13 ms·
I made my VM think it has a CPU fan
- gazatunnelrats 1y ago[flagged]
- lpapez 1y agoUsing such tricks might seem like a cute way for malware to make analysis difficult, but often times calling these obscure system APIs can be detected statically, and you bet that it will flagged as suspicious by AV software. If the malware binary is not obfuscated to hide such calls, I'd even call them "counterproductive" for the malware authors! The legit programs interested in these APIs are almost always binaries signed by well known (and trusted) CAs - making it sensible for the analysis to report sus behavior. I worked as a junior in this field, and one of my tasks was to implement regex pattern matching to detect usages of similar APIs. Surprisingly effective at catching low hanging fruit distributed en masse.
- amelius 1y agoSo, from a security perspective, maybe we should run all software inside a VM then?
- neoromantique 1y agoQubes OS exists
- jbverschoor 1y agoThat’s how the Xbox works too
- keyringlight 1y agoIIRC the xbox one onwards (switching from PowerPC to AMD x86) gave them synergy with AMD's efforts to push hard into servers with virtualization, as well as MS pushing Azure
- boricj 1y agoWe wouldn't need to if we used capability-based operating systems.
- immibis 1y agoEvery app would have a long permissions dialog. Every app would want to read your CPU fan for no good reason (just as another piece of fingerprint) so you'd get use to clicking accept so you could use any apps at all. The malware would still get through. This already happened on mobile.
- JadeNB 1y ago> This already happened on mobile. It happened on mobile because Android (dunno iOS's permission model well enough) is more on the developers' side than the user's side, or at least they're more concerned with everything just working (for some values of "just work") than with giving users a chance to make sure that things don't work that the users don't want to work. A fine-grained capacity system where users were given the option to lie to the software about what capacities it has wouldn't be perfect either, but it would remove a lot of the user-focused pain points of Android's permission model.
- Loranubi 1y agoIt would be a non issue, if the options are not just allow/disallow, but also offer to provide random/fake data, so bad apps would not actually know if the permission is allowed or if the data is fake.
- eddythompson80 1y agoThat leaves you vulnerable to side channel attacks. From a security perspective, we shouldn’t run software at all, but if you have to, just use AWS Lambda.
- amelius 1y agoWhat kind of side-channel attacks? You mean caching-related?
- tclancy 1y agoMy response is in the queue, please be patient.
- eddythompson80 1y agoI want it and I want it now. Screw your event based system
- jeroenhd 1y agoYou'd lose things like hardware acceleration. That said, plenty of malware will stop downloading additional modules or even erase itself when it detects things that could indicate it's being analysed, like VirtualBox drivers, VMWare hardware IDs, and in the case of some Russian malware relying on the "as long as we don't hack Russians the government won't care" tactic, a Russian keyboard layout. It won't stop less sophisticated malware, but running stuff inside of a VM can definitely have viruses kill themselves out of fear of being analysed.
- OneDeuxTriSeiGo 1y ago> You'd lose things like hardware acceleration. This is increasingly less true. SR-IOV and S-IOV are becoming increasingly common even in consumer hardware and OS manufacturers are increasingly leaning on virtualisation as a means to protect users or provide conveniences. WSL has helped with virtualisation support quite a bit as a means of getting hardware manufacturers to finally play nice with consumer virtualisation. And Microsoft is even now provides full ephemeral Windows VM "sandboxes". The feature that came with them that surprised me was that they support enabling proper GPU virtualisation as well.
- AshamedCaptain 1y agoBut then you have your "VMs" accessing the real hardware, so the benefits of the VM reduce if not disappear. You literally can't have the cake and eat it too.
- OneDeuxTriSeiGo 1y agoNot entirely? The virtualised PCIE frameworks (SIOV, SRIOV, etc) don't actually give direct access to the hardware but rather create a virtualised device inside the PCIE device akin to how modern PCs virtualise CPUs and memory.
- AshamedCaptain 1y agoWell, that's precisely the point of these frameworks. They give direct access to the hardware in order to gain the speed advantages of ... directly accessing the hardware. The PCIe aspect of this is just (very high level description) a way to let the hardware know what VM is making the request. You're now at the mercy of the hardware manufacturer on whether there's isolation between the different "partitions" or ... nothing at all. Your attack surface expands in a way that's difficult to imagine.
- jeroenhd 1y agoMalware is signed surprisingly often these days, you can't rely on malware companies not to sign their binaries anymore. Hacked code signing certificates seem to be all over the place and Microsoft seems very reluctant to revoke trust out of fear of actually breaking their original customers' software. Same goes for the common vulnerable drivers that malware likes to load so they can get into the kernel. A weird tiny binary making WMI calls may stand out, but a five year old overclocking utility full of vulnerabilities doing the same queries wouldn't. From the research I've read, this doesn't seem to be about avoiding detection as much as it's about not detonating the real payload on a malware analyst's machine. If the AV flags the binary or the detection trips, the second stage isn't downloaded and the malware that does stuff that makes the news doesn't execute (yet).
- gruez 1y ago>Hacked code signing certificates seem to be all over the place and Microsoft seems very reluctant to revoke trust out of fear of actually breaking their original customers' software. AFAIK most (all?) code signing CAs are cracking down on this (or maybe Microsoft is pushing them) by mandating that signing keys be on physical or cloud hosted HSMs. For instance if you try to buy a digicert code signing certificate, all the delivery options are either cloud or physical HSMs. https://www.digicert.com/signing/code-signing-certificates https://www.digicert.com/signing/code-signing-certificates
- Deathmax 1y agoIt's a change to the CA rules that was passed in https://cabforum.org/2022/04/06/ballot-csc-13-update-to-subscriber-key-protection-requirements/ https://cabforum.org/2022/04/06/ballot-csc-13-update-to-subs... to align OV certificate requirements with the EV ones (that enforces the use of HSMs/hardware tokens/etc) that was meant to go into effect for new certificates issued after November 2022, but was delayed and eventually implemented on June 1 2023.
- dom96 1y agoAnti virus software just guessing what is and isn’t malware by analysing static calls is actually really annoying. If you’re doing that then why not just make an allow list of trusted software and mark any software not in that list as being malware. It’ll work just about the same.
- mystified5016 1y agoThat's pretty much exactly how it works now. We instead analyze programs and guess that they're safe. Well, after we send a copy of the program to Microsoft, of course
- xyst 1y agoThe trick is to become a company like "CrowdStrike", get your crappy software that runs at kernel level signed, then you can run all of the "suspicious" calls to sys apis all you want. Forget determining if it’s a VM or not. Just push untested code/releases on production machines across all of your customers. Then watch the world burn, flights get delayed, critical infrastructure gets hammered, _real_ people get impacted. _Legitimate_ companies have done more damage to American companies than black hat hackers or state actors can ever dream of. The folks behind xz util within libzma aspire to cause the amount of damage companies like ClownStrike and SolarWinds have caused.
- AshamedCaptain 1y agoI am yet to see _any_ consumer-oriented motherboard where SMBIOS descriptions have even a passing relationship to the actual hardware. I would not be surprised if this malware would also fail in 50% of real hardware out there. But I also guess malware can afford this failure rate; as long as it guarantees it also fails on 100% of VMs/debuggers, it is worth it. But if these assumptions are true then I'd presume malware authors would do timing checks rather than the trivially "emulable" SMBIOS.
- msgodel 1y agoHow does Linux find the fans these days? Is it an ACPI/EFI thing now? Nearly all my machines seem to have correct fans/sensors.
- surajrmal 1y agoYes acpi is far more reliable.
- AshamedCaptain 1y agoThrough a bazillion of practically motherboard-model-specific hacks: https://lxr.linux.no/#linux+v6.7.1/drivers/hwmon/ https://lxr.linux.no/#linux+v6.7.1/drivers/hwmon/
- baby_souffle 1y ago> I am yet to see _any_ consumer-oriented motherboard where SMBIOS descriptions have even a passing relationship to the actual hardware. This seems to be especially true for cheap chineese boxes. If I had a dollar for every time I saw "to be filled in by OEM" strings in "live/production" BIOS images ... i'd be retired :).
- smileybarry 1y agoI’m fairly sure my expensive ASUS ROG motherboard (ergo: not even their budget line) also had a “to be filled in by OEM” string that I couldn’t even override. (ASUS have a utility but it’s not publicly available, probably just for computer shops)
- wkat4242 1y agoHuh so new antimalware tactic: Buy passively cooled PC :) And also set up a Russian keyboard: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
- dale_glass 1y agoPassively cooled PC probably won't work because the board will still have fan headers even if nothing is connected to them.
- dom96 1y agoSo we just need to implement the opposite of what OP has on our PCs, i.e. make OS think there are no fans.
- wkat4242 1y agoYes and another method of controlling them.
- syntaxfree 1y agoExternal cooling device?
- theodric 1y agoThe computer knows there's a fan because it sees tacho output. If it doesn't see tacho, shrug. You can get an external temperature-controlled PWM controller for a few units of your local currency on AliExpress, steal 12V from somewhere (Molex header or whatever) and run the fans off that. Figure out where to put the temp sensor to get the desired effect. There are far better ways to do this, but they require software engineering, not €3 and 15 minutes.
- mananaysiempre 1y ago
- peter422 1y agoPretty funny that a blog post talking about complex and innovative ways to help investigate malware has a block of the lowest quality, scummiest ads that probably lead to malware.
- ajd555 1y agoI wonder if making a user endpoint actually look like a VM could help? Maybe adding some VM like flags to throw off some malware? I feel that bad actors would catch on, but it might offer some protection for some low hanging vulnerabilities?
- staplung 1y agoThat’s nothing. I make my VMs think they have dust.
- brcmthrowaway 1y agoWhat an arcane piece of tech. Why not use EFI?
- jmkni 1y agoHang on, does this mean the MacBook Air is less vulnerable to some malware?
- b0a04gl 1y agoMitre ATT&CK's T1497.001 (VM Detection) lists SMBIOS checks as a known vector means its open for injection anyways. i did one little expirement on faking VM's powersupply. done it with 'HotReplaceable=Yes' and 'Status=OK', and you suddenly look like a $5k baremetal server. cmd used pip install dmigen dmigen -o smbios.bin \ --type0 vendor="American Megatrends",version="F.1" \ --type1 manufacturer="Dell Inc.",product="PowerEdge T630" \ --type39 name="PSU1",location="Bay 1",status=3,hotreplaceable=1
- dragonwriter 1y agoFYI: You need two line breaks to force an actual break on HN, or you need to indent each line by two to force code mode.
- joseda-hg 1y agoThis has always striked me as a weird choice, out of all places, one would think the generally computer savvy and technical "forum" would respect formatting as inputted, specially with how often code is discussed
- snickerdoodle12 1y agoWhat's up with the body shaming in this article? > But that’s smol pp way of thinking
- redundantly 1y agoBecause they think it's funny. Personally, I just found it off-putting and stopped reading.
- Footprint0521 1y agoAin’t no way, that was my favorite part
- benatkin 1y agoHas me picturing the author ambling down the road in a truck with a penguin bumper sticker alongside another adornment attached to the trailer hitch...
- ksenzee 1y agoEvery once in a while I manage to forget I’m a woman in a space that’s not friendly to women, and then I come across something like this.
- Smithalicious 1y agoI don't think "smol pp" is meant to be unfriendly to women, but it's telling that men are expected to self-police such utterly innocuous jokes when women are present even though you couldn't find a phrase less applicable to women if you tried.
- ksenzee 1y agoOh I'm sure it's not meant to be unfriendly to women. It's meant to be unfriendly to men, who are the only people reading the article, in the author's mind. You do see the problem, yes?
- marcosscriven 1y agoFascinating article. It prompted two questions for me: 1) With the level of expertise, would it be as easy, or easier, to modify the check in the malware itself? 2) How much work would it be for a something like KVM to fake absolutely everything about a PC so it was impossible to tell it was a VM?
- acrophiliac 1y agoMisread the title as "I made my VM think it WAS a CPU fan" and was a bit disappointed to find the actual article was not about a VM with an identity crisis.
- 1vuio0pswjnm7 1y agoI haven't bought a computer cooled by a fan in over 13 years.
- marttt 1y agoIf you don't mind sharing, what's your exact setup? Fanless laptop (having read many of your previous comments - and found them very inspring -, I'm aware of your modest/text-only needs) or something really spartan like a USB-booting OS, etc? Many thanks.
- deleted 1y ago[deleted]
- userbinator 1y agoThis reminds me of how having the right SMBIOS was necessary to create a working Hackintosh. There are so many of these relatively obscure APIs which have been added to the PC over the years, which are often overlooked by those writing virtualisation software, and malware and other VM detection software often tries to poke at them to see how real they look. A next step to making the VM look real is having simulated temperature sensors that actually change in response to CPU load.
- taftster 1y ago> simulated temperature sensors that actually change in response to CPU load. Or maybe just increments to absurd numbers or negative values. Or locks up when probed. Either way could be fun.
- aruametello 1y ago> Or maybe just increments to absurd numbers or negative values. Or locks up when probed. unironically that would mimick a bunch of existing hardware out there. I owned a PC motherboard that always reported a -65535c in a non existing sensor. my guess is some sensor described but non existing, probably reporting an infinite value of resistance of some unused pin...
- TacticalCoder 1y ago[dead]
- ChuckMcM 1y agoI friend of mine in the infosec business spends most of their time (it seems to me) to make their malware honeypots super representative of their respective hardware. Whether its a windows XP based thermostat, a Siemen's PLC controller, or a banker's desktop PC, its kind of amazing the things they do.
- malfist 1y agoI surely hope there are no windows XP thermostats.
- ChuckMcM 1y agoDon't buy your HVAC systems from Crane.
- comboy 1y agoCuriosity got the better of me: https://www.crestron.com/Products/Catalog/Inactive/Discontinued/T/TPMC-8X https://www.crestron.com/Products/Catalog/Inactive/Discontin...
- malfist 1y agoMy home builder tried to get us to use crestron and we noped out of that. Their stuff feels like it's a relic of the X10 days and has bonkers price tags. A single lightswitch that can dim is $200-$300 from them. And that doesn't include the hub to control things that costs (IIRC) $2-$3k. In comparison, a lutron switch is $70 and the hub is $50.
- 83 1y agoI wouldn't consider a Lutron light switch to be a direct comparison to Crestron. Crestron targets the ultra wealthy by being very reliable (assuming setup by a competent programmer) with unified control of pretty much everything household - shades, lights, audio, video, etc. They're aiming for the kind of people who will pay a premium to make sure their house just works, every time, without having to deal with tech issues. You could certainly bodge together a similar system for less money, but the controls won't be as nice and it'll be nowhere near as hassle free long term. HomeAssistant and competitors have really been catching up in the past few years though, i'm excited to see competition in the market. I wish they could all play nice together with reasonable APIs :/
- thaumasiotes 1y ago> Frankly, I did not miss this at first. I just hoped that what I was trying to do was not “overriding” the predefined structure. > Because Xen (or rather hvmloader) does not define it. > So, before defining it myself, I tried to find out if there was any other poor soul who tried to do the same thing before me. And to my disappointment, there was. Right in the xen-devel patch archive. > Why it was my disappointment, you may ask? Because after reading the response to the patch, I felt the frustration of the author. Specifically, the patch is annotated "SMBIOS tables like 7,8,9,26,27,28 are ne[c]essary to prevent sandbox detection by malware using WMI-queries." And the rejection is in two points: (1) Why is that valuable? (2) What if there were other tables that also helped with that goal? Your patch doesn't include them.
- AceJohnny2 1y ago> (2) What if there were other tables that also helped with that goal? Your patch doesn't include them. If there's anything I've painfully learned in my career, is to not let perfect get in the way of good enough.
- jeffrallen 1y agoThere's lots of interesting things in dmidecode, including the asset tag of the machine. If anyone is interested, on both Lenovo and Super micro servers you can set the asset tag. Lenovos do it with Redfish, with Supermicros, you have to use their "sum" tool. Using it, you can also modify the model name and serial number of your Super micro motherboard. Which cam be useful when your idiot system integrator can't be assed to set them correctly themselves.
- dheera 1y ago> Some malware samples are known to do various checks to determine if they are running in a virtual machine. Not just malware, but some apps are known to do this too, e.g. WeChat. There needs to be a better virtual machine that tries to emulate everything, including random walks for GPS, IMU noise, barometric noise, temperature fluctuations etc.
- Grimblewald 1y agoI feel like we could make our operating system more secure and make things easier for researchers by simply making a normal OS look like a virtual machine. Any program that needs to access resources in a non-virtualized way would have to ask for permission first. If granted, it could then see the relevant information or access the necessary APIs. This way, malware authors would have to choose between making things easier for researchers or targeting far fewer people. Either way, everyone except the malware creators wins.
- bear8642 1y ago> simply making a normal OS look like a virtual machine Or perhaps the other way around? That is making VMs totally unaware they've been virtualised, as I believe IBM's lpars work…
- Grimblewald 1y agoIf that were easy, this article wouldn't exist.
- crazygringo 1y agoThat doesn't seem like it would be possible, if you want all the convenient hooks in VM's for them to be able to integrate with and be usable from the host system. The solution really does seem like implementing those same hooks in non-VM environments, but preventing their actual usage behind permissions. In a VM, the permissions could genuinely be granted or denied. In a non-VM they would always be denied. But malware could never be able to tell why it was denied permission.
- orthoxerox 1y agoAnti-cheat software vendors would lose as well. I prefer the software I run to know its place, but there are enough people who enjoy multiplayer games that hate cheaters more than they hate what amounts to spyware.
- mattigames 1y ago
- photon_garden 1y ago[flagged]
- whall6 1y ago[flagged]
- naikrovek 1y ago[flagged]
- whall6 1y agoHasn’t failed yet!
- naikrovek 1y agoyou are proving my point better than i ever could, so please continue.
- cyanydeez 1y agoThis is the internet. If you haven't learned from the last 10 years, you should have noticed caring _less_ about random people on the internet is healthier than trying to change any and everything, regardless of how smol. You're going to burn out very quickly if this is the level of attention and engagement you desire in the world of the internet.
- naikrovek 1y agoI know what it is. It is a virtual civilization populated by people, the worst species ever known to exist. And it is in this virtual civilization where people reveal their true colors, because there is no punishment for doing so. So here, you see the real identity of humanity. The real people who are underneath the facades of the people you interact with in real life. And it's clear that the people, as they really are, are all despicable and horrible inside. thanks for the pep talk, coach, but you're not my coach and i didn't ask for any coaching. i know what i'm dealing with. i've probably been on the internet longer than you've been alive, so i've watched the internet go from a fairly healthy place to just pile after pile of shit everywhere people interact with each other online. i've watched more and more people show up solely so they can be themselves, and more and more places appear solely for people to be unreastrainable asses to each other.
- naikrovek 1y ago[flagged]
- jojobas 1y agoOf everything going on at the moment, like senseless wars, countries plagued by mass child abuse or forced organ harvesting, you chose to question the humanity's worth because of a smol pp joke?
- naikrovek 1y ago[flagged]
- alexey-salmin 1y agoAll these problems that make you think we deserve extinction, they can't really be fixed in 30 seconds I suppose ? If so, why do you critique everyone so hard that you wish them dead?
- naikrovek 1y agoI don't wish any individuals dead, i have no ill will towards anyone in particular, but individuals do demonstrate the traits of our species that i despise, so i always bring this up in response to individuals. If you can show me where i can respond to the species as a whole, please do, and i'll direct myself there. I wish for our entire species to go extinct, not individual people. Why? we are just inherently destructive to each other. we are super flawed in that way, and I don't see us lasting the amount of time it would take for that to evolve out of us. I do see our awful instincts lasting long enough for some future world war three to reduce the population to a small enough amount where being assholes to each other again becomes a survival tactic that works, so this likely won't ever evolve out of us naturally. Also, in order for it to evolve out of us, we would have to select it out and not allow those who are regularly assholes to each other to breed, and that won't work for a number of reasons. I'm not for society selectively neutering people for any reason, anyway. We are competitive to a point that it is well past anything that the word "flaw" could cover. we are self-destructive, and we let tiny disagreements get us to the point of war. we are just a garbage species. deep down we all know it, i just happen to mention it for some reason.
- benreesman 1y agoThis has applications for other kinds of malware. I used to work in ads, to put it mildly, and all this stuff about blocking the trackers at the DNS level or something? Very silly stuff. If you want to fuck up surveillance capitalism, you send plausible but wrong information to the trackers. There are a zillion ways to do this: let one through now and again and replay it, do a P2P browser extension that proxies you and someone near you through each other, subtly corrupt it, bounce it off a mullvad node. The possibilities are endless. If you got a fair number of people doing it, you could even have some collective bargaining, like let some of the extreme value conversion stuff through in return for concessions on the more egregious tracking-for-the-sake-of-tracking. Sure they'll checksum and shit, but that's a cat-and-mouse game they lose: the typical tracker cookie fire isn't worth shit, it's Superman 2 fractions of a basis point, so even modest effort playing smart against it drives the effective CPM negative.
- joseda-hg 1y agoisn't this what initiatives like Ad Nauseam do?
- djmips 1y agoWhen I was a teen and made a malware for the Apple II : I could inoculate disks by putting the hex value $50 in an unused place of the VTOC that was stored on disk. $50 is P which stands for Parasite. This was before the word virus had taken hold and I called my program a parasite. I could prevent the parasite from infecting my and my friends DOS disks with this benign change.
- rustybolt 1y ago> Your first impulse might be to use DLL hooking and patch the cimwin32. But that’s smol pp way of thinking. We can do better. What's wrong with DLL hooking though?
- 0points 1y agoLovely writeup! 10/10
- 0791444520 1y ago[flagged]
- emilfihlman 1y agoI wonder if this could be used to throttle vms, like I'd like to set something like "this vm can only use at most x% of a cpu" measured over y time.
- wonderwonder 1y agoThere are moments where I consider myself a good engineer and then I read posts like this and realize im a very little fish in a very big ocean
- andix 1y agoI guess that's a gap for a new tool to be developed. Emulate as much hardware as possible, to make a VM look like a real PC. Maybe also faking the CPU ID, to fake another CPU type with less performance (from the same series), so malware can't even detect the lower performance caused by virtualization, or lower core count.
- JamesSwift 1y agoAlso see the effort people go through to fake out minecraft/roblox so they can run via a VM
- ge96 1y ago> smol pp way of thinking apt install laugh