5 ms·

There is also a second OS hiding in your computer right now! (There might even be a third, or forth, depending on your hardware configuration and manufacturer.)

There is also a second OS hiding in your computer right now! (There might even be a third, or forth, depending on your hardware configuration and manufacturer.) Proprietary BIOS software has suffered the same issues for the last twenty+ years.

foobarian 13y ago
Good thing all these embedded computers in my computer don't have antennas attached with buggy baseband that blindly decodes and trusts messages coming thereon. :-)
- rst 13y ago
  Right, it's not like wifi adapters have independent processors of their own with closed-source, potentially buggy firmware that does DMA into main processor memory. :-) It's also worth thinking about netboot (which comes in several flavors), in which the main processor's potentially buggy BIOS may be independently decoding and processing packets coming over physical wires.
  - yuhong 13y ago
    And on USB, don't forget SMM code emulating PS/2 input devices by parsing USB HID packets. I think part of the reason why real mode exploits was never very common was that the address DOS allocated memory depended on for example what TSRs you were running.
    - rst 13y ago
      Remember that story a few months ago about how some government agency had replaced all its keyboards and mice in response to a malware infestation? A lot of folks (including some here) took this as Yet Another Show of Government Cluelessness. I found myself wondering instead if there was a world in which folks advised by government security experts (i.e., you-know-who) would have a good reason to do something like this and not say why. There is. It's a world in which their opponents had a zero-day against the Windows USB driver, and a way into the government's supply chain. And in which you-know-who wants to play the same game themselves against opponents elsewhere.
      - wiml 13y ago
        They don't need a way into the government's supply chain if the keyboards and mice have processors whose firmware is updatable over USB. Which is not exactly rare. PoC: http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard-firmware-hack-demonstrated http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard...
  - makomk 13y ago
    As it happens, the wifi adapters I'm using don't have any firmware at all - most Atheros ones are old-fashioned peripherals with no processor of their own, and some of the remaining ones have offical open source firmware. Good luck finding a baseband interface like that.
- jrockway 13y ago
  I don't think you realize how much noise computers radiate. If someone wanted to emit a signal instead of noise, it would be quite possible to do so. (People are doing DX work by connecting an IO pin of their Raspberry Pi to a long wire.)
  - im3w1l 13y ago
    What is DX work?
    - kalleboo 13y ago
      http://en.wikipedia.org/wiki/DXing http://en.wikipedia.org/wiki/DXing http://www.southgatearc.org/news/march2013/2000_km_dx_using_the_raspberry_pi.htm#.UoMjmpHa1Gs http://www.southgatearc.org/news/march2013/2000_km_dx_using_...
- nitrogen 13y ago
  The largest firmware images shipped with Ubuntu in /lib/firmware are for network adapters: ls -Sl /lib/firmware | head -rw-r--r-- 1 root root 1845305 Apr 10 2013 phanfw.bin -rw-r--r-- 1 root root 1531932 Nov 8 2012 i6050-fw-usb-1.5.sbcf -rw-r--r-- 1 root root 1334532 Nov 8 2012 i2400m-fw-usb-1.5.sbcf -rw-r--r-- 1 root root 1251036 Nov 8 2012 i2400m-fw-usb-1.4.sbcf -rw-r--r-- 1 root root 707392 Nov 8 2012 iwlwifi-2030-6.ucode -rw-r--r-- 1 root root 701228 Nov 8 2012 iwlwifi-135-6.ucode -rw-r--r-- 1 root root 695876 Nov 8 2012 iwlwifi-2000-6.ucode -rw-r--r-- 1 root root 689680 Nov 8 2012 iwlwifi-105-6.ucode -rw-r--r-- 1 root root 679436 Nov 8 2012 iwlwifi-6000g2b-6.ucode https://github.com/torvalds/linux/search?q=phanfw https://github.com/torvalds/linux/search?q=phanfw (QLogic qlcnic) https://github.com/torvalds/linux/search?q=i6050 https://github.com/torvalds/linux/search?q=i6050 (Intel WiMAX) https://github.com/torvalds/linux/search?q=i2400m https://github.com/torvalds/linux/search?q=i2400m (Intel WiMAX) https://github.com/torvalds/linux/search?q=iwlwifi https://github.com/torvalds/linux/search?q=iwlwifi (Intel WiFi)

foobarian 13y ago

Good thing all these embedded computers in my computer don't have antennas attached with buggy baseband that blindly decodes and trusts messages coming thereon. :-)

rst 13y ago
Right, it's not like wifi adapters have independent processors of their own with closed-source, potentially buggy firmware that does DMA into main processor memory. :-) It's also worth thinking about netboot (which comes in several flavors), in which the main processor's potentially buggy BIOS may be independently decoding and processing packets coming over physical wires.
- yuhong 13y ago
  And on USB, don't forget SMM code emulating PS/2 input devices by parsing USB HID packets. I think part of the reason why real mode exploits was never very common was that the address DOS allocated memory depended on for example what TSRs you were running.
  - rst 13y ago
    Remember that story a few months ago about how some government agency had replaced all its keyboards and mice in response to a malware infestation? A lot of folks (including some here) took this as Yet Another Show of Government Cluelessness. I found myself wondering instead if there was a world in which folks advised by government security experts (i.e., you-know-who) would have a good reason to do something like this and not say why. There is. It's a world in which their opponents had a zero-day against the Windows USB driver, and a way into the government's supply chain. And in which you-know-who wants to play the same game themselves against opponents elsewhere.
    - wiml 13y ago
      They don't need a way into the government's supply chain if the keyboards and mice have processors whose firmware is updatable over USB. Which is not exactly rare. PoC: http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard-firmware-hack-demonstrated http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard...
- makomk 13y ago
  As it happens, the wifi adapters I'm using don't have any firmware at all - most Atheros ones are old-fashioned peripherals with no processor of their own, and some of the remaining ones have offical open source firmware. Good luck finding a baseband interface like that.
jrockway 13y ago
I don't think you realize how much noise computers radiate. If someone wanted to emit a signal instead of noise, it would be quite possible to do so. (People are doing DX work by connecting an IO pin of their Raspberry Pi to a long wire.)
- im3w1l 13y ago
  What is DX work?
  - kalleboo 13y ago
    http://en.wikipedia.org/wiki/DXing http://en.wikipedia.org/wiki/DXing http://www.southgatearc.org/news/march2013/2000_km_dx_using_the_raspberry_pi.htm#.UoMjmpHa1Gs http://www.southgatearc.org/news/march2013/2000_km_dx_using_...
nitrogen 13y ago
The largest firmware images shipped with Ubuntu in /lib/firmware are for network adapters: ls -Sl /lib/firmware | head -rw-r--r-- 1 root root 1845305 Apr 10 2013 phanfw.bin -rw-r--r-- 1 root root 1531932 Nov 8 2012 i6050-fw-usb-1.5.sbcf -rw-r--r-- 1 root root 1334532 Nov 8 2012 i2400m-fw-usb-1.5.sbcf -rw-r--r-- 1 root root 1251036 Nov 8 2012 i2400m-fw-usb-1.4.sbcf -rw-r--r-- 1 root root 707392 Nov 8 2012 iwlwifi-2030-6.ucode -rw-r--r-- 1 root root 701228 Nov 8 2012 iwlwifi-135-6.ucode -rw-r--r-- 1 root root 695876 Nov 8 2012 iwlwifi-2000-6.ucode -rw-r--r-- 1 root root 689680 Nov 8 2012 iwlwifi-105-6.ucode -rw-r--r-- 1 root root 679436 Nov 8 2012 iwlwifi-6000g2b-6.ucode https://github.com/torvalds/linux/search?q=phanfw https://github.com/torvalds/linux/search?q=phanfw (QLogic qlcnic) https://github.com/torvalds/linux/search?q=i6050 https://github.com/torvalds/linux/search?q=i6050 (Intel WiMAX) https://github.com/torvalds/linux/search?q=i2400m https://github.com/torvalds/linux/search?q=i2400m (Intel WiMAX) https://github.com/torvalds/linux/search?q=iwlwifi https://github.com/torvalds/linux/search?q=iwlwifi (Intel WiFi)