Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls • Hacker News Board

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#71

Post by SXX » Fri, Jun 09, 2017, 9:36 PM UTC

MichaelGG wrote: post #65

SXX wrote: post #44

Earlier quoted context omitted.

Yeah it's will bring new amazing spyware and ransomware on millions of PCs.

Can you explain how, exactly? Spyware would need to call out to system APIs to do anything useful, and that's not something that can be done inside an enclave. Sure, it'd let you be a bit sloppier with randomware, not needing public key crypto to make it all work. Not really a huge deal.

Yes I can. In past there was many cases when normal software and even distributed drivers contained different kind of malware. After some point someone find it and it's become detectable, there was scandal and way to remove it. Also there was very serious risk that if some company put backdoor into their software it's will be found and company will be sued at least.

If something like SGX become publicly available then a lot of proprietary software and content manufacturers going to use it for DRM purposes. So efficiently it's will be everywhere.

Now imagine that every company can put sleeping backdoor in their software that can't be found by reverse engineering. Then they can activate it on demand for purposes of industrial espionage. Or they can simply ship own version of backdoor to ever customer and then pretend it's was some "bug" when someone detected it's activity.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#72

Post by microwavecamera » Sat, Jun 10, 2017, 12:07 AM UTC

acdha wrote: post #70

mycall wrote: post #46

Earlier quoted context omitted.

Of these techs, which does AMD support? Would switching to AMD make us more secure?

> Would switching to AMD make us more secure? That's not quite the right question: this is just standard use of a remote management feature which is disabled by default. If you enable any remote management service, which are extremely common on server class hardware and many enterprise desktop devices regardless of vendor, you have to take responsibility for securing the management features you enable. The only real…

It's not secure, that's the problem. AMT relies on security by obscurity.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#73

Post by microwavecamera » Sat, Jun 10, 2017, 12:18 AM UTC

zkms wrote: post #40

SXX wrote: post #18

Earlier quoted context omitted.

AMT is disabled by default on most consumer PCs or at least it's not expose itself. Though AMT work on top of ME and ME is opposite: it's always active and required for system to operate. If ME firmware not found CPU will shut down every 30 minutes or something. There also way to neutralize some part of ME firmware while keeping system operational, but it's hard to tell how effective this is actually.

A privileged local user can provision AMT to its liking though, which is afaict what this malware did.

AMT exploits are a side channel attack. AMT has it's own processor, loads from it's own ROM separate from the BIOS and has it's own network stack but has full access to the system at a hardware level. AMT System Management Mode hooks in to the CPU at ring level -2, below the OS and is remotely exploitable.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#74

Post by khedoros1 » Sat, Jun 10, 2017, 12:53 AM UTC

godmodus wrote: post #9

Do ARM cpus have this? Seriously... profanity here

An ARM CPU is just a core. SoCs probably do have this, pretty often. I know the Raspberry Pi's got a separate processor core running closed-source Broadcom software, and which has access to the system's memory.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#75

Post by oneplane » Sat, Jun 10, 2017, 12:58 AM UTC

microwavecamera wrote: post #72

acdha wrote: post #70

Earlier quoted context omitted.

> Would switching to AMD make us more secure? That's not quite the right question: this is just standard use of a remote management feature which is disabled by default. If you enable any remote management service, which are extremely common on server class hardware and many enterprise desktop devices regardless of vendor, you have to take responsibility for securing the management features you enable. The only real…

It's not secure, that's the problem. AMT relies on security by obscurity.

It also seems to rely on "unexpected functionality by buggy code". There were flaws in basic luxury functionality like JPEG parsing that allows anyone to overwrite certain pieces of memory regardless of it's signature or write protect bits. It was then used as a jumping pad to enter the ARC CPU and have total system control from there. Basically, unless you desolder the flash, it's a rootkit you can't get out.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#76

Post by julian_1 » Sat, Jun 10, 2017, 2:06 AM UTC

oneplane wrote: post #31

Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago. You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them wil…

From what I can tell, what's new and correctly reported in the article is that Microsoft have now found active malware exploiting these OOB channels.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#77

Post by julian_1 » Sat, Jun 10, 2017, 2:09 AM UTC

mycall wrote: post #46

oneplane wrote: post #31

Another round of crappy journalism. It's not obscure, it's not a CPU feature but a platform feature, and there are plenty of out-of-band communication channels out there, this isn't the only one. On top of that, this was already published two DEF CONs ago. You can exfil data and even do practival bi-directional communication over: SOL, IPMI, ASF, MT's ARC CPU via injected firmware and then via TCP/IP. Any of them wil…

Of these techs, which does AMD support? Would switching to AMD make us more secure?

No AMD run an on-die ARM co-processor, with dma access to memory and memory-mapped hardware such as ethernet controllers.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#78

Post by rasz » Sat, Jun 10, 2017, 2:51 AM UTC

kakarot wrote: post #53

rasz wrote: post #37

Earlier quoted context omitted.

ME is there (ability to execute below ring -1). Go ahead and check it right now, look at lspci/device manager for Management Engine Communications device. Its present on cheapest desktop H81 motherboards, and on highend (at the time) Z87 ones, no matter the cpu.

I have done that before, and I've just done it again, and I don't get anything. The only thing present on my system related to ME afaik is the MEI linux driver, which is pretty useless without a ME to talk to. According to ARK [0], vPRO is absent. I have done various other system queries and nothing has turned up. Anything else you want me to query? And where do you get this information that ME is present in all chip…

https://github.com/zamaudio/intelmetool

sudo intelmetool -s

Im pretty sure Intel BootGuard is ME based

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#79

Post by MichaelGG » Sat, Jun 10, 2017, 5:40 AM UTC

SXX wrote: post #71

MichaelGG wrote: post #65

Earlier quoted context omitted.

Can you explain how, exactly? Spyware would need to call out to system APIs to do anything useful, and that's not something that can be done inside an enclave. Sure, it'd let you be a bit sloppier with randomware, not needing public key crypto to make it all work. Not really a huge deal.

Yes I can. In past there was many cases when normal software and even distributed drivers contained different kind of malware. After some point someone find it and it's become detectable, there was scandal and way to remove it. Also there was very serious risk that if some company put backdoor into their software it's will be found and company will be sued at least. If something like SGX become publicly available the…

I think you might not understand SGX's capability. It's just a compute kernel. So if they're taking data from your system, that's still very visible. And if they are sending data, that's also visible. So, sure, it's handy to hide logic. So the WannaCry thing, you'd be able to see it does DNS queries, but not how it determined a certain outcome based on the inputs. But you can't hide, for instance, a keylogger.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#80

Post by SXX » Sat, Jun 10, 2017, 6:30 AM UTC

MichaelGG wrote: post #79

SXX wrote: post #71

Earlier quoted context omitted.

Yes I can. In past there was many cases when normal software and even distributed drivers contained different kind of malware. After some point someone find it and it's become detectable, there was scandal and way to remove it. Also there was very serious risk that if some company put backdoor into their software it's will be found and company will be sued at least. If something like SGX become publicly available the…

I think you might not understand SGX's capability. It's just a compute kernel. So if they're taking data from your system, that's still very visible. And if they are sending data, that's also visible. So, sure, it's handy to hide logic. So the WannaCry thing, you'd be able to see it does DNS queries, but not how it determined a certain outcome based on the inputs. But you can't hide, for instance, a keylogger.

I perfectly understand what you pointing to, but problem of black box running in every piece of software is massive. Anyone could use it to implement remote backdoor in software and then pretend it's just a DRM that talking with licensing server.

Yeah it's could be detected when it's start to be active, but it's doesn't have to. It's could be idle on PC for years undetected just waiting for remote command, trigger or special payload just for you.

PS: Also fact that secure enclave itself can't access system API mean nothing because half of software already have interpreters in it as well as frameworks for every possible activity bad or good.