10 ms·
Two never-before-seen tools, from same group, infect air-gapped devices
- 1970-01-01 2y ago>HTTP server, an HTTP server whose precise function isn’t well understood OK, you may be overthinking this one
- deleted 2y ago[deleted]
- gnabgib 2y agoDiscussion (272 points, 4 days ago, 245 comments) https://news.ycombinator.com/item?id=41779952 https://news.ycombinator.com/item?id=41779952
- m3kw9 2y agoGapped or non gapped, the use of USB to deliver back doors is pretty common technique
- rkagerer 2y agoI still use floppy drives and don't have to worry about something I plug into my USB port being more than meets the eye.
- baxtr 2y agoThat’s a great strategy when you live in the early 90s.
- jagged-chisel 2y agoNo one is targeting floppies now. But they were in the 90s. So at that time, you did have to worry that some floppy contained more than you expected.
- pontifier 2y agoFor many years I've just viewed all of my devices as possibly compromised. It's one of the reasons I've been very down on cryptocurrencies in general. I don't actually see USB as something that can maintain a true, robust airgap, because the amount of data transferred is not inspectable. In my view, the best use of an airgapped machine would be for storage of extremely dense and sensitive information such as cryptographic keys. Signing or encryption should be accomplished through an inspectable data channel requiring manual interaction such as QR codes. When every bit in and out of a machine serves a purpose, it's much less likely to leak. Example: show a qr code to a camera on the airgapped machine and get a qr code on the screen containing the signature of the data presented to it. There is very little room for nefarious code execution or data transmission.
- Terr_ 2y agoI'm imagining a "secure slate" you can carry between the computers, a tiny tablet with a camera, e-ink display, and replaceable batteries. It does nothing but snap a picture of a QR code and then (if error checking is OK) reproduces it on its own durable display. Add a write-protection switch that doubles as a cover on the camera-lens, and have it auto-blank when not in use. So you'd snapshot its QR code, hand-carry the slate to air-gapped Computer B, press a button to wake it up, brandish the "copied" QR code in front of B's camera, etc. Maybe even take one and (with careful labeling) put it into a safe, depending on how long you plan to store it. You could do something similar with a camera and thermal-paper printer, but then the physical artifact needs to be reliably destroyed by manual effort, as opposed to auto-erasure.
- RecycledEle 2y ago(oof-topic) I would be very suspicious of a dongle that plugged into an Ethernet port or USB port that said "AIRGAPPED - NO NOT CONNECT."
- Etheryte 2y agoReminds me of this ticket [0]. No matter how hard you try to tell people things, sometimes you just can't. [0] https://github.com/reactjs/react.dev/issues/3896 https://github.com/reactjs/react.dev/issues/3896
- jonathanlydall 2y agoPerhaps the issue author thought the member was given this name because only privileged/blessed developers get to use the “cool stuff” of React. They likely don’t understand the reason why the concept of access modifiers exist in many programming languages. Namely that (good) library authors will do everything possible to avoid breaking the public API, which can be seen as a “promise” from them in what can be relied upon, while internal/private members offer no such promises and the library author can feel free to change/remove them as desired with no prior notice.
- jiggawatts 2y agoThe standard is to put superglue into the ports. In my experience it doesn’t stop admins connecting an “offline Root CA” to the WiFi network to install their entire suite of server management software — none of which are functional without an active network connection. Yes, my plan was to physically remove the wifi adapter daughter card. They exposed the CA to gigabytes of third-party software before I turned up to do the setup. Yes, I warned them not to even take the computer out of the box. Offline anything just breaks people’s brains. “How do we keep the anti-virus pattern file up to date?” “You don’t.”
- 0cf8612b2e1e 2y agoDo they still make non-USB mice/keyboards? I am also wondering if the CEC HDMI protocol could be exploited. Plugin a nefarious monitor which can send a payload and receive a graphic stream back with the response.
- dreadlordbone 2y agoBoth tools are "stick infected USB into air gapped device"
- stavros 2y agoHow do they get these USB sticks to execute code, though?
- sampullman 2y agoPresumably by taking advantage of an exploit on the host's USB driver.
- gruez 2y agoFrom the linked ESET blog post: >It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm.
- dboreham 2y agoIs it just me that thinks "USB device plugged in" != "airgapped"?? Heck every TV show has someone downloading the nuclear plans off Dr. Evil's laptop by...plugging in a USB device when he's distracted by spilling his coffee.
- lazyasciiart 2y agoYes. https://www.techtarget.com/whatis/definition/air-gapping https://www.techtarget.com/whatis/definition/air-gapping
- cwalv 2y agoNo. If you're going to go thru the effort of air gapping, it should be clear that you need to prevent adversaries from getting physical access as well
- highwayman47 2y agoSo just don’t use USB’s? Article was poorly written - couldn’t even finish it
- bankcust08385 2y agoEvery well-funded nationstate has an "equations group", but it is rare to detect, much less publicize, their actions by design. External buses and RF comms present massive attack surfaces that must be locked down with religious fervor including auditing, disabling, and management.
- bikamonki 2y agoDid I get it wrong or the infection was through USB? I thought it was something related to a remote/wireless attack. Is such attack even possible on air-gapped systems?
- vlovich123 2y agoGiven that air gapped American government machines would be vulnerable to similar techniques, why don’t common operating systems build mechanisms to make this stuff more difficult? * force prompting executing anything off external media * disallow anything other than input devices for USB * disallow unsigned binaries from running * work to require usb peripherals to carry a unique cryptographic signature so that you can easily lock the set of allowed devices once the machine is set up Heck, a lot of this stuff could be valuable to help secure corporate IT machines too.
- night862 2y agoWell none of them are selling a security product. There is basically no security focused pc hardware, aside from maybe raptor systems which isn’t really the same ilk. Off the top of my head, a lot of these devices and hardware were scam traps by LEO. I’d go on a limb and say this isn’t a problem anyone actually wants to solve.
- loa_in_ 2y agoThe complete opposite of the tragedy of the commons
- NooneAtAll3 2y agocomedy of the extinct?
- gnopgnip 2y agoSince 2008 or so all US government computers on SIPR block USB storage devices are unless they are on an approved list. Autorun is disabled. Physical security is another big factor, there is a long checklist for a SCIF that at some level takes into account TEMPEST type threats that mitigate many attacks on air gapped systems. And none of these things are the default on commercial software because users want it to be frictionless. They want software to install right away when you plug in a usb drive, etc.
- 2y ago
- dyauspitr 2y agoI was expecting targeting wireless bit flipping or something. This is a let down.
- codezero 2y agoA lot of comments seem to ignore the possibility that the executor of the file on the USB stick wasn’t also part of the exploit chain. The EU has expelled a lot of diplomats and insiders in the last few years. Why wouldn’t a nation state combine a zero day with a physical asset that can execute it?
- mikewarot 2y agoWhy does anyone run an operating system that grants ambient authority to executables? This is analogous to a power grid stripped of all fuses and circuit breakers to make it easier to design toasters. We've studied this problem since 1972[1]. Solutions were found (but the Internet Archive is down, so I can't be sure [2] points to the right files now). [1] https://csrc.nist.rip/publications/history/ande72.pdf https://csrc.nist.rip/publications/history/ande72.pdf [2] https://web.archive.org/web/20120919111301/http://www.albany.edu/acc/courses/ia/classics/belllapadula1.pdf https://web.archive.org/web/20120919111301/http://www.albany...
- forgot-im-old 2y agoIt used to be you could put a file called autoplay on a USB drive and it would get executed on insertion.
- vifon 2y agoAFAIK it only worked with optical drives, not pendrives. I've spent hours trying to get this functionality on my pendrives back in the day, to no avail (thankfully!). It was on Windows XP, and Windows 98 needed external drivers to even use pendrives at all, so if such an attack vector existed, it must have been on Windows 2000 or Me (i.e between XP and 98), so an arguably very short time frame (if at all!).
- actionfromafar 2y agoYou could/can have the USB device appear as a CDROM
- JD557 2y agoI recall Disk Knight (https://www.lucadamico.dev/papers/malware_analysis/DiskKnight.pdf https://www.lucadamico.dev/papers/malware_analysis/DiskKnigh...) working on Windows XP I don't remember the whole details, but I believe it installed an autorun.inf file on all USB drives so that inserting the drive on another PC would install it automatically.
- 2y ago
- hcfman 2y agoSo running programs by sticking in a USB drive is a critical security bug. Have Microsoft reported this to the European Union within a day? Is Microsoft now going to be fined 2.5% of their turn over now from the Cyber Resilience Act?
- morsch 2y agoThe reporting requirements only come into force 21 months after CRA is enacted, apparently. https://ec.europa.eu/commission/presscorner/detail/en/qanda_22_5375 https://ec.europa.eu/commission/presscorner/detail/en/qanda_...
- forgot-im-old 2y agoPocketAdmin is capable of all that's described here and it's open source! https://github.com/krakrukra/PocketAdmin https://github.com/krakrukra/PocketAdmin
- yellow_lead 2y agoI don't think so. > Next, the infected computer infects any external drives that get inserted. When the infected drive is plugged into an air-gapped system, it collects and stores data of interest. Last, when the drive is inserted into the Internet-connected device, the data is transferred to an attacker-controlled server. This implies the ability to turn a common USB drive into a vector for malware.
- forgot-im-old 2y agoPocketAdmin can be both a HID storage device and a keyboard.
- yellow_lead 2y agoBut a capability of the malware is turning a common USB device into an infection vector. This is not a a capability in PocketAdmin AFAICT
- computerfriend 2y agoI once designed and built an air-gapped system and it did not involve operators plugging USB devices to and from MS Windows machines. (We used data diodes). It is strange to me that a security-conscious organisation such as a ministry of foreign affairs would build an air-gapped system this way. Possibly it's a compliance checklist item from their parent organisation, but with no oversight? The US has "forward deployed" state department personnel that handle information security of embassies and consulates in a standardised way, probably this SE asian country (and the EU organisation) should follow suit.
- varjag 2y agoThe US has a history of major data breaches by low rank IT security personnel throughout multiple branches of the government. A security monoculture is not necessarily a great approach on the balance of things.
- pasiaj 2y ago> Security monoculture is not necessarily a great approach See: Hezbollah & pagers.
- lukan 2y agoThey do and did use many methods of communication and the pagers were just one part of it. Excatly to not be reliant on conventional computers and their insecurities, but seemingly easy and secure devices. They just did not expect the sophistication of the Mossad to hijack the production facilities. (Also their walkie talkies also exploded.)
- zahlman 2y agoMy understanding from the description of the attack is that it didn't rely on any vulnerability in USB, only social engineering made possible by the Windows UI.
- ekianjo 2y agoIs it really considered air gapped if people connect USB drives to such machines? USB is a well known vector for malware
- physicsguy 2y agoIf you’re a startup in the industrial world - this is why connectivity of PLC systems is often viewed skeptically.
- mattlondon 2y agoI worked in a data center situation once where there was a physical switch that disconnected the outside network connection which was turned on only in very special circumstances. The USB ports were filled with super-glue. I always thought that the big switch was probably still a massive vulnerability - is it air-gapped or not? When the switch is flicked it only takes milliseconds for an exploit. Anyway, not sure what happened to those guys in the end.
- phendrenad2 2y agoStuxnet was 14 years ago, guys.
- zahlman 2y agoIt's unclear to me why you believe this is relevant here. This attack indeed uses different tooling, and a completely different attack vector (social engineering via the presentation of a malicious executable in the GUI, as opposed to an auto-run exploit).
- lofaszvanitt 2y agoWell, a proper air gapped system would have zero surface area to the outside world, isn't it? Like desoldered USB/Firewire/whatever ports is a basic thing to do. I had a colocated server where the usbs were neutered this way and had an internal USB riser which had the port removed and facing inwards, so if you took the system apart you could plug in something, but that means offline time. This was more like a controlled environment, but everyone knows that USB/WIFI is a steaming shitpile, with its own firmware and other shit.
- djmips 2y agoHow can they exfiltrate to Google drive on an airgapped machine. Airgapped implies not connected to networks. (This should also include sneakernet!)
- PMunch 2y agoI've been wondering lately how these USB execution attacks happen. Surely no modern system auto-runs things from a USB, so there has to be some kind of executable on the drive which the user of the drive either A. Expects to be there, or B. Doesn't notice is there. A sounds a bit strange, but maybe the system is updated over USB, that means that the hackers got into the update pipeline which is very bad. B might be more likely, create an EXE with the thumbnail of an image and maybe you could trick a user into clicking it. Or maybe some nefarious excel macro. But in this case it's strange that the system allows these things to be executed. Does anyone have more details on how this is done?
- Dibby053 2y agoThere are many ways. A simple way is to simulate a USB hub with an input device and a usb drive. You use the input device to execute whatever is on the drive. Another way is to identify as a device whose driver has some vulnerability. Windows auto-installs that driver, then you exploit it.
- codetrotter 2y ago> simulate a USB hub with an input device and a usb drive Yea but that has to be a custom or specific kind of programmable USB device. Or one that somehow unintentionally allows you to reflash its firmware to something else. And also if anyone ever plugs your malicious USB device into a Mac, they will get a pop-up from macOS that asks you to identify the keyboard. Although maybe if it fakes a specific USB keyboard that macOS knows out of the box, you could avoid that?
- PMunch 2y agoSure, if you're the one who created the USB drive then you could make it not actually a USB drive. But this sounds like an infected machine infecting previously safe USB drives and turn them into malicious ones. And I'm not sure I get how a USB drive can be turned malicious. I vaguely remember there was a bit you could flip in older USB drives to make them appear as disk drives and enable autorun, but I doubt that's how this is done.
- Arch-TK 2y agoI think the things to blame here are the design of Windows and the overall design of the air-gapped environment. Yes, at the end of the day you're going to need to move stuff from non-air-gapped devices to air-gapped devices and vice-versa. You can assume the non-air-gapped devices are completely compromised. But why is the air-gapped device not configured to always show file extensions? This is literally working because Windows is configured to hide common file extensions, and the attack relies on hiding a folder and replacing it with an executable with a folder icon and the same name +.exe. If you're designing an airgapped system, this is literally the first thing you should be worried about after ensuring that the system is actually airgapped. At least windows explorer should have been configured to show extensions (and some training delivered to ensure that the people using these systems have the diligence to notice unusual file extensions with familiar looking icons). It would be even better if the file explorer was replaced with something less easy to fool. Something which does not load custom icons, never hides directories, and maybe even prevents access if the flash drive has indications of shenanigans (unusually named files, executables, hidden folders) which would indicate something weird was going on. It's a good job that unlike with Stuxnet nobody plugged in a flash drive from the literal car park, but this is pretty poor on the part of the people designing/implementing the airgapped environment.
- avidphantasm 2y agoGood point re. Windows’s default configuration being less secure due to file extensions being hidden. This is another manifestation of the continuous tax paid for Windows’s insane level of backward compatibility. I think the root cause is that Microsoft thinks files ending in .EXE are ugly (but they don’t want to stop using this convention, which I don’t think is strictly required by the kernel or filesystem, but would probably break other things in the OS and 3rd party tools), so they hide that and all other file extensions (which maybe they also think are ugly, but I don’t see an alternative since files with multiple data streams are not handled well for interchange). Not sure why the default isn’t just to hide the extension of executable files, though I think this is more trouble than it is worth, for the reasons demonstrated by this attack. I would also consider disabling USB ports in air-gapped systems. You can still buy PS/2 keyboards and mice. Server and maybe some workstation motherboards still have PS/2 ports (and there are PS/2 PCI cards). For sneakernet file transfer you can allow use of an SD card. That way, if you see a USB cable or other device in an air-gapped environment, it should be an immediate red flag.
- fsflover 2y agoThis is exactly why Qubes OS has been developed, with its strong hardware-assisted virtualization. All USB devices belong to a dedicated VM, which is reset every time it's restarted. My daily driver, can't recommend it enough! https://qubes-os.org https://qubes-os.org
- deleted 2y ago[deleted]
- zahlman 2y agoA lot of people ITT don't seem to understand very well what's going on with this attack. The Ars Technica article doesn't seem very well written, but we've had previous discussion[0]. Quick FAQ: > Haven't we known about USB vulnerabilities forever (agent.btz, BadUSB etc.)? The fact that USB devices were used to transfer the files is irrelevant to the attack. The attack doesn't depend on running the malware directly off the USB device, on any kind of auto-run vulnerability, etc. It would have worked out the same way if files had been transferred, for example, by burning them to DVD. The attack only depends on the machines on the non-air-gapped side, being compromised such that the attackers can control what is put onto the USB. But the USB drives themselves are only being used as dumb storage here. The attack instead primarily depends on social engineering that is helped along by the design of the Windows GUI. On the air-gapped machine, the user sees a "folder" which is actually an executable file. By default, Windows hides the .exe file extension (which it uses to determine executability of the file) in the GUI; and the icon can be customized. Double-clicking thus launches the malware installer when it was only supposed to open a folder. The folder has a name that the user expected to see (modulo the hidden extension). It appears that the original setup involves hiding[1] (but still copying) the folder that was supposed to be transferred, and then renaming the malware to match. (Presumably, the malware could then arrange for Windows to open the hidden folder "normally", as part of its operation.) Windows can be configured to show "hidden" files (like `ls -a`), but it isn't the default. Notice that this is social engineering applied only to the process of attempting to view the files - nobody was persuaded to use any storage devices "from outside". > Isn't that, like, not actually air gapped? The definition of an air gap generally allows for files to be passed across the air gap. Which is all the attack really depends on. See also "sneakernet". The point is that you can easily monitor and control all the transfers. But this attack is possible in spite of that control, because of the social engineering. > How is it possible to exfiltrate data this way? The actual mechanism isn't clearly described in media coverage so far, from what I can tell. But presumably, once malware is set up on the air-gapped machine, it copies the files back onto the USB, hiding them. When the device is transferred back to the non-air-gapped side, malware already present there monitors for the USB being plugged in, retrieves the files and uploads them (via the "GoldenMailer" or "GoldenDrive" components) elsewhere. [0] https://www.welivesecurity.com/en/eset-research/mind-air-gap-goldenjackal-gooses-government-guardrails/ https://www.welivesecurity.com/en/eset-research/mind-air-gap..., via https://news.ycombinator.com/item?id=41779952 https://news.ycombinator.com/item?id=41779952. [1]: Windows file systems generally don't have an "executable bit" for files, but do have a "hidden bit", rather than relying on a leading-dot filename convention. So it's the opposite of what Linux does.