4 ms·

Right, it's not like wifi adapters have independent processors of their own with closed-source, potentially buggy firmware that does DMA into main processor mem

by rst 13y ago

Right, it's not like wifi adapters have independent processors of their own with closed-source, potentially buggy firmware that does DMA into main processor memory. :-) It's also worth thinking about netboot (which comes in several flavors), in which the main processor's potentially buggy BIOS may be independently decoding and processing packets coming over physical wires.

yuhong 13y ago
And on USB, don't forget SMM code emulating PS/2 input devices by parsing USB HID packets. I think part of the reason why real mode exploits was never very common was that the address DOS allocated memory depended on for example what TSRs you were running.
- rst 13y ago
  Remember that story a few months ago about how some government agency had replaced all its keyboards and mice in response to a malware infestation? A lot of folks (including some here) took this as Yet Another Show of Government Cluelessness. I found myself wondering instead if there was a world in which folks advised by government security experts (i.e., you-know-who) would have a good reason to do something like this and not say why. There is. It's a world in which their opponents had a zero-day against the Windows USB driver, and a way into the government's supply chain. And in which you-know-who wants to play the same game themselves against opponents elsewhere.
  - wiml 13y ago
    They don't need a way into the government's supply chain if the keyboards and mice have processors whose firmware is updatable over USB. Which is not exactly rare. PoC: http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard-firmware-hack-demonstrated http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard...
makomk 13y ago
As it happens, the wifi adapters I'm using don't have any firmware at all - most Atheros ones are old-fashioned peripherals with no processor of their own, and some of the remaining ones have offical open source firmware. Good luck finding a baseband interface like that.

by rst 13y ago

yuhong 13y ago

And on USB, don't forget SMM code emulating PS/2 input devices by parsing USB HID packets. I think part of the reason why real mode exploits was never very common was that the address DOS allocated memory depended on for example what TSRs you were running.

rst 13y ago
Remember that story a few months ago about how some government agency had replaced all its keyboards and mice in response to a malware infestation? A lot of folks (including some here) took this as Yet Another Show of Government Cluelessness. I found myself wondering instead if there was a world in which folks advised by government security experts (i.e., you-know-who) would have a good reason to do something like this and not say why. There is. It's a world in which their opponents had a zero-day against the Windows USB driver, and a way into the government's supply chain. And in which you-know-who wants to play the same game themselves against opponents elsewhere.
- wiml 13y ago
  They don't need a way into the government's supply chain if the keyboards and mice have processors whose firmware is updatable over USB. Which is not exactly rare. PoC: http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard-firmware-hack-demonstrated http://it.slashdot.org/story/09/08/01/1658258/apple-keyboard...

makomk 13y ago

As it happens, the wifi adapters I'm using don't have any firmware at all - most Atheros ones are old-fashioned peripherals with no processor of their own, and some of the remaining ones have offical open source firmware. Good luck finding a baseband interface like that.