Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers crack open malware that hid for 5 years

arstechnica.com

Post reply on HN
Print view View original

191–200 of 232 posts

Re: Researchers crack open malware that hid for 5 years

#191

Post by mikeash »

WalterBright wrote: post #178
WalterBright wrote: post #177

Earlier quoted context omitted.

> Then you can't do over the wire updates, Which, of course, is the whole point. If ROMs do cost more, I bet people who want secure systems would be quite willing to pay a bit extra. It would be too expensive to put an OS in ROM, but the ROMs could contain the hashes of the OS on disk, and can verify the disk image before booting. And besides, why would I want over-the-air updates to my freakin' thermostat?

Another way is to have a jumper that is required to enable the write cycle to the flash ROMs. That enables the manufacturer to update the ROMs before shipping, then remove the jumper. Anyone trying to compromise the device would then require physical access.

Make it a button, so the customer can apply updates, but they need to press a button to make it happen. Add another button which, using only software stored in ROM, reloads the firmware from ROM. Then you have updates, but only when the customer knows and wants it, and if they ever screw it up then they can get back to a known good state.

Re: Researchers crack open malware that hid for 5 years

#192

Post by deftnerd »

WalterBright wrote: post #190
megablast wrote: post #187

Earlier quoted context omitted.

> No malware will survive a power cycle. Not true at all.

Please explain.

I'm not the original poster, but unless you're talking about a very simple embedded system, most computing devices have lots of areas for malware to live that will survive power cycles. HDD firmware, graphics card firmware, various controllers have their own firmware, NIC cards have their own firmware, etc.

Even if the boot device is read-only, it would be a huge challenge to build any kind of system without these vulnerable components.

Re: Researchers crack open malware that hid for 5 years

#193

Post by rangibaby »

13of40 wrote: post #130
dghughes wrote: post #59

Earlier quoted context omitted.

>I remember hearing there were going around filling USB ports with epoxy. And we all laughed at PS/2 keyboards and mouseeses

You can boot an original IBM PC off the keyboard port. Look for the MFG_BOOT function here: https://www.iee.et.tu-dresden.de/~kc-club/DOWNLOAD/DISK401/R... Basically, the device connected to the keyboard port has to reply with code 0x65 when it's initialized, then the BIOS will read some bytes into memory and jump to it. Not sure whether this was brought forward to newer models or clones, though so it's just some fun…

The original IBM PC switch was like the back switch on current PSUs. If it were on it would be booting anyway, right?

Re: Researchers crack open malware that hid for 5 years

#194

Post by ladzoppelin »

devnull42 wrote: post #145
j_s wrote: post #112

Earlier quoted context omitted.

Is there any part of your talk available online?

This is pretty much the only part. The code from the live demo. I will try and find a place to get the slides up in the next few days if there is any interest: https://github.com/coryschwartz/dns_exfiltration

I was at the conference but missed this talk. I would love to see the slides. Congrats on speaking at Defcon.

Re: Researchers crack open malware that hid for 5 years

#195

Post by [deleted] »

infinite8s wrote: post #169
WalterBright wrote: post #148

Earlier quoted context omitted.

Just put the software in the device in ROM, a forgotten technology. No malware will survive a power cycle. It's like I read that malware could infect your "internet of things" thermostat and then hackers could remotely turn off your heat until you pay ransom. Just put the dang thermostat code in ROM. Power cycle, goodbye malware. For more critical stuff, just have it regularly power cycle itself.

Then you can't do over the wire updates, which means no fixes after it's been manufactured and installed, which would probably increase the costs quite a bit.

[deleted]

Re: Researchers crack open malware that hid for 5 years

#196

Post by PeCaN »

rwallace wrote: post #189
PeCaN wrote: post #180

Earlier quoted context omitted.

Yes. Microsoft offers source access to Windows. IBM and Oracle will rent you people who know the details of their software. None of those companies' offerings are particularly ‘black box’-y, in spite of being very closed source. ‘Open source’ is more about the development model (and freedoms) than about the nature of ‘knowing what the software is doing’. Heck, I could argue that Linux is a black box to most people wh…

At the level of security where you need to be paranoid about the operating system developers, how do you know the source code Microsoft shows you, corresponds to the Windows binaries running on your machines? (Let alone to the sum and total of all binary patches applied thereto?)

A source license probably also gets you the build system, or if not maybe you could throw more money at them.

But reproducible builds are a hard problem, so… honestly, I can't answer that.

Re: Researchers crack open malware that hid for 5 years

#197

Post by pjmorris »

PeCaN wrote: post #196
rwallace wrote: post #189

Earlier quoted context omitted.

At the level of security where you need to be paranoid about the operating system developers, how do you know the source code Microsoft shows you, corresponds to the Windows binaries running on your machines? (Let alone to the sum and total of all binary patches applied thereto?)

A source license probably also gets you the build system, or if not maybe you could throw more money at them. But reproducible builds are a hard problem, so… honestly, I can't answer that.

And that's what I really mean by 'black boxes'. Yes, you can buy access to, e.g., Windows source, but that doesn't mean that what you review and what is running on your systems are the same thing. And I can't even speak to all the third-party bits that get compiled in to an instance of Windows. It's a really, really hard problem.

Re: Researchers crack open malware that hid for 5 years

#198

Post by WalterBright »

deftnerd wrote: post #192
WalterBright wrote: post #190

Earlier quoted context omitted.

Please explain.

I'm not the original poster, but unless you're talking about a very simple embedded system, most computing devices have lots of areas for malware to live that will survive power cycles. HDD firmware, graphics card firmware, various controllers have their own firmware, NIC cards have their own firmware, etc. Even if the boot device is read-only, it would be a huge challenge to build any kind of system without these vu…

Every one of those devices that is done with ROMs closes another door to malware. It's certainly far more doable and reliable than ensuring the software doesn't have holes in it.

There's a huge market for secure items - routers, cars, thermostats, medical devices, avionics, ATMs, etc. I simply don't understand why ROMs aren't used.

Re: Researchers crack open malware that hid for 5 years

#199

Post by WalterBright »

mikeash wrote: post #191
WalterBright wrote: post #178

Earlier quoted context omitted.

Another way is to have a jumper that is required to enable the write cycle to the flash ROMs. That enables the manufacturer to update the ROMs before shipping, then remove the jumper. Anyone trying to compromise the device would then require physical access.

Make it a button, so the customer can apply updates, but they need to press a button to make it happen. Add another button which, using only software stored in ROM, reloads the firmware from ROM. Then you have updates, but only when the customer knows and wants it, and if they ever screw it up then they can get back to a known good state.

Yup, that's the way to do it.

Re: Researchers crack open malware that hid for 5 years

#200

Post by woliveirajr »

ms013 wrote: post #147
drzaiusapelord wrote: post #133

Earlier quoted context omitted.

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot. That said, I could see glueing a panel to block them as a vi…

They epoxied the USB ports on my secure machine when I worked at one of the national labs about 12 years ago. One day I came in and the admin had gone through everyone's office the evening before with a bunch of JB weld to fill the USB ports. So, whether or not you believe that it is a useful solution, it certainly did happen. As for alternatives to gluing, I assume that was time related: filling in a port is certain…

Port-ectomy: a new word in my dictionary, must remember to use it someday!
Post reply on HN