Bau$$
Please don't comment like this here.
Researchers crack open malware that hid for 5 years
171–180 of 232 posts
Re: Researchers crack open malware that hid for 5 years
#172Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…
Part of the reason that Windows is an approved OS is enterprise support. When you pay for hundreds of thousands of licenses for a product you can demand features. If the DoD went with Debian they would need an entire corps of developers to maintain government specific patches. Ubuntu offers enterprise support but it's from an African country and that is undesirable as you mentioned above. I've seen government systems…
It's well known that all of Germany's media, intelligence services, and politics was set up by the US after the war.
From what is seen on the geopolitical landscape, Germany is a vassal state of the US.
Re: Researchers crack open malware that hid for 5 years
#173Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…
Just put the software in the device in ROM, a forgotten technology. No malware will survive a power cycle. It's like I read that malware could infect your "internet of things" thermostat and then hackers could remotely turn off your heat until you pay ransom. Just put the dang thermostat code in ROM. Power cycle, goodbye malware. For more critical stuff, just have it regularly power cycle itself.
If you haven't seen it yet, you may like the stateless laptop idea: http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...
Re: Researchers crack open malware that hid for 5 years
#174Earlier quoted context omitted.
> Sometimes it's best to just take control of the physical layer and call it a day. If you want to stop your every day user from plugging in USB drives then this is probably all you need to do. In a scenario where you're concerned about insider threats with even a minimal level of computing knowledge, you have to lock down the BIOS and the OS layer as well. "Oh the IT guy put epoxy in the USB ports, guess I'll just t…
Case intrusion sensors are a thing. And i swear i have seen cases with loops for padlocks.
Padlocked cases are common on school computers.
Re: Researchers crack open malware that hid for 5 years
#175Earlier quoted context omitted.
Just put the software in the device in ROM, a forgotten technology. No malware will survive a power cycle. It's like I read that malware could infect your "internet of things" thermostat and then hackers could remotely turn off your heat until you pay ransom. Just put the dang thermostat code in ROM. Power cycle, goodbye malware. For more critical stuff, just have it regularly power cycle itself.
Then you can't do over the wire updates, which means no fixes after it's been manufactured and installed, which would probably increase the costs quite a bit.
This is literally how everything was made until the very recent past. Next you'll be telling me that you can ship software on physical media.
Re: Researchers crack open malware that hid for 5 years
#176Earlier quoted context omitted.
> This seems apocryphal. Its trivial to disable USB for a mass storage (or all devices) via things like group policy or other security controls. Or disable the controller. The question is - where do you stop? The controller could be re-enabled from a lower level, etc. The rabbit hole goes very deep. Sometimes it's best to just take control of the physical layer and call it a day. > Those USB ports aren't perfect boxe…
There's also value in being able to visually inspect it and say "Yep, that USB port's disabled" versus digging through EFI settings. Every motherboard is going to have that option in a slightly different place, but if you can put epoxy in one USB port you're pretty well set for any piece of hardware.
This scales to ${number_of_devices_you_can_see}. A hundred or more? Easier to manage remotely. You're also likely to have a very limited number of models in that case.
Re: Researchers crack open malware that hid for 5 years
#177Earlier quoted context omitted.
Just put the software in the device in ROM, a forgotten technology. No malware will survive a power cycle. It's like I read that malware could infect your "internet of things" thermostat and then hackers could remotely turn off your heat until you pay ransom. Just put the dang thermostat code in ROM. Power cycle, goodbye malware. For more critical stuff, just have it regularly power cycle itself.
Then you can't do over the wire updates, which means no fixes after it's been manufactured and installed, which would probably increase the costs quite a bit.
> Then you can't do over the wire updates,
Which, of course, is the whole point. If ROMs do cost more, I bet people who want secure systems would be quite willing to pay a bit extra.
It would be too expensive to put an OS in ROM, but the ROMs could contain the hashes of the OS on disk, and can verify the disk image before booting.
And besides, why would I want over-the-air updates to my freakin' thermostat?
Re: Researchers crack open malware that hid for 5 years
#178Earlier quoted context omitted.
Then you can't do over the wire updates, which means no fixes after it's been manufactured and installed, which would probably increase the costs quite a bit.
> Then you can't do over the wire updates, Which, of course, is the whole point. If ROMs do cost more, I bet people who want secure systems would be quite willing to pay a bit extra. It would be too expensive to put an OS in ROM, but the ROMs could contain the hashes of the OS on disk, and can verify the disk image before booting. And besides, why would I want over-the-air updates to my freakin' thermostat?
Another way is to have a jumper that is required to enable the write cycle to the flash ROMs. That enables the manufacturer to update the ROMs before shipping, then remove the jumper.
Anyone trying to compromise the device would then require physical access.
Re: Researchers crack open malware that hid for 5 years
#179Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.
Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.
> running as a local admin on a domain controller
To nitpick, domain controllers don't have local accounts at all. It was probably running as SYSTEM which equates to the domain controller's computer account for AD.
Re: Researchers crack open malware that hid for 5 years
#180Earlier quoted context omitted.
The opposite of “open source” isn't “black box”.
Not the person you're replying to but opposite of open source is closed source, and isn't that basically a black box to you since you don't know what it's doing? Is there something more subtle I'm missing?
Yes. Microsoft offers source access to Windows. IBM and Oracle will rent you people who know the details of their software. None of those companies' offerings are particularly ‘black box’-y, in spite of being very closed source.
‘Open source’ is more about the development model (and freedoms) than about the nature of ‘knowing what the software is doing’.
Heck, I could argue that Linux is a black box to most people who aren't well-versed in kernel development. OpenSSL is notoriously difficult to understand. Sometimes huge bugs look relatively innocent¹ even with people looking at the code.