Researchers crack open malware that hid for 5 years • Hacker News Board

Re: Researchers crack open malware that hid for 5 years

#31

Post by peterwwillis » Tue, Aug 09, 2016, 2:48 PM UTC

drzaiusapelord wrote: post #26

skybrian wrote: post #22

Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.

Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.

Not supposedly. Every pen testing company worth their salt uses dropped USB drives and have a very high success rate, because humans suck at security. The malware infects non-gapped systems until it infects a file which is being copied to a gapped system.

Re: Researchers crack open malware that hid for 5 years

#32

Post by acdha » Tue, Aug 09, 2016, 2:52 PM UTC

pjc50 wrote: post #13

frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

> a serious airgap protocol has to ban USB ports.

This is slightly too strong – it should be “has to ban unsecured USB ports”. By 2002 or so, people I met who worked at SPAWAR were advising conference attendees to follow their standard practice of epoxying necessary USB devices to the computer and completely filling unused ports. That moved USB into the same difficulty class as other physical access attacks, which they were already depending on building security to restrict.

Also note that while it's true that Firewire and Thunderbolt are definitely still riskier, newer versions of Windows, OS X, and Linux can use the IO-MMU to prevent DMA attacks. That started shipping in OS X 10.7 and Windows 8.1 (only when locked) and OS X 10.8 enables that all of the time for hardware made around 2012 and later.

Re: Researchers crack open malware that hid for 5 years

#33

Post by mr_overalls » Tue, Aug 09, 2016, 3:00 PM UTC

Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too.

But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.

Re: Researchers crack open malware that hid for 5 years

#34

Post by peterwwillis » Tue, Aug 09, 2016, 3:01 PM UTC

pjc50 wrote: post #13

frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

You would also need proper shielding to prevent van Eck phreaking from PS/2, monitor, video card, sound card, internal memory bus, and other rf noise.

Re: Researchers crack open malware that hid for 5 years

#35

Post by acdha » Tue, Aug 09, 2016, 3:01 PM UTC

redcalx wrote: post #24

TheCapn wrote: post #21

Earlier quoted context omitted.

Personally? PC gets locked in a box with some sort of venting. Keyboard / Mouse are plugged in by IT and no one unauthorized has physical access to the PC itself. If they're serious enough about finding 0 days and exploits to the USB or OS to load this shit any physical access to the box itself is off limits.

Cut USB cable; splice new device into cable. Or, open mouse/keyboard case, wire device into USB bus connections.

This is why you need defense in depth: physical seals on components, either protecting cables or keeping them clearly visible where someone can notice tampering, and – above all – having the physical space setup to strictly limit someone's ability to bring arbitrary objects in or spend time alone with sensitive hardware.

Consider what someone with the time, skill, and access to do that could also do without that: opening the case and directly installing some sort of device, planting a camera which records you typing passwords in (“oops, left my cellphone sitting out. Won't happen again!”), planting a radio receiver which opens up all sorts of side channel attacks, installing a passive network tap, etc.

A guard with a metal detector and strict limits on what you can bring into the building or what tools you can use inside is going to do a better job preventing all of those.

Re: Researchers crack open malware that hid for 5 years

#36

Post by peterwwillis » Tue, Aug 09, 2016, 3:04 PM UTC

pjc50 wrote: post #14

coldcode wrote: post #2

Some at the NSA is having a bad day reading this.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

You have to research and implement new attacks to design its defense.

Re: Researchers crack open malware that hid for 5 years

#37

Post by jt2190 » Tue, Aug 09, 2016, 3:07 PM UTC

I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, or is this all still rumors?

The reason I ask is because there's actually value in spreading the rumor that a capability like this exists. Imagine if your adversary believed that you could gain access to their computers even when they're not connected to the internet. They'd run themselves in circles trying to secure everything!

In general, I believe this article to be true, but would love to learn more of the details.

Re: Researchers crack open malware that hid for 5 years

#38

Post by Kadin » Tue, Aug 09, 2016, 3:08 PM UTC

pjc50 wrote: post #14

coldcode wrote: post #2

Some at the NSA is having a bad day reading this.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

Not sure why that seems so bizarre; that's consistent with US posture since WWII, particularly strategic posture. Defense through force projection and construction of retaliatory capability. "The best defense is a good offense" is almost an underlying assumption of US doctrine. You don't defend yourself by building walls, you defend yourself by removing your adversaries' capabilities or willingness to use those capabilities.

It doesn't seem as though this has been especially effective with regards to information security, however. There are just too many adversaries, it's too hard to project force against them, and there's not much of an effective deterrent effect by sitting on a 'stockpile' of vulnerabilities yourself.

But IMO the disconnect is almost a fundamental one, because it's an area where what has worked fairly well for the US for 60+ years is suddenly falling flat.

Re: Researchers crack open malware that hid for 5 years

#39

Post by peterwwillis » Tue, Aug 09, 2016, 3:12 PM UTC

amelius wrote: post #9

jobu wrote: post #5

Earlier quoted context omitted.

And they had every login for the network it was found on: "The library was masquerading as a Windows password filter, which is something administrators typically use to ensure passwords match specific requirements for length and complexity. The module started every time a network or local user logged in or changed a password, and it was able to view passcodes in plaintext."

Perhaps time to move to 2FA.

This was a network authentication module on a domain controller. It's intercepting every low level token used to authenticate a network transaction, including encryption keys.

Re: Researchers crack open malware that hid for 5 years

#40

Post by rdtsc » Tue, Aug 09, 2016, 3:14 PM UTC

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess.

There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of those devices come with a 100x markup. $400 device from China vs $40k from US. Those who sell the $40k know how hard it is get on the list they are milking it for all its worth (the sales person was quite frank about it).

It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected (with only ancient version of RHEL's approved for Linux).