TR Forums

just brew it! wrote:

Going off on a tangent here, I think the common corporate IT practice of requiring identical (or similar) PCs for everyone with a common system image is detrimental to security. It's analogous to crop monoculture. By making everything the same, you ensure that everything is vulnerable to the exact same threats, making rapid spread of an infection more likely.

Crop monoculture is definitely a tangent.

I couldn't agree more though, cost and convenience always seems to win over security. What's the deal with DOD machines don't they have custom hardware to prevent the likes of BIOS malware anyway?

Convert wrote:

just brew it! wrote:

Going off on a tangent here, I think the common corporate IT practice of requiring identical (or similar) PCs for everyone with a common system image is detrimental to security. It's analogous to crop monoculture. By making everything the same, you ensure that everything is vulnerable to the exact same threats, making rapid spread of an infection more likely.

I'm not sure how many still adhere to this. Having identical systems for deployment's sake is a really a thing of the past, even the free stuff handles different platforms without a problem. You still have your central image, it just pulls the necessary drivers from the repository.

Now, obviously some companies buy in batches, but even then it seems like it's still "batches". With the way the major OEMs seem to discontinue and change their models so frequently you can have a different system even months apart. I'm sure there are still places out there that replace everything in one go but it's been a while since I've seen it. Guess it depends on the size too.

Not a thing of the past, it is still very much out there.

Our office has just suffered through this, at the hands of new corporate overlords. The standard image also includes enough pre-loaded "security" software to reduce the performance of a modern quad-core hyperthreaded Xeon with 16 GB of RAM (their standard "Power User" hardware config) to less than that of a circa-2005 Pentium 4. Fortunately, Kubuntu 12.04 in a VirtualBox VM seems to perform reasonably well (as in, substantially better than the host system). Go figure. But at least I think I have a way to stay productive, while playing by their rules.

Interresting article. Although I guess that any person experiencing that bit would tend to start believing in ghost before they found something that could attribute it to. It would be quite eerie to have systems behaving that way.

With regards to speakers, high audio frequencies might not be feasable on small computer systems, but once you get into higher end speakers, it's easy to go beyond audible range since most speakers generally want to go as high as possible to avoid having a to low breakup frequency on the tweeter. Chipsets are certainly capable - Here, any better chipset should be ablt to get a fair bit past 20K - http://techreport.com/review/23358/asus ... reviewed/9
Amp's shouldnt be that much of a problem either, the thing is the speakers, although higher end ones easily do it. Now I have nice speakers in my home theater, they are actually capable of going up to almost 30Khz within the normal specifications of being "flat" as in the decently non-flat +-3db thing.

Also, if you have access to audio chipset, you can probably monitor the mic for input and only transmit when it's at its lowest points over a certain amount of time, that would give you better SNR and lower the chance of detection a fair bit I would think. And there is certainly other side-channel attacks that you can use on various levels. Sound can be detection by laser and minute vibrations on physical objects. If you have a bug in a QR reader, you could probably spread malware on fairs with false blank mysterious businesscards or making something ARG-like. You have the old tempest and van Eck.

The really scary thing with this is that it is on such a basic level of the hardware it supposedly act on. Then you have the range and that it might actually be feasiable to get a relativitely reliable connection on. Most of the hardware, especially portable hardware has decently fair capabilities nowdays. Add newfangled things like Kinect, Webcams. Look at an iphone or similar smartphone for instance, powerfull small speakers, a sensitive mic that can actually be calibrated fairly enough to measure things, and you will carry it with you and have the ability to infect other,. talk about a wildfire spreading. As for information flow, you could probably even use 3D tv's with variable updating speed and a photodetector to transfer information, lightboost/g-sync anyone ?

Now, I wonder how long it will take until we get into Snow Crash territory Basically, epilepsi is already a crude brain nuke for some...



Monoculture
While cost and convienence may be a thing over security, monoculture might also have pretty benefits, so it's not really clearcut. If you assume a hardware vulnerability, then sure, if you have it on one piece, you have it on all, but you also only have one kind of equipment to audit and test for faults and mitigate. And you might just miss a few hardware software incompabilities that might introduce new faults by themselves. And while deployment has certainly gotten easier thanks to a more soft policy with the ability to request and schedule updates on individual needs makes multiculture way more feasable, in large companies I still think scale would win economically for monoculture.

JBL - of course the above doesnt take into account the skill of the ones putting together the platform, because there is really no reason today that anything should slow down that much if done properly, and while having defense in depth and multitude of protection programs, loading all of on a client is actually counter intuitive in many ways. You can bet they still wont cant some vulnerbilities that lets an attacker shut them all off anyway so...

Not to mention that while clients are nice, they are often used as a stepping stone for many other things, not a target byselves. A former colleque of mine that works on Outpost24 together with a guy from Kasperky did a practical test on social engineering and also looked at vulnerbilites. Let's just say that good patch management has some ways to go before people start to use 0-day things to be effective, more like... 2-month vulnerbilities in reality in many places.
http://usa.kaspersky.com/about-us/press ... d-overlook / http://www.securelist.com/en/blog/8132/ ... o_overlook
Full paper is here - http://www.securelist.com/en/downloads/ ... erlook.pdf

just brew it! wrote:

Not a thing of the past, it is still very much out there.

I didn't mean the standardized images themselves, just the fact that companies don't really focus on making sure all of the systems are the same physically across the entire business. The standardized OS images are the norm for sure.

Since this "attack" focuses on the hardware I'm just thinking it might not be such a big deal since companies don't always outright replace everything all at the same time. In other words there should be a fair amount of variability in hardware. Just depends of course, sometimes departments are replaced wholesale and since this attack only works in close proximity it's probably isolated to rooms/floors of a building anyways. I guess chances are anything within this distance is probably going to be the same hardware..

http://www.cs.tau.ac.il/~tromer/acoustic/

Who needs the rootkit when you can listen to nearly inaudible coil whine and other "microsounds" and extract a 4096-bit GnuPG key. Even works on a TEMPEST-shielded computer.

H/T Bruce Schneier:

https://www.schneier.com/blog/archives/ ... rypta.html

Looks like the GnuPG team has already issued a patch for the acoustic cryptanalysis attack. It was released yesterday, and showed up in my Ubuntu desktop's list of security updates this morning. From the release announcement:

GnuPG wrote:

GnuPG 1.4.16 avoids this attack by employing RSA blinding during decryption. GnuPG 2.x and current Gpg4win versions make use of Libgcrypt which employs RSA blinding anyway and are thus not vulnerable.

After reading more on the audio listening hack... it is not feasible and only works if the user opens some 40,000 encrypted emails, and only works on non oscillation encryption.

from the author of the paper..
""the process involves bombarding a particular email client with thousands of carefully-crafted encrypted messages, on a system configured to open these messages automatically. The private key to be broken can't be password protected because that would mean a human would need to intervene to open every message.

There are other limitations too, including use of the GnuPG 1.4.x RSA encryption software. And because the whole process is an adaptive ciphertext attack a potential attacker needs a live listening device to provide continuous acoustic feedback in order to work out what the next encrypted message needs to be. The attack requires an evolving conversation of sorts rather than the delivery of a fixed (albeit complex) script.

Mitigating against the complex attack requires simply using the more modern GnuPG 2.x instead of the vulnerable GnuPG 1.4.x encryption scheme, which ought to plug up the problem at least until more powerful attacks comes along.""

OK, you're right on the practical levels of exploitation. That said, if someone is willing to invest much time to do the analysis it is still a potential vector.

At this point I'm not sure if my most paranoid regulated institution is safe. They run 2 separate hard-wired networks to each executive (and the hard-wiring goes back to the source and never do internal and external networks meet. I've traced the Ethernet to validate their claim). There's no KVM or any other point of contact between the two networks; those allowed external access at the desk have 2 complete installations. Non-exec employees must go retrieve their inbound e-mail from a single box on the external network. In the usual world, one would believe.

That's Paranoia 101 and even then I'm not sure that the internal network is not somehow exposed.

Welcome to the mind of a regulator. Seeing as this is General Software, follow-up questions are best directed to me through PM.

EDIT: Added Acoustic Cryptanalysis to the thread title to reflect recent posting reality. Title change will only show up in posts subsequent to this one. Blame phpBB.

More important to me than the communication aspect is the infection vector. I'm not seeing this spreading by non-standard methods, just having some extras to stay in touch with the mothership.

If you can keep it out, who cares what noises it's making? No one is listening.