4 ms·

Yes, a hardware USB bus analyzer could record the entire usb session from when you plug it in to when you unplug. You'd think any researcher would have one of t

by dangero 13y ago

Yes, a hardware USB bus analyzer could record the entire usb session from when you plug it in to when you unplug. You'd think any researcher would have one of those considering they cost well below $2000 http://www.totalphase.com/products/beagle_usb480/ http://www.totalphase.com/products/beagle_usb480/ http://www.saelig.com/category/UA.htm http://www.saelig.com/category/UA.htm The other thing suspicious is the manner of troubleshooting: "Even then, forensic tools showed the packets continued to flow over the airgapped machine. Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped." Hold on a second. What forensic tools were showing packets flowing? If he's saying that a software application on an infected machine showed "packets flowing"? That doesn't mean any data was actually going to and from the machine. That could even mean that the virus just simulates data transfer. Did he try putting tin foil around the machine to block any space signals that might be beaming down? I'm not sure if it's the researcher or the ars writer who doesn't know what they are talking about.

Zancarius 13y ago
What about this part: > Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed. When I read that, I had to check the date to make sure this wasn't posted on April 1st. That seems completely implausible, unless the author completely misunderstood some information relayed to him. There's something (okay, several things) about this entire article that just screams April Fools. Edit: The additional information others have posted here regarding malware in USB controllers seems far more likely and that the article itself was written as a ridiculously implausible story until the very end where it alludes to the notion that nearly the entire first 2/3rds is completely false. I guess I would've expected better of Ars.
- chrischen 13y ago
  It was explained the speakers were used. How is that implausible? The computers were laptops with batteries.
  - Zancarius 13y ago
    Because it doesn't explain that the system was a laptop until toward the end of the article: > Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility it was receiving signals over the electrical connection. To be fair, the Ars piece is poorly written IMO and makes some very outrageous claims throughout the first half. And I personally find the speaker-microphone route implausible given how difficult that would be. Even the article stakes a claim that it's very difficult to prove: > It's even harder to know for sure that infected systems are using high-frequency sounds to communicate with isolated machines Given the variable quality of speakers and microphones on laptops and other devices, it doesn't seem like a viable route to me, and this is resting far too much on speculation and conjecture to be of any use. Worse, I haven't yet found anything in the article that suggests every infected machine had a speaker/microphone combination. There's just not that much useful information, hence why this sounds more like a scare piece. I'm finding myself more and more in agreement with other comments here that have suggested it was probably a reckless use of an infected USB device that wasn't properly ruled out. Edit: I should also note that if they're so suspicious that the systems are transmitting sound to other non-infected machines, it shouldn't be too difficult to prove/disprove this by recording sound in isolation. The problem is IMO given the variable manufacturers of sound devices, drivers, and so forth, the complexity of this would be such that it'd be nearly impossible. An infected USB device makes much more sense and is a simpler explanation.
    - wahsd 13y ago
      I understand your skepticism, but I would not discount things simply because they do not fit in your frame of mind and assumptions. For example, some may assume that sound based data transmission is implausible simply because of variation in speaker technology and quality and performance, but does that not assume some sort of analog transmission? You don't have to produce and listen to specific frequencies if you have a sequence of pulses that trigger something. Ever hear of number stations? Also, we assume that things like data transmission by power cable and through power supplies is implausible, but only because we assume that there is not data link between power delivery and data transmission. Could there not be a gate somewhere that upon receiving a specific pulse of electricity opens for full data transmission or even just triggering a sequence of actions that are hard-coded into chip architecture through compromised specifications and standards? I think we all have heard of the recent publications of NSA's involvement in compromising and deliberately implanting vulnerabilities for their own convenience. Right? If not, you should really read up on what is now public domain. Although it might be scifi, if you look back on the disparity of technological capabilities in the civilian vs military and intelligence world of the past, you might get an extrapolated idea of how advanced technology developed under triple digit billions of dollars might be.
- Zancarius 13y ago
  Please disregard this comment and others I have made in this thread. Or at least read this interchange first: https://news.ycombinator.com/item?id=6650186 https://news.ycombinator.com/item?id=6650186 TL;DR: My reading of the article incorrectly assumed the infection vector was via microphone. It wasn't; the ultrasoncis bit is apparently how the malware communicates (presumably). The tweet referenced in the above link clarifies this. Please do not upvote my comment further. It is incorrect.
  - joshstrange 13y ago
    Thank you for this, too often people change their minds (or have their statements disproved) and don't say anything. Thank you for taking the time to "set the record straight" as it were.
larrys 13y ago
Usb breakout box. http://www.thenerdfiles.com/page24.html http://www.thenerdfiles.com/page24.html

by dangero 13y ago

Zancarius 13y ago

What about this part: > Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed. When I read that, I had to check the date to make sure this wasn't posted on April 1st. That seems completely implausible, unless the author completely misunderstood some information relayed to him. There's something (okay, several things) about this entire article that just screams April Fools. Edit: The additional information others have posted here regarding malware in USB controllers seems far more likely and that the article itself was written as a ridiculously implausible story until the very end where it alludes to the notion that nearly the entire first 2/3rds is completely false. I guess I would've expected better of Ars.

chrischen 13y ago
It was explained the speakers were used. How is that implausible? The computers were laptops with batteries.
- Zancarius 13y ago
  Because it doesn't explain that the system was a laptop until toward the end of the article: > Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility it was receiving signals over the electrical connection. To be fair, the Ars piece is poorly written IMO and makes some very outrageous claims throughout the first half. And I personally find the speaker-microphone route implausible given how difficult that would be. Even the article stakes a claim that it's very difficult to prove: > It's even harder to know for sure that infected systems are using high-frequency sounds to communicate with isolated machines Given the variable quality of speakers and microphones on laptops and other devices, it doesn't seem like a viable route to me, and this is resting far too much on speculation and conjecture to be of any use. Worse, I haven't yet found anything in the article that suggests every infected machine had a speaker/microphone combination. There's just not that much useful information, hence why this sounds more like a scare piece. I'm finding myself more and more in agreement with other comments here that have suggested it was probably a reckless use of an infected USB device that wasn't properly ruled out. Edit: I should also note that if they're so suspicious that the systems are transmitting sound to other non-infected machines, it shouldn't be too difficult to prove/disprove this by recording sound in isolation. The problem is IMO given the variable manufacturers of sound devices, drivers, and so forth, the complexity of this would be such that it'd be nearly impossible. An infected USB device makes much more sense and is a simpler explanation.
  - wahsd 13y ago
    I understand your skepticism, but I would not discount things simply because they do not fit in your frame of mind and assumptions. For example, some may assume that sound based data transmission is implausible simply because of variation in speaker technology and quality and performance, but does that not assume some sort of analog transmission? You don't have to produce and listen to specific frequencies if you have a sequence of pulses that trigger something. Ever hear of number stations? Also, we assume that things like data transmission by power cable and through power supplies is implausible, but only because we assume that there is not data link between power delivery and data transmission. Could there not be a gate somewhere that upon receiving a specific pulse of electricity opens for full data transmission or even just triggering a sequence of actions that are hard-coded into chip architecture through compromised specifications and standards? I think we all have heard of the recent publications of NSA's involvement in compromising and deliberately implanting vulnerabilities for their own convenience. Right? If not, you should really read up on what is now public domain. Although it might be scifi, if you look back on the disparity of technological capabilities in the civilian vs military and intelligence world of the past, you might get an extrapolated idea of how advanced technology developed under triple digit billions of dollars might be.
Zancarius 13y ago
Please disregard this comment and others I have made in this thread. Or at least read this interchange first: https://news.ycombinator.com/item?id=6650186 https://news.ycombinator.com/item?id=6650186 TL;DR: My reading of the article incorrectly assumed the infection vector was via microphone. It wasn't; the ultrasoncis bit is apparently how the malware communicates (presumably). The tweet referenced in the above link clarifies this. Please do not upvote my comment further. It is incorrect.
- joshstrange 13y ago
  Thank you for this, too often people change their minds (or have their statements disproved) and don't say anything. Thank you for taking the time to "set the record straight" as it were.

larrys 13y ago

Usb breakout box. http://www.thenerdfiles.com/page24.html http://www.thenerdfiles.com/page24.html