5 ms·

> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwa

> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure out how to break into the most secure location in that company and steal the most secure key that that company owns, without JMicron finding out about it. Oh come on... "most secure location"? I'd wager it would be harder to break into the janitor's closet and steal his toilet paper supply than it would be to get those signing certs. If this was most companies it was stored on a public file share used by software engineers or in an open source control repository. They either got someone hired as a contractor or bribed an engineer they found on LinkedIn a couple thousand dollars.

LeonM 8y ago
That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Companies of this size are audited regularly, so access to the HSM is expected to be strictly controlled. So yes, it is a pretty secure location, and a highly guarded secret. The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own.
- tscherno 8y ago
  That`s how it should work in theory, in practice it was most likely how the parent has described it.
- titzer 8y ago
  > I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Or were able to duplicate the HSM before it was delivered. You know, like how the NSA intercepted shipments of internet routers in transit and inserted backdoors.
  - amaccuish 8y ago
    That wouldn't work because HSMs are typically not delivered with keys, you generate the private key yourself.
    - titzer 8y ago
      Ok, makes sense. It could also be that the HSM was shipped from one office to another after keys had been loaded onto it. Dunno.
      - erkkie 8y ago
        In "secure" places, HSM's are basically in a vault with armed guards.
        slowburning 8y ago
        I have seen HSMs in a concrete fireproof room, inside another concrete room, inside a regular room, inside a nondescript building. This one required the use of 3 persons (one to authorize entry past the 2 guys with rifles, one to unlock the vault rack with the hsm, another to authenticate to the HSM to perform work).
        irundebian 8y ago
        Company or agency?
        slowburning 8y ago
        a very large private company
- michaelt 8y ago
  IDK, pre-windows-10 didn't you just need a ~$200 [1] code signing certificate? Do people usually buy HSMs to store those? [1] https://www.sslshopper.com/microsoft-authenticode-certificates.html https://www.sslshopper.com/microsoft-authenticode-certificat...
  - erkkie 8y ago
    You do not store certificates on an HSM, you generate the private key on it and use that to sign things. Certificates that end up in actual use are further many chains removed from the root keys.
  - blattimwind 8y ago
    > Do people usually buy HSMs to store those? At the time Stuxnet was around, no, not really.
- mykull 8y ago
  Isn't a national security letter enough to "break in" to any US company?
  - mykull 8y ago
    Oh realtek is Taiwanese, but I don't doubt they have reason to cooperate as well.
- piaste 8y ago
  > The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own. Did they break into them? Stuxnet had government backing, most articles I've read assume American or Israeli. If it was the American government (on its own or on Israel's behalf), then it might have 'simply' applied its considerable influence to get the Taiwanese government to get Realtek and JMicron to hand over the HSMs.
- 34k5uoi5ui 8y ago
  Sorry, this _IS_ how it works. These are usually stored on developers workstations with a weak password protected PKCS12 file (.pfx/.p12) HSMs. Lol.
  - chris_wot 8y ago
    I'm genuinely interested in how you know this.
- VectorLock 8y ago
  >You need the private key to sign the drivers. This is not a file that developers of those companies have access too. The developers would need access to the private key to sign the drivers they're deploying. Convenience is the ultimate foil of most good security intentions.
- vardump 8y ago
  > That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. No, you could unfortunately get around that very easily (or rather, ignore recommendations) at least a few years ago. So I bet there are a lot of certificates and private keys lying around on disks, build servers, version control systems and probably even on developer USB sticks. The cert and key just needs to be something signtool can access. Signtool doesn't care whether it's relatively unprotected key in system software based key store or on a HSM. Windows 10 1607+ enforces a much stricter standard, especially if you want your driver to work in Secure Boot mode. There are also stricter requirements for driver testing and static analysis, although those depend on the driver type. Microsoft requires and checks testing tool output as a part of the driver submission before finally signing it with their cert. Tip: If you run Windows 10 and value security (and system stability), use Secure Boot. (I've developed Windows kernel drivers.)
  - dsfyu404ed 8y ago
    More likely they just spear phished the people who would have access that can be used to get the keys.
- djrogers 8y ago
  > These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. Sure now they often are - after many security failures 10 years ago before HSMs were widely deployed. A decade ago a much more common ‘secure’ mechanism was to store the keys on an airgapped machine that had never been connected to a network and use sneakernet to get binaries signed.
INTPenis 8y ago
I can tell you that even a meager telco that I've worked for has very good security to their PKI equipment and none of it is networked. Has had since before stuxnet became known. And they don't even manufacture hardware. If you manufacture hardware and distribute drivers you are an even bigger target than a telco.
dnomad 8y ago
This is the most suspicious element of the whole affair. The actual security algorithms weren't compromised rather they compromised the whole environment by getting their hands on the Realtek keys. Personally I doubt that retrieving this key involved required some act of super ninja skills espionage. I suspect somebody high up in the US government simply picked up the phone and called somebody high up in the Taiwanese government. The reality is Taiwan's security at the end of the day is wholly dependent upon US defense. There are no other options, there are no other cards in their hand. They absolutely need the US military to secure the continued existence of their nation. This is the lesson of Stuxnet: "private" actors aren't. At the end of the day the US government has demonstrated again and again that it can compel cooperation from virtually every technology firm in the "free world." It's not a card to be played lightly but it's absolutely there. Thanks to Snowden we know the NSA regularly compromises Cisco telecom equipment created for export [1][2] and that the US government is working closely with all the major tech firms[3]. And this is why the US does not want China exporting Chinese phones, electronics, telcom kit, chips and social software. There's absolutely no problem when "private companies" in the US, Korea, Japan and Taiwan export this equipment and technology because these companies are squarely under the thumb of the US. Now that China is getting in on the game everybody is freaking the fuck out precisely because they understand perfectly what it means for "private companies" in China to have a significant chunk of the market. Of course the Chinese also understand exactly what's going on here and this is why they've established the Great Firewall and why they're absolutely determined to homegrow all their technology needs. Right now China imports an absolutely extraordinary amount of chips and it is probably their greatest security weakness [4]. So this is what it comes down to: every large corporation that matters is likely a phone call and/or secret warrant away from literally giving its private keys to some government actor, likely the US or China. Any data stored by these corporate systems should be considered readable and writable by the government. Any service secured by these corporate systems should be considered accessible and ultimately under the control of these governments. These corporations will not risk either their continued existence or the possibility of fat government contracts in order to protect their customers from these governments. Individuals who depend upon these corporations are therefore completely at the mercy of these government actors. All of this is a long way of saying that security of digital assets cannot be outsourced. [1] https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... [2] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... [3] https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) [4] http://nationalinterest.org/feature/how-china-will-benefit-americas-trade-war-25873 http://nationalinterest.org/feature/how-china-will-benefit-a...

LeonM 8y ago

That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Companies of this size are audited regularly, so access to the HSM is expected to be strictly controlled. So yes, it is a pretty secure location, and a highly guarded secret. The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own.

tscherno 8y ago
That`s how it should work in theory, in practice it was most likely how the parent has described it.
titzer 8y ago
> I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Or were able to duplicate the HSM before it was delivered. You know, like how the NSA intercepted shipments of internet routers in transit and inserted backdoors.
- amaccuish 8y ago
  That wouldn't work because HSMs are typically not delivered with keys, you generate the private key yourself.
  - titzer 8y ago
    Ok, makes sense. It could also be that the HSM was shipped from one office to another after keys had been loaded onto it. Dunno.
    - erkkie 8y ago
      In "secure" places, HSM's are basically in a vault with armed guards.
      - slowburning 8y ago
        I have seen HSMs in a concrete fireproof room, inside another concrete room, inside a regular room, inside a nondescript building. This one required the use of 3 persons (one to authorize entry past the 2 guys with rifles, one to unlock the vault rack with the hsm, another to authenticate to the HSM to perform work).
        irundebian 8y ago
        Company or agency?
        slowburning 8y ago
        a very large private company
michaelt 8y ago
IDK, pre-windows-10 didn't you just need a ~$200 [1] code signing certificate? Do people usually buy HSMs to store those? [1] https://www.sslshopper.com/microsoft-authenticode-certificates.html https://www.sslshopper.com/microsoft-authenticode-certificat...
- erkkie 8y ago
  You do not store certificates on an HSM, you generate the private key on it and use that to sign things. Certificates that end up in actual use are further many chains removed from the root keys.
- blattimwind 8y ago
  > Do people usually buy HSMs to store those? At the time Stuxnet was around, no, not really.
mykull 8y ago
Isn't a national security letter enough to "break in" to any US company?
- mykull 8y ago
  Oh realtek is Taiwanese, but I don't doubt they have reason to cooperate as well.
piaste 8y ago
> The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own. Did they break into them? Stuxnet had government backing, most articles I've read assume American or Israeli. If it was the American government (on its own or on Israel's behalf), then it might have 'simply' applied its considerable influence to get the Taiwanese government to get Realtek and JMicron to hand over the HSMs.
34k5uoi5ui 8y ago
Sorry, this _IS_ how it works. These are usually stored on developers workstations with a weak password protected PKCS12 file (.pfx/.p12) HSMs. Lol.
- chris_wot 8y ago
  I'm genuinely interested in how you know this.
VectorLock 8y ago
>You need the private key to sign the drivers. This is not a file that developers of those companies have access too. The developers would need access to the private key to sign the drivers they're deploying. Convenience is the ultimate foil of most good security intentions.
vardump 8y ago
> That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. No, you could unfortunately get around that very easily (or rather, ignore recommendations) at least a few years ago. So I bet there are a lot of certificates and private keys lying around on disks, build servers, version control systems and probably even on developer USB sticks. The cert and key just needs to be something signtool can access. Signtool doesn't care whether it's relatively unprotected key in system software based key store or on a HSM. Windows 10 1607+ enforces a much stricter standard, especially if you want your driver to work in Secure Boot mode. There are also stricter requirements for driver testing and static analysis, although those depend on the driver type. Microsoft requires and checks testing tool output as a part of the driver submission before finally signing it with their cert. Tip: If you run Windows 10 and value security (and system stability), use Secure Boot. (I've developed Windows kernel drivers.)
- dsfyu404ed 8y ago
  More likely they just spear phished the people who would have access that can be used to get the keys.
djrogers 8y ago
> These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. Sure now they often are - after many security failures 10 years ago before HSMs were widely deployed. A decade ago a much more common ‘secure’ mechanism was to store the keys on an airgapped machine that had never been connected to a network and use sneakernet to get binaries signed.

INTPenis 8y ago

I can tell you that even a meager telco that I've worked for has very good security to their PKI equipment and none of it is networked. Has had since before stuxnet became known. And they don't even manufacture hardware. If you manufacture hardware and distribute drivers you are an even bigger target than a telco.

dnomad 8y ago

This is the most suspicious element of the whole affair. The actual security algorithms weren't compromised rather they compromised the whole environment by getting their hands on the Realtek keys. Personally I doubt that retrieving this key involved required some act of super ninja skills espionage. I suspect somebody high up in the US government simply picked up the phone and called somebody high up in the Taiwanese government. The reality is Taiwan's security at the end of the day is wholly dependent upon US defense. There are no other options, there are no other cards in their hand. They absolutely need the US military to secure the continued existence of their nation. This is the lesson of Stuxnet: "private" actors aren't. At the end of the day the US government has demonstrated again and again that it can compel cooperation from virtually every technology firm in the "free world." It's not a card to be played lightly but it's absolutely there. Thanks to Snowden we know the NSA regularly compromises Cisco telecom equipment created for export [1][2] and that the US government is working closely with all the major tech firms[3]. And this is why the US does not want China exporting Chinese phones, electronics, telcom kit, chips and social software. There's absolutely no problem when "private companies" in the US, Korea, Japan and Taiwan export this equipment and technology because these companies are squarely under the thumb of the US. Now that China is getting in on the game everybody is freaking the fuck out precisely because they understand perfectly what it means for "private companies" in China to have a significant chunk of the market. Of course the Chinese also understand exactly what's going on here and this is why they've established the Great Firewall and why they're absolutely determined to homegrow all their technology needs. Right now China imports an absolutely extraordinary amount of chips and it is probably their greatest security weakness [4]. So this is what it comes down to: every large corporation that matters is likely a phone call and/or secret warrant away from literally giving its private keys to some government actor, likely the US or China. Any data stored by these corporate systems should be considered readable and writable by the government. Any service secured by these corporate systems should be considered accessible and ultimately under the control of these governments. These corporations will not risk either their continued existence or the possibility of fat government contracts in order to protect their customers from these governments. Individuals who depend upon these corporations are therefore completely at the mercy of these government actors. All of this is a long way of saying that security of digital assets cannot be outsourced. [1] https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... [2] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... [3] https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) [4] http://nationalinterest.org/feature/how-china-will-benefit-americas-trade-war-25873 http://nationalinterest.org/feature/how-china-will-benefit-a...