Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack open malware that hid for 5 years

arstechnica.com

Post reply on HN
Print view View original

61–70 of 232 posts

Re: Researchers crack open malware that hid for 5 years

#61

Post by drvdevd »

chrisper wrote: post #43
pjc50 wrote: post #13

Earlier quoted context omitted.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I wonder if this is a solution to this problem or not since it seems quite naive.

Just speculating: this might mitigate some kernel level exploits but since its typically usb card usb bus/controller PCI bus, presumably hardware or kernel bugs elswhere in that stack could still be exploited. Interesting thought!

Re: Researchers crack open malware that hid for 5 years

#62

Post by mr_overalls »

taylorwc wrote: post #45
mr_overalls wrote: post #33

Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too. But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.

I suspect your comment will be met harshly here, but I agree for at least a subset of users. If you regularly read HN, you probably can see the clear downsides of the so-called 'walled garden' approach. I can too. Then I have a 10-minute conversation trying to help my mother-in-law with whatever Best-buy recommended cheap PC she purchased 2 years ago, and I am convinced that she needs the walled garden.

I'm definitely an advocate of open source myself, and I never thought I'd be considering the other side's arguments. It's just that I see major data/security breaches increasing in the news, along with stories (like this one) about cyber-offensive capabilities growing more and more powerful. In the InfoSec world, it seems like anything is hackable, and the balance of power firmly lies with offensive tools. I'm just scratching my head about what the appropriate defensive strategies are going to be, given that Chinese and Russian state-sponsored hackers are known to attack civilian targets. I'm not sure how we're supposed to secure our government, financial, and tech companies against these players.

For all of their known (and probable) capabilities, our three-letter agencies don't seem too concerned about encouraging defensive technologies and securing domestic networks.

Re: Researchers crack open malware that hid for 5 years

#64

Post by nyan4 »

mr_overalls wrote: post #33

Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too. But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.

How about a FLOSS archive that provides peer-reviewed and signed application from a trusted source only? Automated security updates? A security team that can provide fixes independently from the upstream authors?

...because I just described how Debian worked for the last 20 years.

Re: Researchers crack open malware that hid for 5 years

#65

Post by lawnchair_larry »

jt2190 wrote: post #37

I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, or is this all still rumors? The reason I ask is because there's actually value in spreading the rumor that a capability like this exists. Imagine if your adversary believed that you could gain access to their computers even when they're not connected to the in…

It is real, and many similar samples exist. People in the industry can usually ask around and get copies.

Re: Researchers crack open malware that hid for 5 years

#66

Post by lawnchair_larry »

Spooky23 wrote: post #47
pjc50 wrote: post #14

Earlier quoted context omitted.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

That's a false statement. They work with NIST to develop the standards that are the basis of the infosed industry.

For the most part, NIST really has no relevance in infosec. With a few exceptions, they're always way behind, and only focus on a few narrow domains.

Re: Researchers crack open malware that hid for 5 years

#67

Post by ultramancool »

frank_jaeger wrote: post #3

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

This seems trivial to me. Heck, you could practically make it full out remote exec and grab output from airgapped machines if USB keys were moved between them frequently enough. Serialize and encrypt tiny blob with command, do the same for the output and dump it back on the same USB drive or the next one plugged in, send the data out the next time it's on an internet connected machine... I don't see any challenge or skill involved here. Good post-exploitation malware is often more about doing simple things right than about doing impressive things though I suppose. Having the exploit that allows this attack to happen is the impressive part.

Re: Researchers crack open malware that hid for 5 years

#68

Post by LeoPanthera »

nyan4 wrote: post #63

> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected Bribes always help.

It's easy to see conspiracy everywhere, but the truth is usually much more mundane. It costs a lot of money to security-certify an OS, so they probably only wanted to certify a small number. Windows is obviously the most-used desktop OS for PCs, so that seems the logical choice.

Re: Researchers crack open malware that hid for 5 years

#69

Post by montecarl »

drzaiusapelord wrote: post #26
skybrian wrote: post #22

Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.

Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.

The DoD Cybersecurity Awareness training[1] covers this and a number of other physical attacks. I'm not sure how serious anyone takes it though.

[1] http://cdsetrain.dtic.mil/cybersecurity/

Re: Researchers crack open malware that hid for 5 years

#70

Post by jpollock »

nyan4 wrote: post #63

> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected Bribes always help.

Paying for certification is what's required. Governments require various certifications to sell to them, and that certification costs money in consultancies. RHEL paid for the testing, they get a certification and access to the customer.

It looks like this is probably referring to EAL [1][2].

In a market with a large number of vendors interacting with a large number of relatively unknowledgeable buyers, an oversight team is going to try to find a certification to give guidance (and ass covering).

Yes, this is a barrier to entry, but it's also a learned behaviour as buyers get repeatedly burned.

I would argue that this is equivalent to requiring your plumbers and electricians to be licensed.

[1] https://en.wikipedia.org/wiki/Evaluation_Assurance_Level [2] https://www.redhat.com/en/about/press-releases/red-hat-achie...

Post reply on HN