Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack open malware that hid for 5 years

arstechnica.com

Post reply on HN
Print view View original

121–130 of 232 posts

Re: Researchers crack open malware that hid for 5 years

#121

Post by AWildDHHAppears »

rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

And that's why you can still buy new i7 and Xeon motherboards with PS2 keyboard connectors--because some sites don't want there to be USB ports on the computers.

Re: Researchers crack open malware that hid for 5 years

#122

Post by Florin_Andrei »

treebeard901 wrote: post #118
Florin_Andrei wrote: post #101

Earlier quoted context omitted.

> This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. The question is - where do you stop? The controller could be re-enabled from a lower level, etc. The rabbit hole goes very deep. Sometimes it's best to just take control of the physical layer and call it a day. > Those USB ports aren't perfect boxe…

> Sometimes it's best to just take control of the physical layer and call it a day. If you want to stop your every day user from plugging in USB drives then this is probably all you need to do. In a scenario where you're concerned about insider threats with even a minimal level of computing knowledge, you have to lock down the BIOS and the OS layer as well. "Oh the IT guy put epoxy in the USB ports, guess I'll just t…

Well, of course this doesn't give you a get out of jail free card. You still have to pay attention to the other layers in the stack. This is only about paying attention (or not) to the physical layer directly (as opposed to handling physical security indirectly in higher layers).

Re: Researchers crack open malware that hid for 5 years

#123

Post by bradford »

DavidWanjiru wrote: post #89

What criteria is used to determine that malware could only possibly have been made by a nation state? If all it takes is specialist teams and a budget in the millions of dollars (presumably, had it been 10s or 100s of millions, that's what they'd call it), lot's of private entities can pull that together, can't they?

They probably could, but would they?

At least in the US, publicly traded tech companies are accountable to shareholders: There's some transparency in the accounting, and it's hard for them to throw millions of dollars at a problem before shareholders start asking tough questions.

Re: Researchers crack open malware that hid for 5 years

#124

Post by 794CD01 »

jjbiotech wrote: post #108
Endy wrote: post #106

Earlier quoted context omitted.

Too many people without security clearance can access and modify Linux. In any real security environment, open-source is poison. Period, end of story.

^ As if any amount of security clearance can erase human fallibility. In any real security environment, humans are poison. Period, end of story. This is not an issue exclusive to open-source.

Of course not, but it's exacerbated by open source. Humans are indeed poison, which is why it's normal to involve as few humans as possible. Unfortunately AI is not sufficiently advanced so you still need some of them in order to get the job done.

Re: Researchers crack open malware that hid for 5 years

#127

Post by rdtsc »

drzaiusapelord wrote: post #97
rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

>filling USB ports with epoxy This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. Those USB ports aren't perfect boxes, the epoxy would just run out all over the place. More than likely you'd have an OS-level security policy and bios block, which is trivial to do in a managed environment. I hear this…

> This seems apocryphal.

I have no reason to believe the person I worked with would make it up. There would just be no point in it.

> Its trivial to disable USB for a mass storage (or all devices)

Except there are hundreds of different kinds of devices, and you tasked with quickly "doing something to fix the problem". Do you have time to go and dig through different types of BIOS menus or open the cases to all of the machines. Or is it easier to get epoxy plungers and send an army of people from desk to desk. Normal epoxy is a pretty decent electrical insulator (some board or components used to even be dipped in epoxy to protect from environmental damage or tempering).

> I suspect you've never managed a non-trivial network before,

No, but I was selling a solution with one in it. And $40k was making a decent size cut in the profit margin.

Re: Researchers crack open malware that hid for 5 years

#128

Post by DavidWanjiru »

bradford wrote: post #123
DavidWanjiru wrote: post #89

What criteria is used to determine that malware could only possibly have been made by a nation state? If all it takes is specialist teams and a budget in the millions of dollars (presumably, had it been 10s or 100s of millions, that's what they'd call it), lot's of private entities can pull that together, can't they?

They probably could, but would they? At least in the US, publicly traded tech companies are accountable to shareholders: There's some transparency in the accounting, and it's hard for them to throw millions of dollars at a problem before shareholders start asking tough questions.

But a military contractor type of company has lots of obfuscation leeway with "top secret" type of things, doesn't it? And I'd imagine a defence contractor is the type of company that would be interested in the kind of info this kind of malware can gather.

Re: Researchers crack open malware that hid for 5 years

#129

Post by mjevans »

peterwwillis wrote: post #39
amelius wrote: post #9

Earlier quoted context omitted.

Perhaps time to move to 2FA.

This was a network authentication module on a domain controller. It's intercepting every low level token used to authenticate a network transaction, including encryption keys.

If security has been penetrated that far you are already owned.

What really scares me are things that can live in firmware; not just on mass storage drives but also in host system firmware. We've let too many dragons breed in dark places in the name of Digital Restrictions Management.

Re: Researchers crack open malware that hid for 5 years

#130

Post by 13of40 »

dghughes wrote: post #59
rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

>I remember hearing there were going around filling USB ports with epoxy. And we all laughed at PS/2 keyboards and mouseeses

You can boot an original IBM PC off the keyboard port. Look for the MFG_BOOT function here:

https://www.iee.et.tu-dresden.de/~kc-club/DOWNLOAD/DISK401/R...

Basically, the device connected to the keyboard port has to reply with code 0x65 when it's initialized, then the BIOS will read some bytes into memory and jump to it. Not sure whether this was brought forward to newer models or clones, though so it's just some fun trivia...

Post reply on HN