Research Inches Toward Processor-Specific Malware 155
chicksdaddy writes "The Windows/Office/IE monoculture is disappearing faster than equatorial glaciers — Mac OS X and iOS, Linux and Android ... and whole new application ecosystems to go with each. That's bad news for malware authors and other bad guys, who count on 9.5 out of 10 systems running Windows and Microsoft applications to do their magic. What's the solution? Why, hardware specific hacks, of course! After all, the list of companies making CPUs is far smaller than, say, the list of companies making iPhone applications. Malware targeting one or more of those processors would work regardless of what OS or applications were installed. There's just one problem: its not easy to figure out what kind of CPU a device is running. But researchers at France's Ecole Superiore d'Informatique, Electronique, Automatique (ESIEA) are working on that problem. Threatpost.com reports on a research paper that lays out a strategy for fingerprinting processors by observing subtle differences in the way they perform complex floating point calculations. The method allows them to distinguish broad subsets of processor types by manufacturer, and researchers plan to refine their methods and release a tool that can make specific processor fingerprinting a snap."
Software Warming (Score:1, Offtopic)
Re: (Score:3, Funny)
You mean the Department of Justice?
Re: (Score:3, Insightful)
The department of justice no longer does what you think it does.
It switched over the last decade or two from the department that does justice for you, to the department that does justice TO you.
Re: (Score:2)
It guys (Score:1)
Re: (Score:2)
After this report 57 IT representatives quit their job in order to become store clerks.
They should go door-to-door selling magazines. I bet they would make way more money than they did at their previous respective jobs.
What am I gonna do with 40 subscriptions to Vibe?!
Ok, maybe this is too simple but (Score:1)
Re:Ok, maybe this is too simple but (Score:5, Insightful)
Re:Ok, maybe this is too simple but (Score:5, Insightful)
it's just fud. early stage fud. from france.
you know, research for the sake of research for the sake of getting more money to do more research.
besides than that : have they not heard of cpuid? -DDD the hardest part of this attack definetely wouldn't be figuring out which cpu the computer has.
so they're tackling the EASIEST part of this, just figuring out which cpu the running host has. they would still have to find application specific holes to get their fingerprinting code to actually run on the target systems. on top of that their fingerprinting depends on you getting to run native code on the target system, after that I suppose the aim is to raise privilidges of the running process to actually do a hack however that would still be very os/app specific.
the whole effort seems quite absurd, except from academia point of view which is to just suck in money while doing nothing.
Re: (Score:2)
Comment removed (Score:5, Insightful)
Re: (Score:2)
Word is that a lot of modern malware is starting to check the OS and not do anything that would trigger a UAC alert under Vista or Win7.
Which makes a lot of sense - AFAIK you can still establish a TCP connection and ship out the contents of the user's home directory with little fear of detection.
Re: (Score:2)
Re: (Score:3, Interesting)
It's rumour, take it with as much or as little salt as you think it needs. But a quick google for malware UAC shows:
http://www.zdnet.com/blog/security/windows-7s-default-uac-bypassed-by-8-out-of-10-malware-samples/4825 [zdnet.com]
http://www.theregister.co.uk/2009/02/04/windows_uac_flaw/ [theregister.co.uk]
And IIRC there was a piece of malware that was signed using a genuine, valid certificate that was issued to Realtek. Looks like I do RC:
http://news.softpedia.com/news/Signed-Malware-Used-Valid-Realtek-Certificate-147942.shtml [softpedia.com]
-
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
at least at the start of this next frontier how about testing for the chip profiling software.
As others have said already: cat /proc/cpuinfo
Okay, seriously: I know you mean more than that. If an application really wants to take advantage of shortcoming within a given processor type, it will necessarily have to interact with it. Problem is, it can do so in one of any number of ways. It could even infect other software and use its activity as cover to inject the tests necessary to characterise the processor's weaknesses.
It's one thing to be able to "detect subtle differences" in floating point operations but another to do it while also trying to avoid detection....
See above.
But why bother attacking the processor if you've already won your way o
Obligatory intel bashing (Score:5, Funny)
cpu = "Intel Pentium";
}
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
This depends apparently on your programming language. I know the .00000001 has to do with decimal to binary conversion which introduces this kind of errors. Anyway I just tried this in Python, and got a different result:
>>> 4195835*3145727/3145727
4195835L
>>> 4195835*3145727/3145727 == 4195835
True
>>> 4195835*3145727/3145727 == 4195835.00000001
False
>>>
Re: (Score:2)
well, that is essentially the whole basis for these researchers work. oh the academics.
Re: (Score:2)
Indeed. TFA is about identifying processors, the bit about exploits is just an attention grabber.
sure sounds interesting (Score:2, Insightful)
but...
where actually is the attack vector if you don't target any software platform at all?
Re: (Score:2)
The firmware.
Sparc, MIPS, PowerPC, ... are practically dead (Score:2)
It's really bad we have only two and a half CPU architectures in any wide use: armel and i386/amd64 -- and even worse, all smartphones use the former and big machines the latter. Using a different arch gives you extra security (by greatly reducing the amount of existing shellcode) while adding basically no issues whatsoever -- any reasonable server OS is fully portable, and having no Adobe Flash is a blessing not a curse.
Too bad, you can forget about performance-to-price, and availability is worse than aby
Huh? (Score:2)
In your house, maybe.
In the server room, PowerPC is still very popular. In fact it's the only choice if you want the best straight-up single core performance.
"any reasonable server OS is fully portable" That's not true because AIX is a perfectly reasonable server OS and it's only on PowerPC.
Re:Huh? (Score:4, Insightful)
Sorry, but I've used AIX and it is not a perfectly reasonable OS.
Re:Huh? (Score:5, Insightful)
Well that is your problem. You don't "use" AIX, you install your server applications on it and you leave it alone.
Re: (Score:2)
Re: (Score:2)
First thing you learn when you get out of your mother's basement is that a large chunk of security is risk assessment.
Okay, so a bug has been found in (obscure library). What systems have that library installed? Do they need it installed in the first place? What services do those systems carry? How much risk is the business exposed to by this bug? Can we make a quick, painless configuration change rather than upgrade a library and go through our entire testing process to check it doesn't break anything
Re: (Score:2)
Not only in servers, but most vehicles have a several PowerPC chips in them for the ECU and other ancillary units.
Re: (Score:3, Informative)
And even in your house PPC isn't dead. All current generation consoles use PPC processors.
Re: (Score:2)
And as the post pointed out, you can forget about performance-to-price and are PPC servers available from anyone other than IBM?
It is extremely rare that i see an AIX box these days, and those few companies who do have them usually have many more x86 systems.
Re:Sparc, MIPS, PowerPC, ... are practically dead (Score:4, Insightful)
Plenty of CPU architectures out there.
ARM is out there in embedded devices.
PowerPC is still popular in servers (and in games consoles)
Plenty of things out there using MIPS including the Playstation Portable and all kinds of home routers
And if you are talking really embedded devices, PIC, AVR and others are still going strong.
Even oldschool archtectures like the Zilog Z80 and Motorola 68000 are still going strong in many areas.
Re: (Score:2)
You forgot SPARC.
Re: (Score:3, Funny)
You forgot SPARC.
The handful of people who haven't are doing their best.
Re: (Score:2)
ARM is out there in embedded devices.
Which I specifically named as one of the two-and-a-half architectures flourishing.
PowerPC is still popular in servers
I looked around, and there's not a single semi-mainstream vendor which sells those -- and I'm not going to order stuff from overseas.
Plenty of things out there using MIPS including the Playstation Portable
I haven't seen a single one of these, but it's a thing from 2004 that has a tiny fraction of what any low-end smartphone can do
and all kinds of home routers
These used to be MIPS-based in 1990s and early 2000s, yeah. Since then, all new ones seem to be migrating to ARM.
Re: (Score:2)
PowerPC is still popular in servers
I looked around, and there's not a single semi-mainstream vendor which sells those -- and I'm not going to order stuff from overseas.
Server-side, I'm pretty sure IBM counts [wikipedia.org] as a major vendor [wikipedia.org]. Also the PS3, XBox360, and Wii all use some variant of PPC, as the GP noted. So btw do a great deal of embedded chips manufactured by such bit players (no pun intended) as, oh, say Motorola (well, Freescale now). A lot of set-top boxes and such use PPC.
Re: (Score:2)
>I looked around, and there's not a single semi-mainstream vendor which sells those -- and I'm not going to order stuff from overseas.
IBM isn't mainstream enough ?
Re: (Score:2)
I looked around, and there's not a single semi-mainstream vendor which sells those -- and I'm not going to order stuff from overseas.
Good thing all the hardware manufacturers ship the parts back from Asia and Mexico for you then...
Why hardware specific? (Score:2, Interesting)
Also, how protected is the type of the processor and the other hardware used in a machine? I would imagine that exposing this information (such that your PC has a GPGPU) to software might help the software work better. To me, it seems that this gain easily outweigh the risks involved.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No it is not. We do it all the time, what do you think microcode is?
Re: (Score:2)
Microcode is what instructions from the architectural instruction set are translated into before being executed on a processor. Essentially, it's a set of specific signals to the muxes, demuxes, and various components (ALUs, register bank, L1 cache, branching unit, etc.). Microcode, unto itself, is not a patch to a hardware flaw, it's just a means of making a processor work.
What you're talking about is "writable microcode" or a "writable control store" which is when the code to microcode translation proce
I hate to ask, but... (Score:4, Informative)
Do you actually work in corporate IT? Windows XP and IE6/7 dominate. Apple has little hope of taking hold in anything bigger than the art department at Comcast, and Linux is what the geekiest artist-type there uses at home.
I'm not advocating Windows... I'm simply pointing out that they are not going anywhere.
Re: (Score:3, Insightful)
Re: (Score:2)
Not to mention that Android and iOS are part of the smart phone segment where there never was a Windows/Office/IE monoculture.
Re: (Score:2)
Exactly. The Windows/Office monoculture hasn't gone anywhere, but the computing field itself has expanded a lot. Now, people do computing in many more places than just their desktop, thanks to small mobile devices, so a giant new market has opened up, and in that market, MS is a bit player. They've had their own offerings in the mobile device arena for quite a while, but it's never been very popular, and now iOS and Android are growing by leaps and bounds while MS's mobile offerings continue to languish.
Re:I hate to ask, but... (Score:5, Insightful)
I dunno. I was a Linux Systems Administrator for a fortune 50 company. I'm now a Linux Systems administrator for the Federal Government. In both cases we also had limited use of Macs too. You didn't see that 10 years ago. I'll grant you "Faster than equatorial glaciers" may be hyperbole, but the monoculture is disappearing (Windows isn't disappearing by any means, just the monoculture).
To a certain extent it's also somewhat of a moot point anyway. If people are using Macs or Linux at home that's still impacting malware authors. In fact it's impacting them worse in some respects. They count on the unpatched boxes in ma and pa's bedroom for a botnet vector. Smartphones are also a growing presence on the 'Net. They're not hugely important *yet* but at the rate they're going they will be.
So yeah, for the time being you can still feel safe that 9/10 clients are Windows (which is still down a lot from 9.7/10). Smart criminals, just like smart companies, look ahead though. If trends continue as they are, 10 years from now it might be 7/10 clients (With the rest split between Macs, some Linux, and lots of mobile) . 10 years after that? Who knows?
Apple has even less hope now (Score:3, Insightful)
With the discontinuation of their Xservs they've quite clearly said "We don't really care about the enterprise market." Can't say I'm surprised, consumer electronics is where they've been making tons of money. However it does mean that any growth potential they had in business markets is likely to dry up. That just means the market will continue to be solidly MS for now.
Re: (Score:3, Interesting)
The enterprise market for servers has never been solidly MS. The Xserve was not a popular product, no one wanted to pay apple prices to run a unix. if you want to do that you could have alway bought a Sun box. The rest of the enterprise wanted to run linux on commodity hardware.
Re: (Score:3, Informative)
Personally I see Apple's strong point as the user interface, and the design of the cases they put their hardware in. Neither are important for servers.
A server has to sit in a corner, fit nicely so square (or for bigger setups: rackable) is preferred. Most of them don't have a monitor attached so a GUI is also unwanted.
Then what reason is there to pay an Apple price for a server?
Microsoft has a similar problem: their strong point is also the user interface, as that's what Windows is about after all. Wind
Re: (Score:2)
Personally I see Apple's strong point as the user interface, and the design of the cases they put their hardware in. Neither are important for servers.
Strongly disagree on the second part: case design is very important on a server. It's almost as important as the hardware in the machine and the external interfaces (say, SAS, IPMI or Infiniband).
I'm pretty sure the Xserve had none of those interfaces, and the internal RAID controller was somewhat lackluster at that. From what I've seen of them, I'd rather have a modern Dell or HP server - the hardware is better.
Re: (Score:2)
With case design I was talking about prettiness and looks, not sturdiness or easy to build in. Consumers buying a case to put in their living room or IT people buying a case to put in a comms cupboard or server room have totally different requirements on case design.
Re: (Score:2)
How many phones is Microsoft on? I'm sure that cuts into the 9.5 out of 10 percentages over computing platforms quite a bit. Phones aren't phones anymore, they are full blown computers.
Also, I know a lot of local governments, state governments are starting not extend their enterprise agreements with Microsoft.
I work for a sizable county government and we are moving off of Exchange/Outlook next year in favor of Zimbra. We are a 2007 shop now and were thinking of migrating to 2010, but won't. Microsoft is
Am I missing something? (Score:5, Insightful)
Malware targeting one or more of those processors would work regardless of what OS or applications were installed.
Ok...but how are you planning on executing that? You can write a piece of code that exploits some chip vulnerability, and compile it for Windows -- but it still gives you no advantage over just writing something which targets Windows in the first place.
And if you're capable of running arbitrary machine code on the host -- which is sort of what I take this article to suggest -- then you've got way bigger fish to fry in the security department...
Re:Am I missing something? (Score:5, Insightful)
Re: (Score:2)
I had the same thought as the grand-parent poster, but the parent post is definitely correct. It's quite common for a lot of smaller web sites to run on VPS's. If you can hack or rent one VPS and use this to execute code which compromises the physical machine, that means that you can take over everyone else's VPS that is ever executed on that same machine. If you're trying to get malicious code onto a lot of web sites (which they are), that would be a very good way to do it. Plus, who knows what else mi
Re: (Score:3, Insightful)
Peak windows. (Score:5, Insightful)
My guess is the AV companies are sensing that 'peak windows' has passed, and are manufacturing a new market.
The reason to run AV software on other platforms is to avoid inadvertently forwarding viruses to Windows users. Not a compelling story.
Catch 22 much ??? (Score:3, Insightful)
This is complete bullshit. First, you have to get your code to execute on my hardware, which you aren't about to do unless you compromise my OS. If you can't get your assembly code to run on the CPU in Ring 0 on the Intel Platform, for example, your processor specific malware, no matter how clever, is useless. If you can do so, you have already compromised my OS, so your code is useless.
Re: (Score:3, Insightful)
Not quite. If I am only in one VM and I want to break out then this sort of thing might be quite useful. If I had already exploited the host, then yes it would be a waste of time.
Re: (Score:2)
I already said that you need to have already compromised my OS. The fact that it runs in a VM is completely immaterial. If you have compromised my paravirtualized OS, you have compromised my OS, but again you have a catch 22. We can both agree that if you have already compromised my OS, then you can continue to compromise my OS.
Re: (Score:2)
This lets me get further. I can now get a shot at the host from inside a vm.
I do of course agree you need a way into the hardware to begin with.
Re: (Score:2)
Re: (Score:2)
Certainly - this would be a very effective dispersal method, particularly if you're running a VM cluster. Break out of the 'jail' through a Windows driver or bug in the VM management interface API, and you've gained privileged access on a clustered VM host. Depending on which VM it is, and which member of a cluster, it's quite possible you've got open administrative access on the entire cluster.
That's, what, 10, 15, 30 physical servers with gobs of RAM and CPU? That alone is terrifying, but consider that th
Re: (Score:2)
The processor privilege and ring 0 thing is a bit off. The whole poi
Re: (Score:2)
That is not the whole point of most malware. It cares about getting application level privileges running in user space, most often in an interpreted environment. If you are trying to do so in an OS independent way the security landscape changes drastically. The only way to accomplish that is with Assembly Language. Therefore the "processor privilege and Ring 0 thing" is, as Marisa Tomei said in "My Cousin Vinny" dead
CPUID registers ? (Score:3, Insightful)
ok, now you can list all the architectures that don't specifically use CPUID, But they all (even PLC's) report what they are.
Re: (Score:2)
f00f bug (Score:2)
Who sponsored the research? (Score:4, Interesting)
Not just useful for malware (Score:2)
This kind of thing would be handy to have for ordinary software, especially code that depends on floating point performance and routines that can optionally take advantage of processor-specific features (or route around misfeatures). The interface would still have to deal with the local OS, but the underlying libraries could be written without recourse to platform-specific code to identify the hardware -- especially since some operating systems either don't make that information available to apps or do so i
I don't get it (Score:2)
The researchers claim to be working on a tool, dubbed Proc_Scope that will use specific numerical expressions to identify the processor type, and to be working on an algorithm that can help identify a specific processor.
That all sounds quite involved and somewhat fragile.
Or you could just use the CPUID [wikipedia.org] instruction. Its been around since the original pentium.
Re: (Score:2)
Assuming you're using a Pentium-class x86 platform. ARM requires something entirely different.
Re: (Score:2)
"Faster than equitorial glaciers". . . (Score:2)
It's true! He just forgot to mention *which* equator he was referring to. I believe in this case, it would be the equator of Uranus.
I think I can explain the real threat here... (Score:3, Insightful)
There is no cross-platform instruction to call the CPUID assembly instruction...so you can only use CPUID if you can run native code on the computer, and if youcan do that, you've already broken in so you don't need it.
Now imagine that you are running some generic code like javascript...which has a limited instruction set and is possibly even being run in a browser based sandbox. If you can use simple floating point arithmetic to detect the processor type, and then you know that this particular processor has a flaw such that if you evaluate: "44.5 / 222.3 + 1" then the following benign string literal in javascript gets interpreted as native binary code which executes outside of the "sandbox" imposed by the limitations of the language...do you get what I'm saying?
Re:I think I can explain the real threat here... (Score:4, Interesting)
Reason to launch an attack like this (I get your idea; but no idea whether it really works like that) is that the ecosystem is smaller, just a few processors to care about. Now you're exploiting a specific bug: I wonder whether such bugs (if they are possible and exist) would last in between major revisions of Intel's or AMD's processor lines.
Regardless it makes me wonder why you need to know the processor type in the first place? Isn't it possible to craft your software in a way that if the bug is hit the next code is run as assembly (a few bytes is enough to jump to where the real code is), but if the attack fails the program will continue to execute and just launch the next attack? Trial and error basically... just try a bunch of attacks and see which works... and as soon as one works you're in and can forget about the rest of your original javascript program.
Re: (Score:2)
then you're attacking/diagnosing the javascript vm. not very app agnostic at all as is hyped on article. they're calling diagnosing the floating point implementation as a 'malware attack' which is still pretty far from it. there's a dozen other better more reliable ways to find out if the browser is running on an iphone 3g or not.
the name 'proc_scope' could even be intentionally chosen to make it hard to google. on top of that, the published paper
Did anyone else read this as (Score:2, Funny)
'...professor specific malware?
I've had to sit through my share of boring lectures, but isn't this carrying things a bit far?
Re: (Score:2)
Good news everyone!
I'm selling affordable viagra and replica wristwatches on my shady Asian-domain website! Also anyone who wants to see some cute dancing bunnies and/or pornography should meet me in the alley out back!
ESIEA is not "Superiore" but "Supérieure" (Score:2, Informative)
ESIEA is "École Supérieure d'Informatique, Électronique, Automatique".
With "supérieure", not "superiore" (which is, maybe, Italian?). Please also note the usage of the accents on some of the letters (even the capitals, as allowed in French, even if some of the French people do not know their usage (!))
Merci.
(A verbatim translation of ESIEA would give something like "High School for Computer Science, Electronic and Control Engineering", however, an "École Supérieure" in
Stupid but fun research (Score:2)
This paper is really about how it is still possible to fingerprint CPUs, even without using the non-privileged CPUID instruction.
First of all, they state that using CPUID might trigger behavioral malware scanners/detectors.
Well, guess what: More or less every single program out there contains at least one CPUID instance somewhere in the runtime library code, some of them in order to avoid known bugs (like the Pentium FDIV case), and some in order to determine which forms of SIMD instructions are available (
Re: (Score:3, Informative)
Re: (Score:2)
My atmel is safe.
Re: (Score:3, Funny)
Security through obscurity FTW!
Re: (Score:2)
Exactly, while CPUID and its equivalents are usually privileged operations their results are not.
Most OSes out there will spill the beans on the platform including CPU, PCI devices, USB devices, etc to anyone. Some of that info is even handed out freely to anyone the system talks to. There is also a whole bunch of network protocols which disclose some info about the systems involved - http (Agent string), UpNP and discovery protocols like Randevous, CDP, you name it.
Re: (Score:2)
Exactly, while CPUID and its equivalents are usually privileged operations their results are not.
CPUID is not a privileged operation. Any userspace program can run it. You can see for yourself:
Re: (Score:3, Insightful)
To be useful, you'd need a microcode memory big enough to fit a decent program (doubtful), and do so without breaking the integrity of the machine (almost impossible) as well as have a chip that has writable microcode caches (does anything do this, other than maybe transmeta)? Number 2 is a biggie- malware that breaks the CPU will quickly get the machine offline and RMAed. If you aren't online, you aren't doing anything useful for the malware. The trick for malware is to do what you want, while appearing
Re: (Score:2)
You also have the problem of a very limited space in the microcode. You won't fit an email sender in there. You're unlikely to fit anything that can send network data, since it would have to do so at a below OS level and manipulate hardware. The likelihood of doing anything useful, even if you were told how to store the data there, is low to none.
Re: (Score:2)
Step 1. cat /proc/cpu
Step 2. NO STEP TWO, you are done.
Re: (Score:3, Insightful)
Except that by adding the requirement of "cat /proc/cpu", you're back to being OS-specific, which defeats the premise of TFA.
Re: (Score:2)
I'm not sure how it would appear to others but my Core i3 frequently clocks down to save electricity.
Re: (Score:2)
I'm not sure how it would appear to others but my Core i3 frequently clocks down to save electricity.
While your premise is correct, your conclusion is not. Downclocking wasn't added to CPUs to save electricity, but to reduce temperature. Saving electricity is a side effect.
Re: (Score:3, Informative)
While your premise is correct, your conclusion is not. Downclocking wasn't added to CPUs to save electricity, but to reduce temperature. Saving electricity is a side effect.
Downclocking was first added to mobile CPUs, and you can rest assured it was to save electricity (= battery).
Re: (Score:2)
Platform independent malware is simply not reasonable. Different strains can be written for different systems
Exactly. Just like how dogs don't get lyme disease and birds don't get swine flu, or something like that. Writing a virus that could mutate to port itself to a different system, however, would be truly amazing.