Research Inches Toward Processor-Specific Malware 155
chicksdaddy writes "The Windows/Office/IE monoculture is disappearing faster than equatorial glaciers — Mac OS X and iOS, Linux and Android ... and whole new application ecosystems to go with each. That's bad news for malware authors and other bad guys, who count on 9.5 out of 10 systems running Windows and Microsoft applications to do their magic. What's the solution? Why, hardware specific hacks, of course! After all, the list of companies making CPUs is far smaller than, say, the list of companies making iPhone applications. Malware targeting one or more of those processors would work regardless of what OS or applications were installed. There's just one problem: its not easy to figure out what kind of CPU a device is running. But researchers at France's Ecole Superiore d'Informatique, Electronique, Automatique (ESIEA) are working on that problem. Threatpost.com reports on a research paper that lays out a strategy for fingerprinting processors by observing subtle differences in the way they perform complex floating point calculations. The method allows them to distinguish broad subsets of processor types by manufacturer, and researchers plan to refine their methods and release a tool that can make specific processor fingerprinting a snap."
sure sounds interesting (Score:2, Insightful)
but...
where actually is the attack vector if you don't target any software platform at all?
Re:Obligatory intel bashing (Score:3, Insightful)
Am I missing something? (Score:5, Insightful)
Malware targeting one or more of those processors would work regardless of what OS or applications were installed.
Ok...but how are you planning on executing that? You can write a piece of code that exploits some chip vulnerability, and compile it for Windows -- but it still gives you no advantage over just writing something which targets Windows in the first place.
And if you're capable of running arbitrary machine code on the host -- which is sort of what I take this article to suggest -- then you've got way bigger fish to fry in the security department...
Re:Huh? (Score:4, Insightful)
Sorry, but I've used AIX and it is not a perfectly reasonable OS.
Catch 22 much ??? (Score:3, Insightful)
This is complete bullshit. First, you have to get your code to execute on my hardware, which you aren't about to do unless you compromise my OS. If you can't get your assembly code to run on the CPU in Ring 0 on the Intel Platform, for example, your processor specific malware, no matter how clever, is useless. If you can do so, you have already compromised my OS, so your code is useless.
CPUID registers ? (Score:3, Insightful)
ok, now you can list all the architectures that don't specifically use CPUID, But they all (even PLC's) report what they are.
Re:Huh? (Score:5, Insightful)
Well that is your problem. You don't "use" AIX, you install your server applications on it and you leave it alone.
Comment removed (Score:3, Insightful)
Re:Am I missing something? (Score:5, Insightful)
Re:I hate to ask, but... (Score:3, Insightful)
Re:I hate to ask, but... (Score:5, Insightful)
I dunno. I was a Linux Systems Administrator for a fortune 50 company. I'm now a Linux Systems administrator for the Federal Government. In both cases we also had limited use of Macs too. You didn't see that 10 years ago. I'll grant you "Faster than equatorial glaciers" may be hyperbole, but the monoculture is disappearing (Windows isn't disappearing by any means, just the monoculture).
To a certain extent it's also somewhat of a moot point anyway. If people are using Macs or Linux at home that's still impacting malware authors. In fact it's impacting them worse in some respects. They count on the unpatched boxes in ma and pa's bedroom for a botnet vector. Smartphones are also a growing presence on the 'Net. They're not hugely important *yet* but at the rate they're going they will be.
So yeah, for the time being you can still feel safe that 9/10 clients are Windows (which is still down a lot from 9.7/10). Smart criminals, just like smart companies, look ahead though. If trends continue as they are, 10 years from now it might be 7/10 clients (With the rest split between Macs, some Linux, and lots of mobile) . 10 years after that? Who knows?
Re:CPU Microcode is the next malware frontier (Score:3, Insightful)
To be useful, you'd need a microcode memory big enough to fit a decent program (doubtful), and do so without breaking the integrity of the machine (almost impossible) as well as have a chip that has writable microcode caches (does anything do this, other than maybe transmeta)? Number 2 is a biggie- malware that breaks the CPU will quickly get the machine offline and RMAed. If you aren't online, you aren't doing anything useful for the malware. The trick for malware is to do what you want, while appearing as if you didn't even exist to the user.
Re:Sparc, MIPS, PowerPC, ... are practically dead (Score:4, Insightful)
Plenty of CPU architectures out there.
ARM is out there in embedded devices.
PowerPC is still popular in servers (and in games consoles)
Plenty of things out there using MIPS including the Playstation Portable and all kinds of home routers
And if you are talking really embedded devices, PIC, AVR and others are still going strong.
Even oldschool archtectures like the Zilog Z80 and Motorola 68000 are still going strong in many areas.
Apple has even less hope now (Score:3, Insightful)
With the discontinuation of their Xservs they've quite clearly said "We don't really care about the enterprise market." Can't say I'm surprised, consumer electronics is where they've been making tons of money. However it does mean that any growth potential they had in business markets is likely to dry up. That just means the market will continue to be solidly MS for now.
Re:Ok, maybe this is too simple but (Score:5, Insightful)
Re:Catch 22 much ??? (Score:3, Insightful)
Not quite. If I am only in one VM and I want to break out then this sort of thing might be quite useful. If I had already exploited the host, then yes it would be a waste of time.
Re:Am I missing something? (Score:3, Insightful)
Re:The road to profit. (Score:3, Insightful)
Except that by adding the requirement of "cat /proc/cpu", you're back to being OS-specific, which defeats the premise of TFA.
Peak windows. (Score:5, Insightful)
My guess is the AV companies are sensing that 'peak windows' has passed, and are manufacturing a new market.
The reason to run AV software on other platforms is to avoid inadvertently forwarding viruses to Windows users. Not a compelling story.
I think I can explain the real threat here... (Score:3, Insightful)
There is no cross-platform instruction to call the CPUID assembly instruction...so you can only use CPUID if you can run native code on the computer, and if youcan do that, you've already broken in so you don't need it.
Now imagine that you are running some generic code like javascript...which has a limited instruction set and is possibly even being run in a browser based sandbox. If you can use simple floating point arithmetic to detect the processor type, and then you know that this particular processor has a flaw such that if you evaluate: "44.5 / 222.3 + 1" then the following benign string literal in javascript gets interpreted as native binary code which executes outside of the "sandbox" imposed by the limitations of the language...do you get what I'm saying?
Comment removed (Score:5, Insightful)
Re:Software Warming (Score:3, Insightful)
The department of justice no longer does what you think it does.
It switched over the last decade or two from the department that does justice for you, to the department that does justice TO you.
Re:Ok, maybe this is too simple but (Score:5, Insightful)
it's just fud. early stage fud. from france.
you know, research for the sake of research for the sake of getting more money to do more research.
besides than that : have they not heard of cpuid? -DDD the hardest part of this attack definetely wouldn't be figuring out which cpu the computer has.
so they're tackling the EASIEST part of this, just figuring out which cpu the running host has. they would still have to find application specific holes to get their fingerprinting code to actually run on the target systems. on top of that their fingerprinting depends on you getting to run native code on the target system, after that I suppose the aim is to raise privilidges of the running process to actually do a hack however that would still be very os/app specific.
the whole effort seems quite absurd, except from academia point of view which is to just suck in money while doing nothing.