF) Conference Presentation Video
New Results for Timing-Based Attestation
In this talk we coined the term Timing-Based Attestation (TBA) to refer to what was previously called “software-based …
Xeno Kovah, Corey Kallenberg, Chris Weathers, Amy Herzog, Matthew Albin, John Butterworth
Cite Whitepaper (PDF)
Training Deep Technical Security Experts at Scale: Lessons Learned from Massive Online Classes
Outlining the case that in order to train the necessary number of security experts currently needed, we must use both open source and …
Xeno Kovah
Cite Slides (PPT) Conference Presentation Video