5 ms·
There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs
by radicalbyte 8y ago
There wouldn't be any weird outbound traffic; the attacker would use another cloud instance as a controller. They would use a US-based account (and IPs via VPNs) to control the controller.
- simplecomplex 8y agoThe traffic has to travel over wire as TCP/IP, regardless of what device generated it. It has to travel over wire somewhere! The device can’t magically communicate with China. Any outbound firewall could detect that, especially traffic going to ports that aren’t even open/used.
- true_religion 8y agoI think the idea is that the traffic goes over intranet to another computer that they legitimately control within the datacenter, then goes to China. Or if they can insert themselves into the maintenance team, they can retrieve their chips at a later date.
- lostmsu 8y agoAren't we talking about virtual machines running on this hardware?
- Filligree 8y agoUnless, just to provide a nightmare scenario, the routers that would detect it are also compromised.
- paulie_a 8y agoThe NSA did that, they literally intercepted routers en route. I'm guessing other agencies have too. Or you can just use the default credentials Cisco is addicted to leaving in their code.
- simondedalus 8y agoi gave you the benefit of the doubt when i read your earlier comment, but this doubledown shows you're extremely naive / have no experience with the space. you realize there are entire industries (plural) premised off the fact that you can't just throw up "any firewall" and detect this kind of thing, no? can you imagine how it would go down if a major corporation like apple experienced a hardware hacking based infrastructure breach, contracted a cybersecurity company, and the tech heading their case asked them like "well were you making sure to check which ports were open?"
- dpedu 8y agoCloud instances are generally firewalled off from each other, usually cross-account, vpc, etc. Two machines can't reach each other just because they're AWS instances. That would be silly.
- zaroth 8y agoThe attacker and target have VMs on the same hardware. The attacker has a fake presence serving cat pics which is constantly sending “valid” logging traffic to an S3 bucket. The chip passes the stolen data between the VM instances by DMA. The stolen data hitches a ride inside an otherwise innocuous TCP packet storing log entries in that S3 bucket. Logs are routine backed up off site. There would be absolute nothing at the network level to distinguish the infiltrated packets. Lower latency scenarios could be devised which would be similarly invisible but allow better command & control.
- robryk 8y agoIt seems that you're arguing for a different functionality of the implanted chip than the original article. Original article supposes that the implanted chip was used to modify the boot process of the BMC in such a way that the BMC loaded its software over the network. The question is why this network activity wasn't easily detectable and firewalled off by default. It seems that you suppose that the chip can be directly used for some sort of userspace-inside-a-VM to ring0(?) escalation. In particular, you suppose that the chip has access to main memory. Can you elaborate on what functionality do you think the implant could've had?
- PeterisP 8y agoNot the parent poster, but the chip can indirectly used for such an escalation - the chip would have the capacity to modify BMC software as it's loaded from a nearby memory chip; and BMC has direct access to main memory that enables all kinds of interesting escalation scenarios.