Malware communicates via ultrasound - Page 1
Forum section: electronics / general

author: amyk
author_rank: Super Contributor
timestamp: November 02, 2013, 12:40:55 pm
content: This was briefly mentioned in another thread but I thought I'd put this here:http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/I think it's implausible mostly because the guy didn't do the most obvious thing: if I were trying to analyse a BIOS infection, the first thing I'd do is to pull the EEPROM and read it out to compare with an uninfected machine.What do the EEs here think?

author: John Coloccia
author_rank: Super Contributor
timestamp: November 02, 2013, 01:16:31 pm
content: I think if this guy is really a security consultant, and it took him 3 years to figure out he's being owned by a simple USB stick attack, he should find something else to do. The whole "high frequency acoustic" communication is interesting, but not that big of a deal. It's not like it's never been done. He's just trying to make a big deal out of the whole thing or else he'll look like a complete idiot for having had his entire lab compromised, for YEARS, as the result of a simple, straightforward, USB stick attack.Amateur hour, IMHO.

author: sync
author_rank: Frequent Contributor
timestamp: November 02, 2013, 01:21:51 pm
content: Bullshit!Why don't they use a microphone to record and show us the communication?And deleting files and undo OS configuration from firmware/ BIOS level...

author: SArepairman
author_rank: Frequent Contributor
timestamp: November 02, 2013, 01:34:19 pm
content: what? How can it communicate unless there is a program written to listen? since when can a bios interface with a microphone?plus, could it really repair itself that quick over what, a 300 baud connection?it sounds like the most unreliable crap ever.

author: mariush
author_rank: Super Contributor
timestamp: November 02, 2013, 01:35:52 pm
content: The interesting part of this virus is that as far as I understand it somehow it uses usb commands to flash new firmware into usb controllers on usb sticks, it doesn't just copy itself as a file in the file system or something like that.Then you plug the usb stick into a computer and the virus on the usb stick apparently modifies the BIOS to insert just enough code to listen on the microphone and receive the payload.There was also some stuff about the virus flashing the DVD drive firmware (he bricked some drive by removing it at an exact moment, when he connected the drive back in the computer the virus apparently fixed the firmware) and modifying the data that was being written to a disc to remove itself from the files burned to the disc.I found it quite interesting... and quite complex and must have taken a huge amount of time to make. I don't think it was made by some random person out there, you'd need quite a lot of hardware level knowledge to make something like this...SArepairman: UEFI bioses can do that. And modern processors also have supervisors and virtualization features that could allow programs to run without an operating system being aware of them.

author: SArepairman
author_rank: Frequent Contributor
timestamp: November 02, 2013, 01:42:00 pm
content: is that how they flash USB controllers in the factory?he could just post the chip they use in the compromised media he has so we can look at a data sheet about how its programmed right?plus this would have been so much more credible if he hooked up a scope to the speaker.

author: John Coloccia
author_rank: Super Contributor
timestamp: November 02, 2013, 02:00:07 pm
content: I wonder if he irons his clothes in the office?

author: tszaboo
author_rank: Super Contributor
timestamp: November 02, 2013, 02:55:34 pm
content: Yeah, maybe the malicious code went from the iron, with the steam. Or the computers get the virus from RFID chips dogs marked with...

author: Cdngreybeard
author_rank: Contributor
timestamp: November 02, 2013, 03:15:43 pm
content: As posted earlier, he could easily verify if there were ultrasound transmissions by either scoping speakers or using another microphone to detect the sound.Three other things should be considered:1. Computer audio systems have a very limited audio bandwidth making high frequency signal output problematic. Any "ultrasound" would be attenuated to the point of being almost useless.2. Assuming the packet transfers occur at an ultrasonic frequency, the gaps between transmissions should be detectable as audible buzzing sound.3. Ultrasonic sound is somewhat directional and there would be significant sound loss between the transmitter and receiver as they move apart and as they move from a straight line path.

author: mrflibble
author_rank: Super Contributor
timestamp: November 02, 2013, 03:43:21 pm
content: Quote from: Cdngreybeard on November 02, 2013, 03:15:43 pmYeah, no kidding. Just the general cheapness of pc speakers would already save you from "malicious ultrasound h4x0rz". And as you pointed out, if this reeeeeaaally was going on, a rather trivial scope probe on the speaker pins would easily sort things out. All in all ...

author: JohnnyGringo
author_rank: Regular Contributor
timestamp: November 02, 2013, 03:52:24 pm
content: He needs to wear his tin-foil hat when working in the lab.https://www.eevblog.com/forum/chat/the-snake-oil-thread/msg299773/#msg299773

author: JuKu
author_rank: Frequent Contributor
timestamp: November 02, 2013, 04:14:27 pm
content: Nothing to add:http://www.rootwyrm.com/2013/11/the-badbios-analysis-is-wrong/

author: marshallh
author_rank: Unknown
timestamp: November 02, 2013, 06:18:34 pm
content: IMO the malware is real, but the guy is:1. Extremely busy and sidetracked2. Somehat inept3. Blaming the wrong causesA friend did a proof of concept ASK communication using the sound card. If you use the exact nyquist frequency of the card's sampling rate it's inaudible. Otherwise yes you can hear a slight whine. Data rates are slow but workable with FEC. It works across a moderately sized clear room even with tons of fan noise.And 2 weeks ago I saw an unprivileged usermode rootkit stealth infect UEFI, it masked its own code from reads at run time.This stuff is *mostly* possible, and every day I'm finding more attack vectors..

author: M. András
author_rank: Super Contributor
timestamp: November 02, 2013, 06:47:00 pm
content: wouldnt it possible to have that damn flashchip a physical switch on the board which disables the writes to the chip? dunno if those chips have a write enable pin or not. but the easyest way of preventing rootkits

author: mcinque
author_rank: Unknown
timestamp: November 02, 2013, 06:49:17 pm
content: Quote from: John Coloccia on November 02, 2013, 01:16:31 pm

author: amyk
author_rank: Super Contributor
timestamp: November 03, 2013, 01:53:41 pm
content: Quote from: SArepairman on November 02, 2013, 01:42:00 pmOr done any other sort of investigation besides (what looks like) attempting to either infect more machines with it, or analyse it from an already infected machine. If you suspect it's a USB protocol-level exploit, then get a protocol analyser (which he hasn't done). Mount the infected hard drive on another machine, preferably one with wildly different architecture (even an Arduino could work here) in order to image it and inspect its contents. Anything to prove its existence would've given it more credibility.All the individual pieces of this malware behaviour are believable, but it's the combination that's hard to believe --- and that the vital parts of the self-replication code (including communication) are small enough to hide in the BIOS.

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 03, 2013, 02:46:23 pm
content: Quote from: M. András on November 02, 2013, 06:47:00 pmEvery SPI Flash I have come across does have a dedicated write disable pin.

author: M. András
author_rank: Super Contributor
timestamp: November 03, 2013, 03:30:06 pm
content: Quote from: NiHaoMike on November 03, 2013, 02:46:23 pmgood to know, i dont get why they didnt use it to prevent unwanted modifications on the motherboards etc. a little switch. if the higher end gpu-s can do that by having 2 bios on them 1 can be modified the other is fixed

author: tszaboo
author_rank: Super Contributor
timestamp: November 03, 2013, 04:17:47 pm
content: Quote from: NiHaoMike on November 03, 2013, 02:46:23 pmAnd NSA and Illuminati personally flashes their spy code on every chip, if ever it makes it to computers...This must be so true.

author: M. András
author_rank: Super Contributor
timestamp: November 03, 2013, 05:47:08 pm
content: yeah nsa for sure? but illumnati? nah they just gives the orders for it. the next will be chips in your head to control you. like the americans said to their biometric shits i yeah chip as like dogs.... over my dead body thats for sure

author: amyk
author_rank: Super Contributor
timestamp: November 04, 2013, 07:04:44 am
content: Quote from: NiHaoMike on November 03, 2013, 02:46:23 pmMotherboards used to have a BIOS Write Protect jumper that would either toggle that pin or disconnect the programming voltage completely, but apparently  it costs just a little extra to install a jumper,  it makes BIOS upgrades require opening the case to switch it so making the process more difficult for regular users and possibly causing more tech support issues in the process, and  many newer mobos, in the interest of reducing BOM costs, store nonvolatile config data e.g. ESCD (not frequently modified, but still often enough that a hardware switch wouldn't work) in the same EEPROM.

author: John Coloccia
author_rank: Super Contributor
timestamp: November 04, 2013, 01:10:20 pm
content: I don't see why he thinks it's attacking his BIOS. This sounds to me like a simple root kit transmitted via USB sticks. He kept rebuilding machines and then he would keep reinfecting them by using his infected USB drives. That's so amateurish. I can well believe the ultrasound communication technique, but it only works because his entire security lab...dozens of computers....are all infected because he keeps on infecting himself by not following basic security hygiene.The signature of junk science is:1) fantastic claims2) refusal to release data which will absolutely confirm or deny the claim (dump the BIOS and post it. It's either changed or not)3) existence of a far simpler explanation that doesn't require the fantastic claimsSo while his fellow researchers are giving him the benefit of the doubt out of respect, and I'm sure he's a very nice guy so nothing personal, until he actually releases data to at least prove SOMETHING this is junk science to me.

author: tszaboo
author_rank: Super Contributor
timestamp: November 04, 2013, 06:26:20 pm
content: Quote from: M. András on November 03, 2013, 05:47:08 pmSorry, I was just trying to compete the BS from the article, kedves András.

author: M. András
author_rank: Super Contributor
timestamp: November 04, 2013, 06:57:56 pm
content: Quote from: NANDBlog on November 04, 2013, 06:26:20 pm

author: Terabyte2007
author_rank: Frequent Contributor
timestamp: November 06, 2013, 03:56:44 pm
content: I do quite a bit of experimentation with ultrasonic frequencies and I can tell you first hand that PC and Laptop speakers can and do produce ultrasonic frequencies over 40KHz. I have measured this on my scope, and I also have a couple devices that allow listening to ultrasonic frequencies by converting them to audible frequencies. It is amazing how much ultrasonic sound can be associated with these devices. Now, applying that to a Malware, not sure how effective this would be because of certain limitations of these devices and frequencies. I can tell you this much, it is definitely possible and given the right circumstances, probably not very hard to do.Is there an official name for this virus/malware?