Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack open malware that hid for 5 years

arstechnica.com

Post reply on HN
Print view View original

21–30 of 232 posts

Re: Researchers crack open malware that hid for 5 years

#21

Post by TheCapn »

leni536 wrote: post #16
pjc50 wrote: post #13

Earlier quoted context omitted.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

> You could quite easily hide a USB mass storage device inside a mouse AFAIK one could mitigate something like this by really restrictive udev rules only allowing certain usb drivers on certain usb ports (like no usb msc on the port dedicated for keyboard only).

Personally? PC gets locked in a box with some sort of venting. Keyboard / Mouse are plugged in by IT and no one unauthorized has physical access to the PC itself.

If they're serious enough about finding 0 days and exploits to the USB or OS to load this shit any physical access to the box itself is off limits.

Re: Researchers crack open malware that hid for 5 years

#23

Post by Aelinsaar »

mr_overalls wrote: post #20

What is the role of an InfoSec professional in an environment where advanced threats like this are being deployed? I mean, a beat cop knows when it's time to call the FBI or the military. But the open nature of the Net means that firewall probes by script kiddies are interspersed with intrusions by nation-state actors. It's a weird state of affairs.

I'm sure the nation-state actors couldn't be happier about the confusing nature of that, and cultivate it within reason.

Re: Researchers crack open malware that hid for 5 years

#24

Post by redcalx »

TheCapn wrote: post #21
leni536 wrote: post #16

Earlier quoted context omitted.

> You could quite easily hide a USB mass storage device inside a mouse AFAIK one could mitigate something like this by really restrictive udev rules only allowing certain usb drivers on certain usb ports (like no usb msc on the port dedicated for keyboard only).

Personally? PC gets locked in a box with some sort of venting. Keyboard / Mouse are plugged in by IT and no one unauthorized has physical access to the PC itself. If they're serious enough about finding 0 days and exploits to the USB or OS to load this shit any physical access to the box itself is off limits.

Cut USB cable; splice new device into cable. Or, open mouse/keyboard case, wire device into USB bus connections.

Re: Researchers crack open malware that hid for 5 years

#25

Post by pjc50 »

leni536 wrote: post #16
pjc50 wrote: post #13

Earlier quoted context omitted.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

> You could quite easily hide a USB mass storage device inside a mouse AFAIK one could mitigate something like this by really restrictive udev rules only allowing certain usb drivers on certain usb ports (like no usb msc on the port dedicated for keyboard only).

You can mitigate the exploit against standard mass storage drivers, yes, but there are other ways. It appears in this case the host was compromised (so able to override the drivers).

If a userland program can get at the raw HID interface, that can also be used for exfiltration to a tailored device.

Re: Researchers crack open malware that hid for 5 years

#26

Post by drzaiusapelord »

skybrian wrote: post #22

Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.

Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc.

Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.

Re: Researchers crack open malware that hid for 5 years

#27

Post by IntelMiner »

cloudjacker wrote: post #19
MOARDONGZPLZ wrote: post #11

Earlier quoted context omitted.

This seems to be the crux of it: Part of what makes ProjectSauron so impressive is its ability to collect data from air-gapped computers. To do this, it uses specially prepared USB storage drives that have a virtual file system that isn't viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for…

Okay first, it probably doesn't get information from air gapped computers without being plugged in, so let's quit with the voodoo right now. You guys are discounting the possibility of idiocy. Second, making partitions that windows doesn't see is trivially easy. I went out of my way to buy a 128gb flash drive nearly 10 years ago at great expense, it had a 4gb fat 32 partition which is what Windows would see. It had a…

"making partitions that windows doesn't see is trivially easy"

Are we talking "partitions Windows wont mount because they aren't FAT/NTFS" or "partitions that literally do not show up to Windows Disk Management because the disk itself is showing a different capacity. EG: A 16GB USB reporting only 8GB, regardless of the OS installed"

Like one of these, only malicious

https://www.neowin.net/news/fake-chinese-500-gb-external-dri...

Re: Researchers crack open malware that hid for 5 years

#28

Post by Aelinsaar »

sitkack wrote: post #8
zellyn wrote: post #4

Earlier quoted context omitted.

The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?

Now they are in the SMC and the secure enclave.

As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?

Re: Researchers crack open malware that hid for 5 years

#29

Post by ethanbond »

skybrian wrote: post #22

Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.

Well one of the linked/related attacks, called "Equation," was apparently distributed at least once via CD without a person on the ground (near the target, at least).

It says that the CD, containing data about a recent research expedition, was mailed to an academic. It was apparently intercepted in the mail, compromised, and forwarded on.

Re: Researchers crack open malware that hid for 5 years

#30

Post by drzaiusapelord »

pjc50 wrote: post #14
coldcode wrote: post #2

Some at the NSA is having a bad day reading this.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

Well, what do you expect them to do for you? Nationalize and manage your IT infrastructure? They and the DoD publish security guidelines for servers, desktops, etc that any business or government agency can follow. Also do you use SELinux? That's NSA as well.

If you want regulation, that's Congress and POTUS, not the NSA.

Post reply on HN