4 ms·

Some of dragosr's claims/suspicions come off as next to impossible. I think he could use a healthy dose of Occam's razor. Never the less, this does sound like

Some of dragosr's claims/suspicions come off as next to impossible. I think he could use a healthy dose of Occam's razor. Never the less, this does sound like a nasty piece of malware.

gnaffle 13y ago
If not impossible, at least very strange that he has not done more research to verify this (would be easy to do with an oscilloscope attached to the speaker output). Seems like trolling or some form of paranoia.
- puzzlingcaptcha 13y ago
  Dumping the BIOS also comes to mind.
  - mschuster91 13y ago
    How are you supposed to dump it? It's like hacking slot machines: you can always make a rootkit which returns exactly the data you're expecting...
    - delroth 13y ago
      Using any random quad-SPI programmer and soldering it to the chip that contains your BIOS. If dragosr is suspecting a BIOS malware, I can't understand that he hasn't done that yet. From what I've read on his Twitter and Facebook account, he would have spent 3 years investigating this malware and is just now thinking of dumping the ROM of his "infected" USB devices. Smells fishy to me.
      - yiedyie 13y ago
        What if the BIOS code dynamically compresses/decompresses crypts/decrypts code and data? You then put the code on another machine and you are in the same situation, it seems to me like a vicious circle if you don't know where to cut.
        lcampbell 13y ago
        Presumably that's atypical behavior for a BIOS, so an analysis of the dumped firmware should turn up where it's getting the location of and method to decode the data. That would give you enough to keep digging.
        delroth 13y ago
        That sounds fairly unlikely (the BIOS does executes some code from PCI devices, but he says this happens on a machine without any weird PCI device, and PCI ROMs can be dumped too). We would not have to discuss whether this is the case if BIOS dumps turned out to be different. The issue is that 3 years after discovering the malware, he hasn't even tried to dump his BIOS. Compression and encryption at this stage would be obfuscation more than anything else, and it's the job of malware researchers to break these kind of obfuscation layer. But again, we have no proof of this even being present. The BIOS is not a black box that can't be analyzed.
    - gnaffle 13y ago
      With many (most?) desktop motherboards, the flash chip is desolderable and can usually be taken out and read on a dedicated flash reader if you have the equipment. There would be no way for the rootkit to bypass that.
    - puzzlingcaptcha 13y ago
      You can, you know, remove it and dump it with an eprom/flash programmer...
      - mschuster91 13y ago
        Yet, even these programmers are not directly wired to the transistors holding the individual bits and bytes. I would not be surprised if there's a way to manipulate the internal logic of an EEPROM chip, too.
nknighthb 13y ago
> Some of dragosr's claims/suspicions come off as next to impossible. Which ones? The technical aspects are all known to be practical. The only thing odd is that a reasonably sophisticated and determined attacker is seemingly targeting him specifically and no one else.
- 300bps 13y ago
  Please explain this one: Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed
  - nknighthb 13y ago
    It is explained. HF audio via speakers and microphones. In other words, a modem. Your username is highly ironic.
    - deleted 13y ago
      [deleted]
      - nknighthb 13y ago
        > Are you just assuming these are laptops with a battery? Did you even read the article? It's a laptop. That would be the safe assumption, anyway. Laptops far out-stripped desktop sales years ago, they're what most work happens on now. > And saying that computers are communicating by speakers and microphones over long distances (i.e. > a few inches) is patently ridiculous. It's not. I've done it myself. Go grab a couple laptops and some PSK31 software and you can do it, too.
    - 300bps 13y ago
      My main question was regarding the power cords not being plugged in but apparently these are laptops. As for communications via speakers and microphones, that makes as much sense as any other outrageously insane theory I've ever heard.
gmuslera 13y ago
If the BIOS (or some commonly used FPGA) already have builtin some kind of backdoor could be used for this. Now, if it was over a hardware backdoor in so many models it should be pretty widespread. http://blog.erratasec.com/2012/05/bogus-story-no-chinese-backdoor-in.html http://blog.erratasec.com/2012/05/bogus-story-no-chinese-bac... http://news.softpedia.com/news/Secret-3G-Radio-in-Every-Intel-vPro-CPU-Could-Steal-Your-Ideas-at-Any-Time-385194.shtml http://news.softpedia.com/news/Secret-3G-Radio-in-Every-Inte...

Some of dragosr's claims/suspicions come off as next to impossible. I think he could use a healthy dose of Occam's razor. Never the less, this does sound like a nasty piece of malware.

gnaffle 13y ago

If not impossible, at least very strange that he has not done more research to verify this (would be easy to do with an oscilloscope attached to the speaker output). Seems like trolling or some form of paranoia.

puzzlingcaptcha 13y ago
Dumping the BIOS also comes to mind.
- mschuster91 13y ago
  How are you supposed to dump it? It's like hacking slot machines: you can always make a rootkit which returns exactly the data you're expecting...
  - delroth 13y ago
    Using any random quad-SPI programmer and soldering it to the chip that contains your BIOS. If dragosr is suspecting a BIOS malware, I can't understand that he hasn't done that yet. From what I've read on his Twitter and Facebook account, he would have spent 3 years investigating this malware and is just now thinking of dumping the ROM of his "infected" USB devices. Smells fishy to me.
    - yiedyie 13y ago
      What if the BIOS code dynamically compresses/decompresses crypts/decrypts code and data? You then put the code on another machine and you are in the same situation, it seems to me like a vicious circle if you don't know where to cut.
      - lcampbell 13y ago
        Presumably that's atypical behavior for a BIOS, so an analysis of the dumped firmware should turn up where it's getting the location of and method to decode the data. That would give you enough to keep digging.
      - delroth 13y ago
        That sounds fairly unlikely (the BIOS does executes some code from PCI devices, but he says this happens on a machine without any weird PCI device, and PCI ROMs can be dumped too). We would not have to discuss whether this is the case if BIOS dumps turned out to be different. The issue is that 3 years after discovering the malware, he hasn't even tried to dump his BIOS. Compression and encryption at this stage would be obfuscation more than anything else, and it's the job of malware researchers to break these kind of obfuscation layer. But again, we have no proof of this even being present. The BIOS is not a black box that can't be analyzed.
  - gnaffle 13y ago
    With many (most?) desktop motherboards, the flash chip is desolderable and can usually be taken out and read on a dedicated flash reader if you have the equipment. There would be no way for the rootkit to bypass that.
  - puzzlingcaptcha 13y ago
    You can, you know, remove it and dump it with an eprom/flash programmer...
    - mschuster91 13y ago
      Yet, even these programmers are not directly wired to the transistors holding the individual bits and bytes. I would not be surprised if there's a way to manipulate the internal logic of an EEPROM chip, too.

nknighthb 13y ago

> Some of dragosr's claims/suspicions come off as next to impossible. Which ones? The technical aspects are all known to be practical. The only thing odd is that a reasonably sophisticated and determined attacker is seemingly targeting him specifically and no one else.

300bps 13y ago
Please explain this one: Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed
- nknighthb 13y ago
  It is explained. HF audio via speakers and microphones. In other words, a modem. Your username is highly ironic.
  - deleted 13y ago
    [deleted]
    - nknighthb 13y ago
      > Are you just assuming these are laptops with a battery? Did you even read the article? It's a laptop. That would be the safe assumption, anyway. Laptops far out-stripped desktop sales years ago, they're what most work happens on now. > And saying that computers are communicating by speakers and microphones over long distances (i.e. > a few inches) is patently ridiculous. It's not. I've done it myself. Go grab a couple laptops and some PSK31 software and you can do it, too.
  - 300bps 13y ago
    My main question was regarding the power cords not being plugged in but apparently these are laptops. As for communications via speakers and microphones, that makes as much sense as any other outrageously insane theory I've ever heard.

gmuslera 13y ago

If the BIOS (or some commonly used FPGA) already have builtin some kind of backdoor could be used for this. Now, if it was over a hardware backdoor in so many models it should be pretty widespread. http://blog.erratasec.com/2012/05/bogus-story-no-chinese-backdoor-in.html http://blog.erratasec.com/2012/05/bogus-story-no-chinese-bac... http://news.softpedia.com/news/Secret-3G-Radio-in-Every-Intel-vPro-CPU-Could-Steal-Your-Ideas-at-Any-Time-385194.shtml http://news.softpedia.com/news/Secret-3G-Radio-in-Every-Inte...