4 ms·
Explain to me how a non-infected machine would receive and process data from an audio channel so that it ends up interpreted as code and executed. Yes, back in
by btbuildem 13y ago
Explain to me how a non-infected machine would receive and process data from an audio channel so that it ends up interpreted as code and executed.
Yes, back in the day of computers with rubber keyboards, software was recorded on audio tapes, and you could listen to a program loading (sounded basically like a prolonged modem handshake). But even on devices specifically designed to receive data this way, you still had to initiate the procedure. There was code already on that machine that processed the audio stream, loaded it into memory and called the initial JMP.
If I put my tinfoil hat on, I could speculate that yes all the hardware has been made in China for decades, and yes nefarious forces could have very well implemented an always-on listening layer, which by the power of copypasta has now spread to every BIOS-having device, and now it lay in wait waiting for D-day when all your base are belong to us.
TL;DR: the audio attack vector would be like causing a buffer overflow by whistling the right tune into a microphone. This seems impossible without the machine already being compromised.
- 3JPLW 13y agoAdmittedly, the article isn't very well written, but it says that Dragos believes the malware to be installed through USB firmwares. Only after that does it communicate with other compromised systems via audio. Supposedly. The malware, Ruiu believes, is transmitted though USB drives to infect the lowest levels of computer hardware
- teilo 13y agoThat's not what the article claims at all. He's claiming the audio is used to maintain a network connection for command-and-control continuity using other already-infected machines: "Ruiu said he arrived at the theory about badBIOS's high-frequency networking capability after observing encrypted data packets being sent to and from an infected laptop that had no obvious network connection with—but was in close proximity to—another badBIOS-infected computer. The packets were transmitted even when the laptop had its Wi-Fi and Bluetooth cards removed. Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility it was receiving signals over the electrical connection. Even then, forensic tools showed the packets continued to flow over the airgapped machine. Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped."
- btbuildem 13y agoThanks, I missed that!