7 ms·

What triggers my skepticism is * "Ruiu said he plans to get access to expensive USB analysis hardware" -- I'm not an expert on USB, but I do believe it should

by marijn 13y ago

What triggers my skepticism is * "Ruiu said he plans to get access to expensive USB analysis hardware" -- I'm not an expert on USB, but I do believe it should be trivial to tap the traffic between a machine and such an infected stick, and compare it to what should normally be happening. * No effort seems to have been made to capture the sound waves made by this (supposedly reproduceable) high-frequency audio networking. * The infected bios hasn't been dumped and compared to the bios the machine was supposed to have. * For some reason, there's no mention of other researchers getting access to or investigating infected machines and usb sticks. These are all extremely basic steps that could be taken to make the story go from vague conjecture to actual proof (or disproof). Why weren't they taken?

aktiur 13y ago
Apparently he did make a recording of the output (second last comment on this G+ publication https://plus.google.com/u/0/103470457057356043365/posts/3reWRqDMbn4 https://plus.google.com/u/0/103470457057356043365/posts/3reW... )
- marijn 13y ago
  Interesting. Let's hope it's more conclusive than the clean windows files he provided before. [edit]: That comment is two days old, and the files were not provided publicly, he just says he is analyzing them himself. Again, needless obscurity.
dangero 13y ago
Yes, a hardware USB bus analyzer could record the entire usb session from when you plug it in to when you unplug. You'd think any researcher would have one of those considering they cost well below $2000 http://www.totalphase.com/products/beagle_usb480/ http://www.totalphase.com/products/beagle_usb480/ http://www.saelig.com/category/UA.htm http://www.saelig.com/category/UA.htm The other thing suspicious is the manner of troubleshooting: "Even then, forensic tools showed the packets continued to flow over the airgapped machine. Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped." Hold on a second. What forensic tools were showing packets flowing? If he's saying that a software application on an infected machine showed "packets flowing"? That doesn't mean any data was actually going to and from the machine. That could even mean that the virus just simulates data transfer. Did he try putting tin foil around the machine to block any space signals that might be beaming down? I'm not sure if it's the researcher or the ars writer who doesn't know what they are talking about.
- Zancarius 13y ago
  What about this part: > Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed. When I read that, I had to check the date to make sure this wasn't posted on April 1st. That seems completely implausible, unless the author completely misunderstood some information relayed to him. There's something (okay, several things) about this entire article that just screams April Fools. Edit: The additional information others have posted here regarding malware in USB controllers seems far more likely and that the article itself was written as a ridiculously implausible story until the very end where it alludes to the notion that nearly the entire first 2/3rds is completely false. I guess I would've expected better of Ars.
  - chrischen 13y ago
    It was explained the speakers were used. How is that implausible? The computers were laptops with batteries.
    - Zancarius 13y ago
      Because it doesn't explain that the system was a laptop until toward the end of the article: > Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility it was receiving signals over the electrical connection. To be fair, the Ars piece is poorly written IMO and makes some very outrageous claims throughout the first half. And I personally find the speaker-microphone route implausible given how difficult that would be. Even the article stakes a claim that it's very difficult to prove: > It's even harder to know for sure that infected systems are using high-frequency sounds to communicate with isolated machines Given the variable quality of speakers and microphones on laptops and other devices, it doesn't seem like a viable route to me, and this is resting far too much on speculation and conjecture to be of any use. Worse, I haven't yet found anything in the article that suggests every infected machine had a speaker/microphone combination. There's just not that much useful information, hence why this sounds more like a scare piece. I'm finding myself more and more in agreement with other comments here that have suggested it was probably a reckless use of an infected USB device that wasn't properly ruled out. Edit: I should also note that if they're so suspicious that the systems are transmitting sound to other non-infected machines, it shouldn't be too difficult to prove/disprove this by recording sound in isolation. The problem is IMO given the variable manufacturers of sound devices, drivers, and so forth, the complexity of this would be such that it'd be nearly impossible. An infected USB device makes much more sense and is a simpler explanation.
RazorOfOccam 13y ago
For what it's worth, he has dumped several files, including the ME firmware, which have all been found to be clean by experts. https://twitter.com/esizkur/status/389226368514289664 https://twitter.com/esizkur/status/389226368514289664 https://twitter.com/0x0000EBFE/status/394216393282830336 https://twitter.com/0x0000EBFE/status/394216393282830336 He doesn't even have a way to test whether or not a machine is "infected". He claims that it's based on problems booting from a CD and/or hearing audio interference. Extremely dubious.
- sillysaurus2 13y ago
  How were the dumps created? Is it true that if you control the firmware, then you control what those dumps look like? If so, then the virus could be sending a decoy image whenever it detects someone's trying to dump the firmware.
kenrikm 13y ago
For those who think that possibility of using the speakers to transmit data from the air gap machine is too far fetched step back and look at ShopKick, they have been doing this for several years using iPhones and speakers mounted on the ceiling of stores. http://teleautomaton.com/post/1478772622/ultrasound-whispers-beat-out-gps http://teleautomaton.com/post/1478772622/ultrasound-whispers...

by marijn 13y ago

aktiur 13y ago

Apparently he did make a recording of the output (second last comment on this G+ publication https://plus.google.com/u/0/103470457057356043365/posts/3reWRqDMbn4 https://plus.google.com/u/0/103470457057356043365/posts/3reW... )

marijn 13y ago
Interesting. Let's hope it's more conclusive than the clean windows files he provided before. [edit]: That comment is two days old, and the files were not provided publicly, he just says he is analyzing them himself. Again, needless obscurity.

dangero 13y ago

Yes, a hardware USB bus analyzer could record the entire usb session from when you plug it in to when you unplug. You'd think any researcher would have one of those considering they cost well below $2000 http://www.totalphase.com/products/beagle_usb480/ http://www.totalphase.com/products/beagle_usb480/ http://www.saelig.com/category/UA.htm http://www.saelig.com/category/UA.htm The other thing suspicious is the manner of troubleshooting: "Even then, forensic tools showed the packets continued to flow over the airgapped machine. Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped." Hold on a second. What forensic tools were showing packets flowing? If he's saying that a software application on an infected machine showed "packets flowing"? That doesn't mean any data was actually going to and from the machine. That could even mean that the virus just simulates data transfer. Did he try putting tin foil around the machine to block any space signals that might be beaming down? I'm not sure if it's the researcher or the ars writer who doesn't know what they are talking about.

Zancarius 13y ago
What about this part: > Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed. When I read that, I had to check the date to make sure this wasn't posted on April 1st. That seems completely implausible, unless the author completely misunderstood some information relayed to him. There's something (okay, several things) about this entire article that just screams April Fools. Edit: The additional information others have posted here regarding malware in USB controllers seems far more likely and that the article itself was written as a ridiculously implausible story until the very end where it alludes to the notion that nearly the entire first 2/3rds is completely false. I guess I would've expected better of Ars.
- chrischen 13y ago
  It was explained the speakers were used. How is that implausible? The computers were laptops with batteries.
  - Zancarius 13y ago
    Because it doesn't explain that the system was a laptop until toward the end of the article: > Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility it was receiving signals over the electrical connection. To be fair, the Ars piece is poorly written IMO and makes some very outrageous claims throughout the first half. And I personally find the speaker-microphone route implausible given how difficult that would be. Even the article stakes a claim that it's very difficult to prove: > It's even harder to know for sure that infected systems are using high-frequency sounds to communicate with isolated machines Given the variable quality of speakers and microphones on laptops and other devices, it doesn't seem like a viable route to me, and this is resting far too much on speculation and conjecture to be of any use. Worse, I haven't yet found anything in the article that suggests every infected machine had a speaker/microphone combination. There's just not that much useful information, hence why this sounds more like a scare piece. I'm finding myself more and more in agreement with other comments here that have suggested it was probably a reckless use of an infected USB device that wasn't properly ruled out. Edit: I should also note that if they're so suspicious that the systems are transmitting sound to other non-infected machines, it shouldn't be too difficult to prove/disprove this by recording sound in isolation. The problem is IMO given the variable manufacturers of sound devices, drivers, and so forth, the complexity of this would be such that it'd be nearly impossible. An infected USB device makes much more sense and is a simpler explanation.

RazorOfOccam 13y ago

For what it's worth, he has dumped several files, including the ME firmware, which have all been found to be clean by experts. https://twitter.com/esizkur/status/389226368514289664 https://twitter.com/esizkur/status/389226368514289664 https://twitter.com/0x0000EBFE/status/394216393282830336 https://twitter.com/0x0000EBFE/status/394216393282830336 He doesn't even have a way to test whether or not a machine is "infected". He claims that it's based on problems booting from a CD and/or hearing audio interference. Extremely dubious.

sillysaurus2 13y ago
How were the dumps created? Is it true that if you control the firmware, then you control what those dumps look like? If so, then the virus could be sending a decoy image whenever it detects someone's trying to dump the firmware.

kenrikm 13y ago

For those who think that possibility of using the speakers to transmit data from the air gap machine is too far fetched step back and look at ShopKick, they have been doing this for several years using iPhones and speakers mounted on the ceiling of stores. http://teleautomaton.com/post/1478772622/ultrasound-whispers-beat-out-gps http://teleautomaton.com/post/1478772622/ultrasound-whispers...