Researchers crack open malware that hid for 5 years • Hacker News Board

Re: Researchers crack open malware that hid for 5 years

#161

Post by jrowley » Tue, Aug 09, 2016, 10:54 PM UTC

PeCaN wrote: post #156

jrowley wrote: post #111

Earlier quoted context omitted.

So security through obscurity?

Or maybe security through, you know, actual security. Closed source does not mean obscurity–– and open source does not mean clarity (see OpenSSL, that one Linux 2.6 thing¹, etc). It's not like being proprietary suddenly means the only security is through obscurity. Why do you think that? Are you just a zealot? Did you not consider that closed source software could be well-engineered and secure? You're welcome to read…

I wasn't saying it was only secure due to obscurity. I should asked more clearly - "So the idea is to enhance security through obscurity?" For mission critical secure systems, I can see a case being made that software should be closed source, as it allows fewer people to be aware of potential attack vectors. Especially, if you know the software you are creating won't be used externally much or audited.

Re: Researchers crack open malware that hid for 5 years

#162

Post by wepple » Tue, Aug 09, 2016, 10:56 PM UTC

jt2190 wrote: post #37

I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, or is this all still rumors? The reason I ask is because there's actually value in spreading the rumor that a capability like this exists. Imagine if your adversary believed that you could gain access to their computers even when they're not connected to the in…

This is realistic; there are examples you can see.

Have a google around for Stuxnet; a fairly advanced piece of malware which went after Iranian nuclear enrichment centrifuges. It used five previously unreported Microsoft vulnerabilities and a bunch of fairly advanced techniques including jumping airgaps like ProjectSauron does via USB.

There are samples of Stuxnet kicking about, if you want to take a look yourself there's nothing stopping you. Although, you may be there a while.

Re: Researchers crack open malware that hid for 5 years

#163

Post by vardump » Tue, Aug 09, 2016, 10:57 PM UTC

Kadin wrote: post #41

> The researchers went on to speculate that the project was funded by a nation-state, but they stopped short of saying which one. So ... does anyone, perhaps who doesn't have Kaspersky's business interests to protect, care to actually speculate? In other cases it's been seemingly well-known in the security community which APT attacks trace back to which countries, it's just apparently impolite to say it in public.

Remember you got the list from a company lead by ex-KGB, with very close FSB (and Putin) ties. Kaspersky himself studied in a KGB sponsored school. He even met his wife at a KGB holiday resort.

Not suggesting anything, just keep that in mind.

Re: Researchers crack open malware that hid for 5 years

#164

Post by zepolen » Tue, Aug 09, 2016, 10:58 PM UTC

TeMPOraL wrote: post #72

dewyatt wrote: post #57

Earlier quoted context omitted.

Wireless RF keyboard+mouse, external antennas outside of the shielded case?

Can be defeated by a phone charger. http://samy.pl/keysweeper/

This is genius.

Re: Researchers crack open malware that hid for 5 years

#165

Post by wepple » Tue, Aug 09, 2016, 10:59 PM UTC

DavidWanjiru wrote: post #89

What criteria is used to determine that malware could only possibly have been made by a nation state? If all it takes is specialist teams and a budget in the millions of dollars (presumably, had it been 10s or 100s of millions, that's what they'd call it), lot's of private entities can pull that together, can't they?

My gut feel is that governments have a much more significant ability to do things such as: "hey, we're going to do this thing and you're not entitled to ask about it" than private sector.

Re: Researchers crack open malware that hid for 5 years

#166

Post by dr_hooo » Tue, Aug 09, 2016, 11:00 PM UTC

erikpukinskis wrote: post #113

mr_overalls wrote: post #62

Earlier quoted context omitted.

I'm definitely an advocate of open source myself, and I never thought I'd be considering the other side's arguments. It's just that I see major data/security breaches increasing in the news, along with stories (like this one) about cyber-offensive capabilities growing more and more powerful. In the InfoSec world, it seems like anything is hackable, and the balance of power firmly lies with offensive tools. I'm just s…

What do you mean "attack"? Is there some specific harm being done that you want to protect against? Breach of defenses isn't itself an attack. A foreign agent inside your castle isn't an attacker until they start stabbing people, right? I'm not personally worried about what Chinese and Russian hackers know about me, because none of that information is particularly useful for taking valuables from me. I am curious wha…

How do you assume that the information isn't useful? That implies that all your valuables are fully isolated from the digital world - really? I really have trouble understanding the "I have nothing to hide" attitude. What's the difference to saying "there is this guy always standing in the corner of my living room, but I'll just assume he's benign..."

Re: Researchers crack open malware that hid for 5 years

#167

Post by breadtk » Tue, Aug 09, 2016, 11:04 PM UTC

celticninja wrote: post #109

breadtk wrote: post #107

Earlier quoted context omitted.

I believe it's less about fear mongering and more about understanding the level of sophistication of the software. Talk to anti malware analyst and they'll tell you how commoditized the malware game is nowadays. There's an endless stream of malware and ransomware which can be linked back to just a handful of frameworks. These types of malware families also fall under the spray-n-pray mentality for distribution. Spam,…

Essentially depending on what malware does we can easily identify government software because criminal software has a different set of objectives. Is it possible though that corporate software could have similar objectives? I'm thinking corporate espionage type behaviour.

> Is it possible though that corporate software could have similar objectives? I'm thinking corporate espionage type behaviour.

Yes, it is possible.

Re: Researchers crack open malware that hid for 5 years

#168

Post by breadtk » Tue, Aug 09, 2016, 11:07 PM UTC

jandrese wrote: post #87

zellyn wrote: post #4

Earlier quoted context omitted.

The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?

Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work. If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below t…

There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/

Re: Researchers crack open malware that hid for 5 years

#169

Post by infinite8s » Tue, Aug 09, 2016, 11:29 PM UTC

WalterBright wrote: post #148

rdtsc wrote: post #40

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…

Just put the software in the device in ROM, a forgotten technology. No malware will survive a power cycle. It's like I read that malware could infect your "internet of things" thermostat and then hackers could remotely turn off your heat until you pay ransom. Just put the dang thermostat code in ROM. Power cycle, goodbye malware. For more critical stuff, just have it regularly power cycle itself.

Then you can't do over the wire updates, which means no fixes after it's been manufactured and installed, which would probably increase the costs quite a bit.

Re: Researchers crack open malware that hid for 5 years

#170

Post by emmelaich » Tue, Aug 09, 2016, 11:32 PM UTC

rdtsc wrote: post #138

drzaiusapelord wrote: post #133

Earlier quoted context omitted.

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot. That said, I could see glueing a panel to block them as a vi…

> You can chip that off easily with your finger or a key. Because it was more of a reminder for stupidity. "Oh, look there is glue in there, that's right we not supposed to stick random USB devices in there". If the machine is on their desk, yes, they could plug in a PCI device that has an USB thing on it and still connect. But by that point they are really going out of their way, they are opening the case and such,…

Exactly. The other related threat is the new junior admin being asked by a senior exec to allow (windows policy-wise) the USB storage just temporarily. "Because I need this presentation NOW as I have to get to the airport in 45 minutes!