Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack open malware that hid for 5 years

arstechnica.com

Post reply on HN
Print view View original

11–20 of 232 posts

Re: Researchers crack open malware that hid for 5 years

#11

Post by MOARDONGZPLZ »

paxcoder wrote: post #7
frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

Can you clarify what exactly is so impressive about this software? I read the article, and I don't see it.

This seems to be the crux of it:

Part of what makes ProjectSauron so impressive is its ability to collect data from air-gapped computers. To do this, it uses specially prepared USB storage drives that have a virtual file system that isn't viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for storing data that is kept on the air-gapped machines. The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives.

Re: Researchers crack open malware that hid for 5 years

#12

Post by chillydawg »

paxcoder wrote: post #7
frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

Can you clarify what exactly is so impressive about this software? I read the article, and I don't see it.

Stealth. Being found after 5 years is considerably better concealment than most malware (that is discovered at all).

Re: Researchers crack open malware that hid for 5 years

#13

Post by pjc50 »

frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

If your machine has a USB port, it's no longer properly isolated.

Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports.

You could quite easily hide a USB mass storage device inside a mouse, or with a bit more work have an unmodified mouse with a spare Flash area used for data exfiltration.

(Firewire is even worse, and Thunderbolt lets you onto the PCI bus)

Re: Researchers crack open malware that hid for 5 years

#16

Post by leni536 »

pjc50 wrote: post #13
frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

> You could quite easily hide a USB mass storage device inside a mouse

AFAIK one could mitigate something like this by really restrictive udev rules only allowing certain usb drivers on certain usb ports (like no usb msc on the port dedicated for keyboard only).

Re: Researchers crack open malware that hid for 5 years

#17

Post by dragonwriter »

pjc50 wrote: post #14
coldcode wrote: post #2

Some at the NSA is having a bad day reading this.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.

Re: Researchers crack open malware that hid for 5 years

#18

Post by mtgx »

dragonwriter wrote: post #17
pjc50 wrote: post #14

Earlier quoted context omitted.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.

If only the media was quick to blame them for cyberattacks that happen under their watch, too. Then they might finally start to care. But because corporate media has such a tight relationship with all the Washington insiders, that never really happens.

One good example from recent times of how well this type of "incentive" works is Google and Stagefright. The media went nuts over Stagefright affecting virtually all Android devices - and for good reason, too.

Since then Google seems to be taking Android security way more seriously, and there have been a lot of serious security improvements in Android (7.0) over the past year.

But these sort of actions seem to happen in slow motion, if at all, when there isn't a hacking/malware catastrophe for which the companies can get blamed in the press.

The NSA pushed hard for new surveillance laws such as CISA with the promise that it's what they need to keep us safe against cyberattacks. So why isn't every single media entity blaming the NSA over every major new data breach that happened since then?

Re: Researchers crack open malware that hid for 5 years

#19

Post by cloudjacker »

MOARDONGZPLZ wrote: post #11
paxcoder wrote: post #7

Earlier quoted context omitted.

Can you clarify what exactly is so impressive about this software? I read the article, and I don't see it.

This seems to be the crux of it: Part of what makes ProjectSauron so impressive is its ability to collect data from air-gapped computers. To do this, it uses specially prepared USB storage drives that have a virtual file system that isn't viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for…

Okay first, it probably doesn't get information from air gapped computers without being plugged in, so let's quit with the voodoo right now. You guys are discounting the possibility of idiocy.

Second, making partitions that windows doesn't see is trivially easy. I went out of my way to buy a 128gb flash drive nearly 10 years ago at great expense, it had a 4gb fat 32 partition which is what Windows would see.

It had an 16gb Linux partition with 8gb of that being an encrypted partition

I installed a bootloader that allowed it to be switched to if plugged in when any computer was starting up

The other 100gb you ask? Another partition....

Re: Researchers crack open malware that hid for 5 years

#20

Post by mr_overalls »

What is the role of an InfoSec professional in an environment where advanced threats like this are being deployed? I mean, a beat cop knows when it's time to call the FBI or the military. But the open nature of the Net means that firewall probes by script kiddies are interspersed with intrusions by nation-state actors. It's a weird state of affairs.
Post reply on HN