First, a disclaimer
The story so far is this: Dragos's laptops appear to be have been infected by a virus more advanced than anything seen so far, more advanced than Stuxnet or Flame, two previous examples of state-sponsored advanced viruses.
We don't know of any of this is real. Dragos could be having a psychotic episode where paranoia has gotten the best of him. Our industry is rife with paranoia, where our "Occam's Razor" is tuned to believing that the most plausible explanation for everything "hackers". Weird sounds coming from the speakers? OMG it's a hacker!!
Also, Dragos hasn't given us anything we can independently verify. If it's a bad BIOS, Dragos can extract it and publish it. If a USB drive infects a system, Dragos can use a USB sniffer and dump all the packets going across the USB bus. If it's ultrasonic audio, Dragos could record the sound in WAV files. He could publish all this stuff, and we could see for ourselves whether it's real or not. That he hasn't casts doubt on what he's found.
But at the same time, this is Dragos Ruiu, a well-respected researcher for 15 years. If he says he's got an infected BIOS, I'm going to believe him. Sure, he's probably gotten some things wrong: just because "they" really are ought to get you doesn't mean that "they" are responsible for every phenomenon you can't explain. But on the whole, I (and many other old-time experts) believe that in the end, most everything he suspects will be confirmed.
Infecting the BIOS ROM
When you turn on a computer it starts running code located in flash memory. This startup code tests the system, initializes the hardware, then loads the operating system.
We call this the "BIOS ROM", but the term as been outdated since the 1980s. The word BIOS (Basic Input/Ouput System) meant that it contained the drivers the operating system could use to interact with the hardware, but today's operating systems contain their own drivers, ignoring the BIOS drivers. The word "ROM" (Read Only Memory) meant that it was burned into chips and couldn't be changed -- except by replacing the chips. Today, it's flash memory that is writeable. So a BIOS ROM isn't a BIOS ROM anymore, but we still call it that.
What hackers can do is overwrite the BIOS flash memory, adding their own code that runs on startup. It's a little bit tricky, because eventually the BIOS hands off control to the operating system and ceases to run. There are a number of techniques a hostile BIOS needs to do in order to maintain control. For example, in the early phase of booting, the operating system uses the BIOS drivers to read from hard drives. Therefore, the BIOS might look at which files are being loaded, and then load hostile versions of some of them. Then, once the operating system switches over to using it's own device drivers, the hostile code is already running inside the operating system.
Update: The picture to the right shows my Macintosh's built-in Bluetooth adapter. It's uses the Broadcom BCM20702 chip, which contains an ARM7-TDMI processor running around 70-MHz. The current firmware version is "38 (4243)". A virus can overwrite this and stay resident in the system through complete wipes of the system, even wiping the primary BIOS.
The most insidious component is the "system agent" that may be powered on even when the computer is powered "off" as far as you can tell. This system agent is designed to be able to power on the computer when you press a key on the keyboard, when it receives a special packet from the network, or at certain configured times of the day.
While these devices seem diverse, there are in fact only a few manufacturers of microcontrollers and flash memory. Thus, once a hacker has written viral code for one, let's say the battery controller, it's not too difficult to extend the code to also infect the trackpad, for example.
The upshot is this: when a system gets infected by a virus, the infection can likely become permanent, being nearly impossible to completely remove from the system. There's just too many places code can hide, and too many components that can interfere with you trying to disinfect the system. Also, modern anti-virus vendors have nothing close to defending against this.
This sounds like science-fiction, but it really isn't. There have been prototypes floating around at hacker conferences for over 5 years. Personally I've played with a prototype infection of Ethernet firmware, others have played with infecting the motherboard BIOS. It's pretty straighforward for hackers.
Networking over hi-def audio
Dragos believes that two infected computers can communicate with each other over the audio port in frequencies above human hearing, thus allowing an "air gapped" computer to still communicate over the Internet.
This technique is no different than old telephone modems. Back in the early 1990s, modems contained dedicated hardware to modulate/demodulate the audio signal coming across the phone line. By the late 1990s, most modems became "soft modems" consisting of circuitry that simply sampled the audio signal like a sound card, and then used software running on the computer to do the modulation/demodulation.
Modern computers are thousands of times faster than that. Now we have "software defined radio" consisting of a dongle on the USB port that samples radio waves at a high frequency then processes those samples on the computer. With a $10 dongle, your laptop can pick up radio waves, such as television and radio broadcasts, or your neighbor's baby monitor. With a slightly more expensive dongle that can transmit as well as receive, your laptop can pretend to be a wifi access point or a cell phone tower -- doing all the signal processing on your main CPU in software.
Today's computers support "high definition" audio with 24 bit samples at 96 KHz sampling rate. I think it's been part of the PC spec now for over a decade, and even the cheapest of cheap RealTek audio chip support it. Hackers can apply the same soft-modem or soft-radio concepts to it for communications. They can apply a bandpass filter to the lower 20 KHz that is in human hearing range, and use the remaining bandwidth ("ultrasonic frequencies") for communications. Even if hackers aren't personally familiar with signal processing, they can download open-source code to do it for them. This the sort of thing a professor in a college course might assign to students as homework. Sure, it's a little tricky, because speakers distort the sound, and you have to deal with echoes in the room as sound bounces off walls, but that can be solved either by lowering transmission rate or more advanced signal processing.
In other words, while I know of no talk at a hacking conference on "air gapped communication" via sound waves, it's pretty darn easy, so expect to see one soon at a conference.
By the way, there are other ways to do air gapped communications using covert channels. For example, you might exploit blinking LEDs and using the built-in camera on the laptop. Or, you might be able to monitor the voltage on the power supply on one computer while turn on the power supply on/off on another. The overage laptop computer has a godaweful number of inputs/outputs that we don't quite realize.
[Update:] The picture above is that of a $229 netbook computer producing a 20 KHz tone that's received by $2000 MacBook Air, while music is playing in the background. That the carrier is clearly visible hints that this is a practical technique for low-speed communications. While testing today, I couldn't get anything above 24 KHz to work, because speakers are surprisingly bad, and manufacturers lie about how fast they sample input.
[Update:] The picture above is that of a $229 netbook computer producing a 20 KHz tone that's received by $2000 MacBook Air, while music is playing in the background. That the carrier is clearly visible hints that this is a practical technique for low-speed communications. While testing today, I couldn't get anything above 24 KHz to work, because speakers are surprisingly bad, and manufacturers lie about how fast they sample input.
Infection via USB
Dragos reports that unplugging a USB stick from an infected machine and then plugging it into an uninfected machine will transfer the virus. This relies upon two important features of USB: the first is that USB devices contain their own microprocessor/firmware (of course), and the second that drivers are buggy.
There are only a few popular vendors of USB thumbdrive controllers. There is a great website "http://flashboot.ru" that documents all them. I've visited their site many times in order to download software for my flash drives. I use this software to reprogram them to emulate a CD-ROM drive, making "read-only flash drives", but you can also use this software to download new firmware to the flash drives. Thus, it's pretty straightforward for hostile malware to not simply overwrite the data on inserted USB drives, but to overwrite their firmwares as well.
Once USB drive has hostile firmware, it can now attack new machines when it's plugged in. The reason is that software in Windows/Linux/Mac that talks to USB devices is inherently insecure. They assume that all USB devices are friendly rather than hostile, and believe whatever these devices tell them. This allows hostile devices to exploit vulnerabilities in driver code.
For example, USB drivers are full of "buffer overflow" bugs. Let's say that you have a buffer that's supposed to be less than 16 bytes according to the specification, but a hostile USB device gives you 100 bytes instead. Driver writers don't check that sort of thing, thus allowing a hostile USB device to take control of the host system.
Making this work well with viruses is tough job for hackers. Their code will have to fingerprint the system, such as the BIOS vendor when infecting during the boot process, or fingerprint the operating system when the USB drive is inserted later. But, at the same time, it's just a matter of effort, adding new USB controllers to your malware, or adding new operating system targets.
Covert network channels
Dragos reports seeing odd IPV6 packets even when the system doesn't support IPv6. Actually, there is a lot whole lot of ways that a computer may talk covertly across the network.
There are a lot of high-level components that malware can hook into such that you'd never see the network communication by looking at the network. For example, I could insert myself into a Chrome browser such that whenever you sent an email from your browser via Gmail, it'd send an extra message from my malware, then erase the message from the sent folder. All you'd see on the wire is that some of the SSL packets are slightly bigger than expected. But, what you wouldn't see is any network communication happening when the computer isn't connected to Gmail.
Another example is the DCOM debugging feature. DCOM is Microsoft's way of building corporate app that distribute themselves across computers. It's got a cool way that I can add a DLL to a program that hitches a ride along with all DCOM packets. Thus, while sniffing the network, even unencrypted packets in the clear, you are likely to still miss this additional information in each packet.
Or take DNS, which we've long used as a method for cover communications. Just wait for a flurry of DNS packets (like 10 DNS in 10 seconds), then add your own DNS packet.
The point I'm trying to make here is that hackers can easily hide covert communications within packets that would be really hard to detect by capturing all packets going across the wire.
Conclusion
Everything Dragos describes is plausible. It's not the mainstream of "hacking", but neither is it "nation state" level hacking. That it's all so plausible leads credence to the idea that Dragos isn't imagining it. Of course, since Dragos is an expert, his imagination is likely be full of factually correct details anyway, so maybe the plausibility of these hacks isn't such guarantee of truth.
Dragos has only been analyzing this for a few weeks. Presumably, he won't give us the full details for us to check out until the next CanSecWest conference. Until then, I guess we are all just blowing smoke about whether this is "real" or not.
24 comments:
hello, what software you mean in "Networking over hi-def audio" ?
thanks
An interesting aside to the USB side of things: The "PS Jailbreak" device that was used for piracy on PS3 systems used similar faults and assumptions in the USB protocol to gain code execution by way of a buffer overflow.
Common audio misconception.
People often mistake the sample frequency for the audio frequency.
Audio speakers can clearly reproduce frequencies between 20Hz-20kHz, the human hearing range, but not much more. Even if audible, these high frequencies are indiscernible beeps.
To digitally describe a sound wave one must sample this wave with an AD convertor. Open the link to the image. http://en.wikipedia.org/wiki/File:Pcm.svg . This shows one fase of a sine wave (in red).
An AD convertor takes snapshots (in gray) of the sounds amplitude at an interval. In the case of the image that is 32 times per fase/cycle (horizontal resolution). There is no mention of sound frequency in this image, so if the sound frequency in the image is 100 Hz, the sample frequency would be 3200 Hz. A higher frequency means a crisper sound.
Had this sample rate been equal to the sound frequency, the ADC samples only every fase, wich means it measures the similar outbreaks every fase, wich creates a flatline, hence no sound. A sample rate of 44.1 kHz (CD quality) can playback a square wave at 22.05 kHz, not higher (Nyquist frequency) and nothing more then a square (see the grey blocks). The lower the audio frequency, the better the quality of characteristics. Or raise the sample frequency. For playback of audible sound 44.1 kHz suffices more then enough.
When tuning down the sound (making baby cries sound like lion growls, or make mosquito like a B17) a much higher sample frequency is needed to clearly represent the edited sound. Hence the 96 kHz in studios.
The same goes for the 16 vs 24 bit pcm sound misconception. This describes amplitude (vertical resolution in the image, wich is a mere 4 bit). Sixteen bit is enough, unless you are editing very soft sounds. Then you use 24 bit wich is 256 times more precise.
Picking up audio to monitor certain activity is very well possible, but the frequencies at wich this happens are a limited.
I thought I should clear this up.
He's clearly having a psychotic episode. And people like you are giving credence to his delusions.
Tech people are too quick to jump down hypothetical rabbit holes (e.g. this blog post). Consider the situation logically: Dragos is a low value target to any sophisticated adversary. What are his intelligence assets? Second, it's well known (from leaked documents, and just plain reason) that the intelligence community consistently uses the least sophisticated exploits on those who have the technical ability to detect and analyze exploitation.
1. appear to be have been infected by a virus more advanced than anything seen so far, more advanced than Stuxnet or Flame, two previous examples of state-sponsored advanced viruses. 2. It's not the mainstream of "hacking", but neither is it "nation state" level hacking. These sentences do not correlate. Is it nation-state level hacking or not?
Halloween keeps getting scarier and scarier. On a more serious note (ha ha - note) is computer audio really good enough to do an ultra-sound?
I think the conclusion of this article is fantastic: “That it's all so plausible leads credence to the idea that Dragos isn't imagining it. Of course, since Dragos is an expert, his imagination is likely be full of factually correct details anyway”
Clearly this *could* be real. What if this is a whistle-blower revealing just how bad the security of the modern PC is? If you wanted everyone to know about this sort of thing, who would be the best person to infect? Clearly it wouldn't be a nation-state who would cover it up as quickly as possible. It would be a researcher who would publicize his findings.
This is scary stuff. Again, *if* it's real. Until someone else gets hands on an infected machine, we won't know for sure
While it may seem farfetched for such avenues to be infected and used as a means to transport viruses and infect others, it is certainly plausible. This fact alone means that innovative hackers will try to exploit these vulnerabilities and eventually crack it.
Wouldn't you think that when information as sensitive as military or government intellectual property is sought after by hostile governments, that they would look for new ways to infiltrate a network of computers?
In this day and age, it's certainly prudent to be a bit paranoid and the best thing to do is take reasonable precautions. This includes judicious use of your USB drive, staying on mainstream sites (though they can still be infected with malware), and staying educated on the latest tools to stay ahead of hackers, whether that is something as simple as the latest internet security suite, or something more novel and innovative such as Spikes' AirGap for browsing.
You've also got to remember that Intel Macs use EFI firmware instead of a traditional BIOS. But still, similar attack vectors are in play, plus a Mac may have additional components that it could breach too.
Great post!
Just wanted to see if you could clarify on an issue - with the air-gapped communication, we are already assuming the air gapped computer has already been infected via USB, correct? I can only imagine that this is the way it knows to demodulate the signals coming through the speakers.
Thanks!
Air gap has been confirmed (several times) to be command and control only. Dragos has said so multiple times on his Twitter feed. Unfortunately, the Ars article was not very precisely worded and people got confused.
Just to reinforce Ivo's points...
the most important of which is that typical speakers (even high end ones) have a limited range of frequency reproduction. It varies, but it's not in any way controlled by any microprocessor or as a result of what the computer can output. Most if not all audio gear (speciality stuff designed for ultra high frequency research stuff, etc, notwithstanding) has analog or digital roll-off components phsyically present in the circuitry, directly in the path of signal flow. These physically/electronically limit the upper and lower frequencies that can be produced. As Ivo mentioned, it's usually 20-20000Hz.
You may not even need audio hardware to produce sound, for example my thinkpad sometimes produces annoying c4-beeping. I know a good amount of people who can't hear that because their ears aren't that good anymore.
@Eugene Kwak
Stuxnet was targeted at a Nation-State target but spread to wide and was accidentally discovered by an A/V company.
It's God, like everyone in history knows. You think you're so smart? You're a tin foil hat clown. God is the occums razor answer.
A question for Clarification:
In the Ars article, the author mentions that Dragos had been messing with this thing for several years (initial infection being 3 years ago).
In your followup, you mention he has only been analysing it for several months?
Seems to be a bit of a timeframe gap there. Any idea which it actually is?
Signals hidden in audio is how certain types of copy protection also work- Look up Cinavia.
A modern http://en.wikipedia.org/wiki/The_War_of_the_Worlds_(radio_drama) ?
To clarify Jeremey Cote's clarification of Ivo's comment:
Concerning "While testing today, I couldn't get anything above 24 KHz to work, because speakers are surprisingly bad, and manufacturers lie about how fast they sample input."
Most audio sampling systems will put a 20 kHz low pass filter in front of the sampler (to force satisfying Nyquist sampling theorem). So even if the signal is sampled at 96 kHz, the only signal that can reach the sampler would be one below 20 kHz.
Remember when the AMI BIOS source code and UEFI signing key were found on a public FTP server (refresher: http://www.techspot.com/news/52171-ami-bios-source-code-and-uefi-signing-key-found-on-public-ftp.html)? :p
Hi! I'm no specialist at all, and this have maybe already been commented, but I just thought about this (not considering the audio quality needed for audio networking) :
- first, my computer microphone is off by default. To be listening/recording unwanted malware audio, it would need a high amount of chance or previously infected by another virus telling him to constantly listen to any audio signal around.
- secondly, if my computer is listening to any audio incoming, it will be still considered as a simple audio signal. Is there by default a piece of software in my computer that will automatically tell the OS to translate the audio incoming into code? I guess it would need another virus to do so...
I'm curious about this!
Post a Comment