10 ms·
Writing a firmware-only keylogger
- edgeform 5y agoWhen Jason Snell posts on HN, I sit up in my chair. Great read. That "technology" included in Realtek is absolutely bonkers -- who asked for that functionality at a consumer level? No one.
- miles 5y ago> When Jason Snell posts on HN, I sit up in my chair I believe the post is from Juho Snell: http://www.snellman.net/blog/archive/about/ http://www.snellman.net/blog/archive/about/ https://twitter.com/juhosnellman https://twitter.com/juhosnellman
- _Nat_ 5y agoThis comment doesn't seem too related to the article except for the words "Jason Snell" and "Realtek", and both of those appear misused. So I don't mean to be rude, but I'm guessing this is a chatbot? Skimmed for proper-nouns, then generic shrills about how the author and article are great and how technology's too complicated?
- gzer0 5y agoGood catch. I must say I concur with your assessment.
- edgeform 5y agoYou're wrong, go see my reply to the other guy. What a miserable lot you two make.
- edgeform 5y ago> So I don't mean to be rude He said, before being rude & condescending. Here, would a chat bot pick apart your miserable comment like this? https://twitter.com/jsnell https://twitter.com/jsnell Oh no I mixed up social media handles I must be a chat bot > Skimmed for proper-nouns Oh no I mixed up social media handles I must be a chat bot > then generic shrills Huh? I'm complaining about the very real technology present in the Realtek chips that enables any moron with access to a web browser to send firmware-level commands anywhere in the world. Did you even read the article? > about how the author and article are great Are you a chatbot? I didn't even sing about the article being great, I asked if anyone had a real consumer application for the tech presented as an attack vector in the article. Go outside. Talk to a human being. I'm betting it's been a couple years for you if you're this bad at not only misjudging intention but going straight to "this must not be a human being, only a bot would respond with something I do not wholly understand". Again, what a miserable comment.
- _Nat_ 5y agoHah, okay, that sounds human enough. Sorry for the misunderstanding; I truly meant no offense. Thanks for clarifying! =)
- bobthebuilders 5y agoChatbot detection protection? Throws some whataboutism and a human written paragraph attacking the comment to disguise things.
- yjftsjthsd-h 5y ago> That "technology" included in Realtek is absolutely bonkers -- who asked for that functionality at a consumer level? No one. What tech are we talking about? WoL is definitely appreciated in all devices, although the "RealWoW" thing is very much diminishing returns. Otherwise, everything is just normal programmable chips and DMA-type data movement, both of which are generally desirable.
- edgeform 5y agoRealWoW.
- a-dub 5y agonah. i'll take wifi hardware that doesn't have buggy layer 4+ features in firmware that hackers can exploit to turn my keystrokes into udp packets, thank you very much. in fact, i think i'd prefer a computer that leaves all the layer 4+ up to the operating system as at least it has a chance of being audited. that said, this raises an interesting point. the only way to really be sure is to sniff your own packets... but if everything moves to being encrypted that's going to get a lot harder...
- Nextgrid 5y agoThe RealWoW stuff requires host cooperation to set the proper configuration fields. The card has very basic functionality to be pre-configured to respond to certain packets, but this needs to be set by the host - it is disabled by default and in fact the Linux driver doesn't even support it. In addition if he could achieve code execution on the card it wouldn't matter whether the card has this functionality as he could implement it himself if needed.
- a-dub 5y agosorry. regardless of whether or not you can change the firmware binaries to do what you want. i'm really not okay with half-assed remote management junk being baked into the nic of my personal laptop that bypasses any firewalls i can configure and is constructed from code i cannot review. that is exactly the kind of crap that gets exploited.
- gricardo99 5y agoThe funny thing is that this is effectively a keylogger that does not run any code on the CPU while it is running. I already knew it, but this just reinforced how terribly vulnerable pretty much every computer system is. Makes me think ransomware/hacks are going to get a lot worse, and I can’t see how the situation can be improved, at least for quite some time.
- matheusmoreira 5y agoJust make companies liable for any damage caused by their crappy products. Make them pay billions in damages every time somebody gets hacked because of their negligence. Then they'll start caring about the quality of their software instead of treating it as a cost center.
- smcameron 5y agoOpen source stuff would disappear.
- sonograph 5y agoI disagree. FOSS and commercially licensed (and sold) software with EULAs are two very different things, and can be distinguished in whatever legal language implements these theoretical liabilities
- swiley 5y agoOpen source is the only stuff that doesn't reliably leave gaping wholes laying around for years because anyone can pay to have them fixed.
- kaba0 5y agoThat’s simply false. I really love open-source but to even imply that it is not a ticking bomb of security is just naive.
- Karunamon 5y ago
- marcodiego 5y agoA firmware for the wifi/bluetooth can convince the embedded controller to pass the keys that are pressed on the keyboard and pass this data using wifi, is that? If that is the case, my list of reasons to like open-source firmwares and dislike intel IME has just increased a bit more.
- johncolanduoni 5y agoThe EC has to be flashed too, so it’s not really convincing it of anything. It’s also worth noting that since the wifi firmware isn’t persistent you need to keep the compromised WiFi firmware in your Linux install. So wiping your disk would remove this hack.
- deleted 5y ago[deleted]
- captainmuon 5y agoReally interesting, this is the first time I hear anything about what is in those Realtek firmwares. Keylogger aside, is there anything fun or nefarious one could do with the radio? Also, we use them at work in our products, and usually just get the firmware and driver binaries thrown over the wall by the board vendor, withouy any description or changelog. I'm tempted to throw a few different bins through Ghidra and see if I can tell what changed.
- GekkePrutser 5y agoConsidering people have been converting the PWM pin of a raspberry pi into a digital TV transmitter and the fact that all modern wi-fi chipsets are software defined, I think a lot of malicious stuff can be done with it if one really sets their mind to it. Much more than the regular deauth shenanigans.
- pfundstein 5y agoI think I found the transmitter you're talking about, it looks pretty neat: https://github.com/F5OEO/rpidatv https://github.com/F5OEO/rpidatv
- GekkePrutser 5y agoYes, it's very cool! But don't use it to transmit in practice though. The output is very dirty because it produces square waves which generate a lot of harmonics (emissions on unintended frequencies). You can use this safely if you know what you're doing but only with a lot of filtering. Or by not transmitting as such but outputting into a receiver directly with some attenuation.
- Nextgrid 5y ago> Considering people have been converting the PWM pin of a raspberry pi into a digital TV transmitter Somehow the world didn't end though? Maybe we should just assume the RF spectrum can and will be interfered with regarding of regulation and design accordingly, rather than trying to put the cat in the bag? After all, that's the approach we take for security despite "hacking" being illegal in most countries, and yet we still use HTTPS and authentication.
- baybal2 5y agoI like RealTek hardware for it being really barebones, without overload from extraneous marketing department inspired features. They've been on the retreat from the WiFi space for years, both WiSoC, and STA space. They even sell their latest router chips with third party WiFi 6 chips these days.
- nikital 5y ago> 8051s love talking to each other after all, otherwise USB would not exist. Can anyone explain what the author meant by that? I thought 8051 is just an ISA, is there something special there for cross IC communication compared to other ISAs? And what the the connection to USB?
- repiret 5y agoIn my experience, most USB controllers use an 8051 to implement the USB protocol at the level in between the link and URBs.
- caust1c 5y agoI think the author's simply referencing the fact that it's a common chip used in many usb controllers and make it easy to build peripherals that work with USB standards.
- segfaultbuserr 5y agoDue to its historical influences, 8051-based microcontrollers and cores are still widely used in a huge number of embedded devices and ASICs everywhere - motherboard EC, Ethernet, Wi-Fi controllers, this also includes the peripheral devices that plug into USB ports, like a mouse, a keyboard, a sensor, or industrial controllers, or whatever, so the first part of the joke is most communications via USB are just 8051s talking to each others. The second part of the joke is that even USB ASICs themselves, like USB hubs or host controllers, are often powered by 8051 cores.
- megous 5y agoJust look at the beauty that is EZ-USB FX2LP for one example.
- 0x0 5y agoThe RealWOW server appears to run an ancient windows php distribution that is probably rooted to high heavens: https://twitter.com/angelxwind/status/1410742393914023937?s=21 https://twitter.com/angelxwind/status/1410742393914023937?s=...
- gsich 5y agoSo how does Realwow work? I see the site and can enter some ID, but that request is not going to land magically and globally at my Realtek chip. What am I missing here?
- flatiron 5y agoHe describes it in his post. It is designed to magically and globally hit your Realtek chip!
- garaetjjte 5y agoDriver can configure WiFi firmware to periodically query the RealWOW server by UDP, without host involvement.
- userbinator 5y agoThe funny thing is that this is effectively a keylogger that does not run any code on the CPU while it is running It in fact runs code on two "CPU"s, the EC and the WiFi card; both of which could reasonably be considered computers of their own.
- tinus_hn 5y agoIs this an actual implementation? Or is it just someone musing about what would be possible? Is it even possible for a Bluetooth chipset to read the traffic sent by the devices, or is the encryption handled by the CPU?
- binarybanana 5y agoNice. I'm all for opening up hardware. Now if only someone broke HP's draconian firmware restrictions (verifies firmware at boot an reflashes anything "compromised" with a backup stored who knows where) that would open it up for some real security measures (ME cleaner, coreboot, etc.) and modding in general. Preventing hackers from hacking sucks balls when you're that hacker hacking your own hardware. For me this is a feature and what differenciates a general purpose computer from a locked down games console.