Bau$$
Researchers crack open malware that hid for 5 years
91–100 of 232 posts
Re: Researchers crack open malware that hid for 5 years
#92That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.
If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…
There's usually going to be some interface between the two worlds, right? You just want it to be highly controlled.
What's left? Optical media? Or are we seriously reduced to a human with two computers reading from one and typing into the other?
Re: Researchers crack open malware that hid for 5 years
#93Earlier quoted context omitted.
If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…
If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I wonder if this is a solution to this problem or not since it seems quite naive.
Any USB device gets to be a keyboard and mouse. If it comes down to it, the device could just "type" its payload.
Re: Researchers crack open malware that hid for 5 years
#94What criteria is used to determine that malware could only possibly have been made by a nation state? If all it takes is specialist teams and a budget in the millions of dollars (presumably, had it been 10s or 100s of millions, that's what they'd call it), lot's of private entities can pull that together, can't they?
They simply pretend that all skilled attackers are state actors.
Due to how the industry works, they're usually correct.
Re: Researchers crack open malware that hid for 5 years
#95Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.
Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.
> the DC's weren't patched
As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
Re: Researchers crack open malware that hid for 5 years
#96Earlier quoted context omitted.
Depends on having a camera pointed that the compromised keyboard, and cameras are the first things banned when setting up a secure environment.
I meant, using a physically compromised keyboard that records LED transitions set by the host, since the context was USB devices that look like normal keyboard or mice but actually contain storage.
The only problem with that is people don't typically carry keyboards around and plug them into different devices.
Re: Researchers crack open malware that hid for 5 years
#97Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…
>filling USB ports with epoxy
This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. Those USB ports aren't perfect boxes, the epoxy would just run out all over the place. More than likely you'd have an OS-level security policy and bios block, which is trivial to do in a managed environment.
I hear this type of story from time to time and frankly its the sysadmin version of "he hacked us with a visual basic gui!"
>$400 device from China vs $40k from US.
I'd rather trust my network with a warrantied Cisco with same-day replacement than a $400 Abibaba sourced ROUTER PLUS SHENZEN SPECIAL with two weeks delivery. I suspect you've never managed a non-trivial network before, let alone one with real security policy if you'd consider running that and thinking you're secure.
Re: Researchers crack open malware that hid for 5 years
#98Earlier quoted context omitted.
If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…
There's usually going to be some interface between the two worlds, right? You just want it to be highly controlled. What's left? Optical media? Or are we seriously reduced to a human with two computers reading from one and typing into the other?
Zip disks?
Re: Researchers crack open malware that hid for 5 years
#99Earlier quoted context omitted.
Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.
> the DC's weren't patched As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
Its trivial to do with WSUS and off-line updates. But yeah, if its a shit run environment, it will get owned by someone eventually.
Re: Researchers crack open malware that hid for 5 years
#100Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too. But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.
> By analogy, there's a reason that many ancient cities were circled by a wall. Walls around cities were likely very poor at stopping small, stealthy groups of infiltrators. They were designed for much more brute force attacks. Apple's walled garden helps quite a bit with the deluge of crap that would be available without it. Without it there would be an order of magnitude more crap (in quantity and quality). That sa…
The problem with Windows is that it is just a wall made of glass