Researchers crack open malware that hid for 5 years • Hacker News Board

Re: Researchers crack open malware that hid for 5 years

#141

Post by jonathankoren » Tue, Aug 09, 2016, 9:37 PM UTC

Spooky23 wrote: post #47

pjc50 wrote: post #14

Earlier quoted context omitted.

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

That's a false statement. They work with NIST to develop the standards that are the basis of the infosed industry.

The problem with NIST (and I believe they admitted this is a problem) is that NIST is required by law to use the relevant experts from government agencies[0], which normally is fine, and exactly what you want. However, the agency when it comes to security is NSA, and their in the business of undermining it. Thus the whole ECC backdoor debacle.[1]

NIST seems like a good agency trying to do the right things. It's just that they're forced to work with bad actors.

[0] https://www.accessnow.org/its-not-you-its-me-committee-of-cr...

[1] http://www.nist.gov/itl/csd/sp800-90-042114.cfm

Re: Researchers crack open malware that hid for 5 years

#142

Post by Zigurd » Tue, Aug 09, 2016, 9:42 PM UTC

EthanHeilman wrote: post #10

Zigurd wrote: post #6

Some security professionals have expressed the view that insecure endpoints represent a good compromise. That is, without the US government being able to snoop on endpoint devices, encryption would have to be tightly controlled, so that the government could retain intelligence and investigatory capability. A more cynical view would be that many security firms sell both security and forensics/surveillance. One of thos…

I've often heard not that "insecure endpoints represent a good compromise" but instead that since: 1. endpoints are vulnerable because they are exceptionally hard to secure, 2. and attacking endpoints can be targeted and specific, the governments case that weakening encryption is necessary for warranted search is weak. Even with strong encryption the government can exploit the targeted communicant's endpoint to learn…

You get what you pay for. Right now, endpoint systems are undefended, even intentionally compromised. The design of endpoint systems assumes all components can be trusted. But those components don't usually undergo testing for vulnerabilities and hidden capabilities.

Re: Researchers crack open malware that hid for 5 years

#143

Post by jonathankoren » Tue, Aug 09, 2016, 9:43 PM UTC

coldcode wrote: post #2

Some at the NSA is having a bad day reading this.

Or they're saying, "Oh? That old thing?"

We honestly don't know. It might not even be the NSA.

Re: Researchers crack open malware that hid for 5 years

#144

Post by devnull42 » Tue, Aug 09, 2016, 9:43 PM UTC

eugenekolo2 wrote: post #131

devnull42 wrote: post #76

Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting.

> Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting. > Kaspersky researchers still aren't sure precisely how the USB-enabled exfiltration works. The presence of the invisible storage area doesn't in itself allow attackers to seize control of air-gapped computers. The researchers suspect the capability is used only in rare ca…

>The attackers used multiple interesting and unusual techniques, including:

> Data exfiltration and real-time status reporting using DNS requests.

Sorry to be more specific we spoke on DNS Base Exfil using base64 encoded strings in DNS Lookups and also how to use DNS records to control botnets.

So not exact and only part of their method.

Re: Researchers crack open malware that hid for 5 years

#145

Post by devnull42 » Tue, Aug 09, 2016, 9:47 PM UTC

j_s wrote: post #112

devnull42 wrote: post #76

Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting.

Is there any part of your talk available online?

This is pretty much the only part. The code from the live demo. I will try and find a place to get the slides up in the next few days if there is any interest:

https://github.com/coryschwartz/dns_exfiltration

Re: Researchers crack open malware that hid for 5 years

#146

Post by ayyn0n0n0 » Tue, Aug 09, 2016, 9:50 PM UTC

Anyone know what IPs the C&C servers used?

Interested to see what hosting company in the US they used.

Re: Researchers crack open malware that hid for 5 years

#147

Post by ms013 » Tue, Aug 09, 2016, 9:52 PM UTC

drzaiusapelord wrote: post #133

rdtsc wrote: post #127

Earlier quoted context omitted.

> This seems apocryphal. I have no reason to believe the person I worked with would make it up. There would just be no point in it. > Its trivial to disable USB for a mass storage (or all devices) Except there are hundreds of different kinds of devices, and you tasked with quickly "doing something to fix the problem". Do you have time to go and dig through different types of BIOS menus or open the cases to all of the…

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot. That said, I could see glueing a panel to block them as a vi…

They epoxied the USB ports on my secure machine when I worked at one of the national labs about 12 years ago. One day I came in and the admin had gone through everyone's office the evening before with a bunch of JB weld to fill the USB ports.

So, whether or not you believe that it is a useful solution, it certainly did happen. As for alternatives to gluing, I assume that was time related: filling in a port is certainly faster than opening thousands of machines to give them a physical port-ectomy.

Re: Researchers crack open malware that hid for 5 years

#148

Post by WalterBright » Tue, Aug 09, 2016, 9:53 PM UTC

rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

Just put the software in the device in ROM, a forgotten technology. No malware will survive a power cycle.

It's like I read that malware could infect your "internet of things" thermostat and then hackers could remotely turn off your heat until you pay ransom. Just put the dang thermostat code in ROM. Power cycle, goodbye malware.

For more critical stuff, just have it regularly power cycle itself.

Re: Researchers crack open malware that hid for 5 years

#149

Post by WalterBright » Tue, Aug 09, 2016, 9:57 PM UTC

treebeard901 wrote: post #118

Florin_Andrei wrote: post #101

Earlier quoted context omitted.

> This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. The question is - where do you stop? The controller could be re-enabled from a lower level, etc. The rabbit hole goes very deep. Sometimes it's best to just take control of the physical layer and call it a day. > Those USB ports aren't perfect boxe…

> Sometimes it's best to just take control of the physical layer and call it a day. If you want to stop your every day user from plugging in USB drives then this is probably all you need to do. In a scenario where you're concerned about insider threats with even a minimal level of computing knowledge, you have to lock down the BIOS and the OS layer as well. "Oh the IT guy put epoxy in the USB ports, guess I'll just t…

For a hardened PC, the first thing I'd do is burn the BIOS into ROM. Read Only Memory. ROM cannot be infected.

Re: Researchers crack open malware that hid for 5 years

#150

Post by olympus » Tue, Aug 09, 2016, 10:10 PM UTC

rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

Part of the reason that Windows is an approved OS is enterprise support. When you pay for hundreds of thousands of licenses for a product you can demand features. If the DoD went with Debian they would need an entire corps of developers to maintain government specific patches. Ubuntu offers enterprise support but it's from an African country and that is undesirable as you mentioned above.

I've seen government systems running Windows (USA), Mac (USA) but the strangest I've seen is SUSELinux (Germany). I have no idea how they got SUSE approved when Red Hat is more "American" but some agencies don't have to follow the rules.