Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack open malware that hid for 5 years

arstechnica.com

Post reply on HN
Print view View original

131–140 of 232 posts

Re: Researchers crack open malware that hid for 5 years

#131

Post by eugenekolo2 »

devnull42 wrote: post #76

Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting.

> Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting.

> Kaspersky researchers still aren't sure precisely how the USB-enabled exfiltration works. The presence of the invisible storage area doesn't in itself allow attackers to seize control of air-gapped computers. The researchers suspect the capability is used only in rare cases and requires use of a zero-day exploit that has yet to be discovered. In all, Project Sauron is made up of at least 50 modules that can be mixed and matched to suit the objectives of each individual infection.

You remarkably have the exact exfil method when that's not disclosed information?

Re: Researchers crack open malware that hid for 5 years

#132

Post by pjmorris »

Endy wrote: post #106
rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

Too many people without security clearance can access and modify Linux. In any real security environment, open-source is poison. Period, end of story.

So you trust the black boxes someone sold you?

Re: Researchers crack open malware that hid for 5 years

#133

Post by drzaiusapelord »

rdtsc wrote: post #127
drzaiusapelord wrote: post #97

Earlier quoted context omitted.

>filling USB ports with epoxy This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. Those USB ports aren't perfect boxes, the epoxy would just run out all over the place. More than likely you'd have an OS-level security policy and bios block, which is trivial to do in a managed environment. I hear this…

> This seems apocryphal. I have no reason to believe the person I worked with would make it up. There would just be no point in it. > Its trivial to disable USB for a mass storage (or all devices) Except there are hundreds of different kinds of devices, and you tasked with quickly "doing something to fix the problem". Do you have time to go and dig through different types of BIOS menus or open the cases to all of the…

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot.

That said, I could see glueing a panel to block them as a visual to remind people that those ports are off, but not as a primary blocking device. More than likely its done via security policy.

Re: Researchers crack open malware that hid for 5 years

#134

Post by robocat »

chrisper wrote: post #43
pjc50 wrote: post #13

Earlier quoted context omitted.

If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…

If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I wonder if this is a solution to this problem or not since it seems quite naive.

The BIOS may access USB devices e.g. during boot or config.

Re: Researchers crack open malware that hid for 5 years

#135

Post by jstalin »

Endy wrote: post #106
rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

Too many people without security clearance can access and modify Linux. In any real security environment, open-source is poison. Period, end of story.

Well, end of story. That's it then. No more discussion can be had!

Re: Researchers crack open malware that hid for 5 years

#136

Post by linkregister »

Endy wrote: post #106
rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

Too many people without security clearance can access and modify Linux. In any real security environment, open-source is poison. Period, end of story.

This is a falsehood. One of many sources: https://news.ycombinator.com/item?id=7203211 (HN discussion of Snowden using wget to scrape NSA internal sites)

Re: Researchers crack open malware that hid for 5 years

#137

Post by drzaiusapelord »

Florin_Andrei wrote: post #101
drzaiusapelord wrote: post #97

Earlier quoted context omitted.

>filling USB ports with epoxy This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. Those USB ports aren't perfect boxes, the epoxy would just run out all over the place. More than likely you'd have an OS-level security policy and bios block, which is trivial to do in a managed environment. I hear this…

> This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. The question is - where do you stop? The controller could be re-enabled from a lower level, etc. The rabbit hole goes very deep. Sometimes it's best to just take control of the physical layer and call it a day. > Those USB ports aren't perfect boxe…

> The controller could be re-enabled from a lower level, etc

In a managed environment you could do it via the BIOS trivially, which is most likely locked as well. I mean, glueing the ports is especially stupid. You can chip glue off with your fingers or a key. If you're doing physical things to the PC, you'd most likely just remove the USB header from the mb and call it a day. Pop-open the case the case, remove it, bend down the pins, or cut it and go about your business. Messing with stuff that takes 60 minutes to cure is ridiculous. Ignoring the OS security policy is ridiculous. Ignoring BIOS controls is ridiculous. Ignoring how security is handled in managed environments is ridiculous.

It would take two minutes for a stoned teenager to pop-open the case and plug in his own USB connector into the header in this scenario. Less time for a determined attacker.

I imagine some middle-manager asshole asked for a piece of plastic to block the panel to make it 'look nice and remind people they're blocked' and some paper-pusher took it as "OMG THEY GLUED THE PORTS TO STOP HACKERS" He was just ignorant of how IT security is really done.

I think its obvious HN is mostly web-devs, not sysadmins or security people if stuff like this is widely believed and comments contrary to it get instant 'disagree downvotes.' If you think the NSA and the DoD just glue ports instead of doing real security, then I don't know what to say here.

Re: Researchers crack open malware that hid for 5 years

#138

Post by rdtsc »

drzaiusapelord wrote: post #133
rdtsc wrote: post #127

Earlier quoted context omitted.

> This seems apocryphal. I have no reason to believe the person I worked with would make it up. There would just be no point in it. > Its trivial to disable USB for a mass storage (or all devices) Except there are hundreds of different kinds of devices, and you tasked with quickly "doing something to fix the problem". Do you have time to go and dig through different types of BIOS menus or open the cases to all of the…

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot. That said, I could see glueing a panel to block them as a vi…

> You can chip that off easily with your finger or a key.

Because it was more of a reminder for stupidity. "Oh, look there is glue in there, that's right we not supposed to stick random USB devices in there". If the machine is on their desk, yes, they could plug in a PCI device that has an USB thing on it and still connect. But by that point they are really going out of their way, they are opening the case and such, and it will be very hard to maintain the idea that it was just a stupid mistake.

Re: Researchers crack open malware that hid for 5 years

#139

Post by SCHiM »

DavidWanjiru wrote: post #128
bradford wrote: post #123

Earlier quoted context omitted.

They probably could, but would they? At least in the US, publicly traded tech companies are accountable to shareholders: There's some transparency in the accounting, and it's hard for them to throw millions of dollars at a problem before shareholders start asking tough questions.

But a military contractor type of company has lots of obfuscation leeway with "top secret" type of things, doesn't it? And I'd imagine a defence contractor is the type of company that would be interested in the kind of info this kind of malware can gather.

There is some evidence that CITIC Group, a Chinese company, is heavily involved in corporate espionage and the manipulation of foreign nations. There's no particular reason that other large companies, no matter their home countries, could not also be engaged in these types of activities.

Re: Researchers crack open malware that hid for 5 years

#140

Post by jonathankoren »

treebeard901 wrote: post #118
Florin_Andrei wrote: post #101

Earlier quoted context omitted.

> This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. The question is - where do you stop? The controller could be re-enabled from a lower level, etc. The rabbit hole goes very deep. Sometimes it's best to just take control of the physical layer and call it a day. > Those USB ports aren't perfect boxe…

> Sometimes it's best to just take control of the physical layer and call it a day. If you want to stop your every day user from plugging in USB drives then this is probably all you need to do. In a scenario where you're concerned about insider threats with even a minimal level of computing knowledge, you have to lock down the BIOS and the OS layer as well. "Oh the IT guy put epoxy in the USB ports, guess I'll just t…

You can also cut the traces or epoxy the internally ports as well. It's not hard. It's just about what level of threat do you want live with. I imagine you could always defeat this by cutting through the epoxy or gently sanding the board to put probes directly on the traces, but then again security is all about depth.

I have a friend that worked at LLNL and she used to talk about secured laptops having their USB ports epoxied and the traces physically cut on the camera and microphones to help secure them. I think even the wifi and bluetooth were disabled as well.

After hearing these stories, it made me chuckle at Zuckerberg's masking tape.

Post reply on HN