3 ms·

The article states: >"Somewhere in the Linux operating system, which runs in many servers, is code that authorizes a user by verifying a typed password against

The article states: >"Somewhere in the Linux operating system, which runs in many servers, is code that authorizes a user by verifying a typed password against a stored encrypted one. An implanted chip can alter part of that code so the server won’t check for a password—and presto! A secure machine is open to any and all users." I realize the intended audience for this article is not a technical crowd but can someone walk me through in practical terms how such a chip might subvert the /bin/login binary?

gluegadget 8y ago
Quite possibly through IPMI as PAM.
- bogomipz 8y ago
  Can you elaborate?
  - sounds 8y ago
    Let me elaborate your question. "can someone walk me through in practical terms how such a chip might subvert the /bin/login binary?" Unpacking that: 1. Please, random internet stranger, can you... 2. Make a nice bloggy article with pretty pictures... 3. That includes practical handy advice... 4. How, once I've compromised the system at the BMC... 5. To write an exploit for the linux kernel without getting caught. Preferrably one that silently patches /bin/login. Yeah, if you know how to do that, you're not posting it on the internet. You're on anonymous message boards asking for jobs from one side or the other.
    - bogomipz 8y ago
      Yeah that wasn't my question at all. Maybe you aren't a native English speaker but "walk me through" is an idiom in the English language it is not a literal phrase. The OP's comment was quite terse and so I asked if they wouldn't mind elaborating. As you can see someone else replied with a more concrete example, which is all I was asking. Your response displays a shocking level of immaturity that appears to have been triggered by your own total and complete misunderstanding.
stordoff 8y ago
https://jhalderm.com/pub/papers/ipmi-woot13.pdf https://jhalderm.com/pub/papers/ipmi-woot13.pdf suggests one (fairly visible) way: > Another common feature is virtual USB disk media, which can be used to infiltrate or exfiltrate files or to provide new boot media. The combination of these capabilities and remote power cycling would allow an attacker to seize control of most common server configurations. For instance, they could restart the system and boot from a virtual live CD, then directly copy or modify data on the host’s storage devices If the IPMI has write access to disc and/or main memory, you can do it more directly - drop a new /bin/login on the disc, or patch it in memory (similar to the LoJax attack: https://news.ycombinator.com/item?id=18090651 https://news.ycombinator.com/item?id=18090651)
- bogomipz 8y ago
  Thanks. So presumably these backdoor chips are attached to either the I2C or SMBus. That's the part I was missing. Cheers.
MattSteelblade 8y ago
Here is a demonstration by Christopher Domas where he uses an undocumented processor hidden in an X86 processor to become root: https://www.youtube.com/watch?v=_eSAF_qT_FY https://www.youtube.com/watch?v=_eSAF_qT_FY
- bogomipz 8y ago
  Wow this was a great watch. Thanks!

gluegadget 8y ago

Quite possibly through IPMI as PAM.

bogomipz 8y ago
Can you elaborate?
- sounds 8y ago
  Let me elaborate your question. "can someone walk me through in practical terms how such a chip might subvert the /bin/login binary?" Unpacking that: 1. Please, random internet stranger, can you... 2. Make a nice bloggy article with pretty pictures... 3. That includes practical handy advice... 4. How, once I've compromised the system at the BMC... 5. To write an exploit for the linux kernel without getting caught. Preferrably one that silently patches /bin/login. Yeah, if you know how to do that, you're not posting it on the internet. You're on anonymous message boards asking for jobs from one side or the other.
  - bogomipz 8y ago
    Yeah that wasn't my question at all. Maybe you aren't a native English speaker but "walk me through" is an idiom in the English language it is not a literal phrase. The OP's comment was quite terse and so I asked if they wouldn't mind elaborating. As you can see someone else replied with a more concrete example, which is all I was asking. Your response displays a shocking level of immaturity that appears to have been triggered by your own total and complete misunderstanding.

stordoff 8y ago

https://jhalderm.com/pub/papers/ipmi-woot13.pdf https://jhalderm.com/pub/papers/ipmi-woot13.pdf suggests one (fairly visible) way: > Another common feature is virtual USB disk media, which can be used to infiltrate or exfiltrate files or to provide new boot media. The combination of these capabilities and remote power cycling would allow an attacker to seize control of most common server configurations. For instance, they could restart the system and boot from a virtual live CD, then directly copy or modify data on the host’s storage devices If the IPMI has write access to disc and/or main memory, you can do it more directly - drop a new /bin/login on the disc, or patch it in memory (similar to the LoJax attack: https://news.ycombinator.com/item?id=18090651 https://news.ycombinator.com/item?id=18090651)

bogomipz 8y ago
Thanks. So presumably these backdoor chips are attached to either the I2C or SMBus. That's the part I was missing. Cheers.

MattSteelblade 8y ago

Here is a demonstration by Christopher Domas where he uses an undocumented processor hidden in an X86 processor to become root: https://www.youtube.com/watch?v=_eSAF_qT_FY https://www.youtube.com/watch?v=_eSAF_qT_FY

bogomipz 8y ago
Wow this was a great watch. Thanks!