Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Research Inches Toward Processor-Specific Malware

samzenpus posted more than 3 years ago | from the acquiring-new-targets dept.

Security 155

chicksdaddy writes "The Windows/Office/IE monoculture is disappearing faster than equatorial glaciers — Mac OS X and iOS, Linux and Android ... and whole new application ecosystems to go with each. That's bad news for malware authors and other bad guys, who count on 9.5 out of 10 systems running Windows and Microsoft applications to do their magic. What's the solution? Why, hardware specific hacks, of course! After all, the list of companies making CPUs is far smaller than, say, the list of companies making iPhone applications. Malware targeting one or more of those processors would work regardless of what OS or applications were installed. There's just one problem: its not easy to figure out what kind of CPU a device is running. But researchers at France's Ecole Superiore d'Informatique, Electronique, Automatique (ESIEA) are working on that problem. Threatpost.com reports on a research paper that lays out a strategy for fingerprinting processors by observing subtle differences in the way they perform complex floating point calculations. The method allows them to distinguish broad subsets of processor types by manufacturer, and researchers plan to refine their methods and release a tool that can make specific processor fingerprinting a snap."

cancel ×

155 comments

Sorry! There are no comments related to the filter you selected.

Phew i'm good. (0)

Anonymous Coward | more than 3 years ago | (#34192296)

Glad no one targets my WinChip CPU for anything.

Re:Phew i'm good. (2, Informative)

bhcompy (1877290) | more than 3 years ago | (#34192316)

Yea, no malware for my Cyrix either

Re:Phew i'm good. (1)

MichaelSmith (789609) | more than 3 years ago | (#34192422)

My atmel is safe.

Re:Phew i'm good. (3, Funny)

Anonymous Coward | more than 3 years ago | (#34192618)

Yeah, cuz "cat /proc/cpupinfo" is so frickin' hard to do.

Security through obscurity FTW!

Re:Phew i'm good. (0)

Anonymous Coward | more than 3 years ago | (#34192634)

Seing as a WinChip is slow enough that running cat /proc/cpuinfo is so slow...

Software Warming (0, Offtopic)

cosm (1072588) | more than 3 years ago | (#34192312)

We need an Al Gore of receding corporate monopolies!

Re:Software Warming (2, Funny)

MrEricSir (398214) | more than 3 years ago | (#34193030)

You mean the Department of Justice?

Re:Software Warming (3, Insightful)

davester666 (731373) | more than 3 years ago | (#34193420)

The department of justice no longer does what you think it does.

It switched over the last decade or two from the department that does justice for you, to the department that does justice TO you.

It guys (1)

Octopuscabbage (1932234) | more than 3 years ago | (#34192326)

After this report 57 IT representatives quit their job in order to become store clerks.

Re:It guys (0)

Anonymous Coward | more than 3 years ago | (#34192342)

After this report 57 IT representatives quit their job in order to become store clerks.

They should go door-to-door selling magazines. I bet they would make way more money than they did at their previous respective jobs.

Re:It guys (1)

mldi (1598123) | more than 3 years ago | (#34192492)

After this report 57 IT representatives quit their job in order to become store clerks.

They should go door-to-door selling magazines. I bet they would make way more money than they did at their previous respective jobs.

What am I gonna do with 40 subscriptions to Vibe?!

Ok, maybe this is too simple but (1)

justsomecomputerguy (545196) | more than 3 years ago | (#34192350)

at least at the start of this next frontier how about testing for the chip profiling software. It's one thing to be able to "detect subtle differences" in floating point operations but another to do it while also trying to avoid detection while you're doing it.

Re:Ok, maybe this is too simple but (4, Insightful)

WrongSizeGlass (838941) | more than 3 years ago | (#34192808)

Just for my own education, how would a processor specific piece of malware 'get in' if it isn't delivered via software that can run on the host's OS? And how would it spread out of the computer it's infecting? Is it going to come with it's own ethernet drivers? It's own TCP/IP stack? If it's not relying on the OS to do its dirty work than what does it do besides figuring out your CPU type?

Re:Ok, maybe this is too simple but (2, Interesting)

macs4all (973270) | more than 3 years ago | (#34192894)

Just for my own education, how would a processor specific piece of malware 'get in' if it isn't delivered via software that can run on the host's OS? And how would it spread out of the computer it's infecting? Is it going to come with it's own ethernet drivers? It's own TCP/IP stack? If it's not relying on the OS to do its dirty work than what does it do besides figuring out your CPU type?

Exactly what I was thinking.

Correct me if I'm wrong, but doesn't ALL malware exploit vulnerabilities in an application or an OS? So, as you say, unless the malware carries its own network and likely filesystem drivers (and then WHICH filesystem, WHICH NIC?), WTF can it really DO?

Re:Ok, maybe this is too simple but (5, Insightful)

hairyfeet (841228) | more than 3 years ago | (#34193216)

Not to mention it is totally nuts from a malware writer's POV. You have roughly 93% of the business and home desktops running WinOS, with a good portion of those still running the "Hey, let's all run as admin everybody!" XP, and with the huge amounts of home users now on fast connections with NO clue as to whether they are up to date or even if their AV works, jumping through all those hoops to base your malware on a specific CPU would not only be silly it would be purposely limiting your target.

If everyone wants to know what the big targets of the future is gonna be, let this old PC repair guy fill you in: On the home front it'll be Adobe everything, thanks to them not working with MSFT to have updates to their software pushed through Windows Updates so it is ALWAYS out of date, drive by malware courtesy of social sites like FaceBook, JavaScript malware o' the day pushed by the above, and on the mobile side I'm expecting a huge iOS and Android bug any day now, even though with the shitty USA phone networks you won't be getting as much as with a cable or DSL connection, simply because all the malware guys want to go "I did it! Yep, it was me!", and finally don't forget the EVER popular "ZOMG! U Got teh Viruz!!! Run thiz and turn off your broken AV pleasz!" fake AV crap that still spreads like the clap.

So there you go. While some researcher my think the "next wave" will be some uber super hacker shit, I'm willing to bet the pickings are just too easy the way things are for most malware guys to care. Maybe when 2014 rolls around and folks have to either buy new machines or upgrade away from XP will we see things change, as UAC, ASLR, and DEP does make it harder for malware along with WoW on x64, but right now there are still hundreds of millions on XP, and if you add in the ones that will happily turn off their AV just to see the dancing bunnies [codinghorror.com] or will run "special codecs" to see teh prons, well that is a hell of a lot of easy pickings. Remember folks, criminals are just like any other predator and are inherently lazy. If they can nail lots of prey without hardly any work than that is what they WILL do, and working on these machines 6 days a week I can tell you there is a LOT of easy prey out there. No "super uber CPU specific hacks" required.

Obligatory intel bashing (4, Funny)

zill (1690130) | more than 3 years ago | (#34192366)

if( 4195835*3145727/3145727 != 4195835 ){
cpu = "Intel Pentium";
}

Re:Obligatory intel bashing (2, Insightful)

Mitchell314 (1576581) | more than 3 years ago | (#34192454)

4195835*3145727/3145727 == 4195835.00000001

Re:Obligatory intel bashing (0)

Anonymous Coward | more than 3 years ago | (#34192548)

4195835*3145727/3145727 == 4195835.00000001

True!

Re:Obligatory intel bashing (2, Informative)

wvmarle (1070040) | more than 3 years ago | (#34193376)

This depends apparently on your programming language. I know the .00000001 has to do with decimal to binary conversion which introduces this kind of errors. Anyway I just tried this in Python, and got a different result:
>>> 4195835*3145727/3145727
4195835L
>>> 4195835*3145727/3145727 == 4195835
True
>>> 4195835*3145727/3145727 == 4195835.00000001
False
>>>

Re:Obligatory intel bashing (-1, Troll)

Anonymous Coward | more than 3 years ago | (#34192836)

oh, i am so lucky to view this wonderful website and your nice discussions. Could some guys help me check my website "ukinterracialmatch.com" I have tried my best to promote it, but don't know how to make more popular. Could some one show your advise?

sure sounds interesting (2, Insightful)

Anonymous Coward | more than 3 years ago | (#34192396)

but...

where actually is the attack vector if you don't target any software platform at all?

Re:sure sounds interesting (1)

Mashiki (184564) | more than 3 years ago | (#34192638)

The firmware.

Sparc, MIPS, PowerPC, ... are practically dead (1)

KiloByte (825081) | more than 3 years ago | (#34192406)

It's really bad we have only two and a half CPU architectures in any wide use: armel and i386/amd64 -- and even worse, all smartphones use the former and big machines the latter. Using a different arch gives you extra security (by greatly reducing the amount of existing shellcode) while adding basically no issues whatsoever -- any reasonable server OS is fully portable, and having no Adobe Flash is a blessing not a curse.

Too bad, you can forget about performance-to-price, and availability is worse than abysmal.

Huh? (1)

FranTaylor (164577) | more than 3 years ago | (#34192462)

In your house, maybe.

In the server room, PowerPC is still very popular. In fact it's the only choice if you want the best straight-up single core performance.

"any reasonable server OS is fully portable" That's not true because AIX is a perfectly reasonable server OS and it's only on PowerPC.

Re:Huh? (3, Insightful)

danlip (737336) | more than 3 years ago | (#34192506)

Sorry, but I've used AIX and it is not a perfectly reasonable OS.

Re:Huh? (4, Insightful)

FranTaylor (164577) | more than 3 years ago | (#34192538)

Well that is your problem. You don't "use" AIX, you install your server applications on it and you leave it alone.

Re:Huh? (-1, Flamebait)

Anonymous Coward | more than 3 years ago | (#34193114)

Well that is your problem. You don't "use" AIX, you install your server applications on it and you leave it alone.

You *use* AIX as a platform when you install those applications. You *use* AIX to provide a secure and functional environment in which to run them. If you are running an AIX server, you have plenty of opportunity to evaluate its design. Playing the badass pragmatist doesn't change that, it just makes you look evasive.

Defensive much?

Re:Huh? (0)

Anonymous Coward | more than 3 years ago | (#34193430)

You seem like one of the guys who hate on UNIX because it doesn't ship with a GNU userland like Linux does, or something even more superficial along those lines.

If you DID take the pragmatist stance and just learn to write portable shell code, put up with things as old as Perl 5.6, deal with post-installed free software, etc, you CAN leave the OS alone and move on to more important things, like the application running on it for example.

But hey, maybe your business just can't survive without GNU tar or the latest ls flag, or whatever.

Re:Huh? (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#34193250)

The only people/servers running AIX are either retired or dead.

Re:Huh? (1, Interesting)

Anonymous Coward | more than 3 years ago | (#34193486)

Well that is your problem. You don't "use" AIX, you install your server applications on it and you leave it alone.

Actually, "you" don't use AIX at all..your dedicated IBM representative "deploys the end-to-end AIX solutions framework" on your behalf

you know those WTF? moments that come out of Japan (0)

Anonymous Coward | more than 3 years ago | (#34192914)

... AIX is like that.

Re:Huh? (1)

pullmyfinger (872625) | more than 3 years ago | (#34193296)

Please elaborate on your poor experience. I've managed AIX deployments since v3 came with support for the Power platform and I've only seen steady improvement over the years. Like any Unix distro, it has its quirks (but AIX at least documents it!).

AIX (0)

Anonymous Coward | more than 3 years ago | (#34193350)

At least they named it right. They just spelled it wrong. It SHOULD be aches.

Re:Sparc, MIPS, PowerPC, ... are practically dead (3, Insightful)

jonwil (467024) | more than 3 years ago | (#34192758)

Plenty of CPU architectures out there.
ARM is out there in embedded devices.
PowerPC is still popular in servers (and in games consoles)
Plenty of things out there using MIPS including the Playstation Portable and all kinds of home routers

And if you are talking really embedded devices, PIC, AVR and others are still going strong.
Even oldschool archtectures like the Zilog Z80 and Motorola 68000 are still going strong in many areas.

Re:Sparc, MIPS, PowerPC, ... are practically dead (1)

h4rr4r (612664) | more than 3 years ago | (#34192908)

You forgot SPARC.

Re:Sparc, MIPS, PowerPC, ... are practically dead (2, Funny)

forkazoo (138186) | more than 3 years ago | (#34193176)

You forgot SPARC.

The handful of people who haven't are doing their best.

Re:Sparc, MIPS, PowerPC, ... are practically dead (1)

gstrickler (920733) | more than 3 years ago | (#34193198)

And when you're looking for hardware specific hacks, each new microarchitecture is likely to behave differently, so each new microarchitecture is functionally a new architecture.

ARM: ARMv7 := ARMv6 := ARMv5, etc.

Intel: Sandy Bridge := Nehalem := Merom, etc.

repeat for AMD, PPC, MIPS, Cell, etc.

Even different process sizes, different steppings, and different variants within a microarchitecture may behave differently, although that's less likely.

Hacking a CPU isn't trivial. The payoff is that attacking hardware flaws may bypass OS security

Re:Sparc, MIPS, PowerPC, ... are practically dead (1)

KiloByte (825081) | more than 3 years ago | (#34193206)

ARM is out there in embedded devices.

Which I specifically named as one of the two-and-a-half architectures flourishing.

PowerPC is still popular in servers

I looked around, and there's not a single semi-mainstream vendor which sells those -- and I'm not going to order stuff from overseas.

Plenty of things out there using MIPS including the Playstation Portable

I haven't seen a single one of these, but it's a thing from 2004 that has a tiny fraction of what any low-end smartphone can do

and all kinds of home routers

These used to be MIPS-based in 1990s and early 2000s, yeah. Since then, all new ones seem to be migrating to ARM.

Re:Sparc, MIPS, PowerPC, ... are practically dead (1)

Anubis350 (772791) | more than 3 years ago | (#34193348)

PowerPC is still popular in servers

I looked around, and there's not a single semi-mainstream vendor which sells those -- and I'm not going to order stuff from overseas.

Server-side, I'm pretty sure IBM counts [wikipedia.org] as a major vendor [wikipedia.org] . Also the PS3, XBox360, and Wii all use some variant of PPC, as the GP noted. So btw do a great deal of embedded chips manufactured by such bit players (no pun intended) as, oh, say Motorola (well, Freescale now). A lot of set-top boxes and such use PPC.

Relax! (1)

jflo (1151079) | more than 3 years ago | (#34192416)

With stories like this, I always like to refer to the book of Star Trek Voyager for wisdom. Ensin Kim: "Why does everyone say 'relax' when they're about to do something terrible?"

Why hardware specific? (2, Interesting)

Musically_ut (1054312) | more than 3 years ago | (#34192418)

Isn't it still far easier to specialize malware for specific softwares rather than trying to heuristically determining the hardware being used and then trying to exploit that?

Also, how protected is the type of the processor and the other hardware used in a machine? I would imagine that exposing this information (such that your PC has a GPGPU) to software might help the software work better. To me, it seems that this gain easily outweigh the risks involved.

Re:Why hardware specific? (2, Insightful)

DigiShaman (671371) | more than 3 years ago | (#34192550)

Current software exploits are based on specific OS, Apps, and/or a combination of the two. Add in different versions and quick patching can put out the malware fires rather quickly. With hardware, there's less permutations and revisions in comparison to software.

While it's possible to patch hardware flaws with firmware and microcode updates, it's not something that happens automatically by the end user. In theory, running malware at the hardware level opens up a huge potential homogeneous field to play in.

also (1, Interesting)

Anonymous Coward | more than 3 years ago | (#34193016)

there is the possiblity of making it impossible for someone without say specialised JAG hardware to reflash the firmware, so once its compromised it cant be uncompromised. then there are the couterfiet bits of hardware with could be designed with backdoors that also lead to hardware that cannot be uncompromised, even if it goes into a super dormant state.

there are ways of communicating stenographically using timing delays in typing or network packets, so its actually starting to get pretty difficult to clean your system. not like removing a hdd and sticking it into a dock of a clean machine and wiping mbr+whole drive etc.

Re:Why hardware specific? (1)

Musically_ut (1054312) | more than 3 years ago | (#34193270)

If it has to exploit the hardware, the malware will need to have platform independent vector (!?!) which can get executed and, in turn, can run the hardware specific code on the systems. If it can get as far as executing machine code, then, umm .. I think it is still a software malware first.

Besides, which hardware platform is likely to bring in a divide bigger than the software divide we have?

Spread and large scale adoption of Hardware presumably is more difficult than software adoption.

Re:Why hardware specific? (1)

DigiShaman (671371) | more than 3 years ago | (#34193562)

Well, CPU L2 or L3 cache can be quite large and more than adequate to store and run machine code. In theory at least. Also, modern NIC processors in servers are pretty intelligent too. The Broadcom NetExtreme series come to mind.

If I were to develop malware and a SPAM botnet, I would be coding for both the CPU and NIC to inject and/or communicate directly through its own TCP/IP stack out over the Internet.

Re:Why hardware specific? (0)

Anonymous Coward | more than 3 years ago | (#34193422)

Current software exploits are based on specific OS, Apps, and/or a combination of the two.

In other words, Windows and Windows applications. Got it.

Re:Why hardware specific? (1)

olsmeister (1488789) | more than 3 years ago | (#34192614)

It's pretty hard to issue a patch for a hardware flaw.

Re:Why hardware specific? (1)

h4rr4r (612664) | more than 3 years ago | (#34192826)

No it is not. We do it all the time, what do you think microcode is?

Re:Why hardware specific? (0)

Anonymous Coward | more than 3 years ago | (#34193082)

Code written in very small font point?

Re:Why hardware specific? (1)

KeithIrwin (243301) | more than 3 years ago | (#34193248)

Microcode is what instructions from the architectural instruction set are translated into before being executed on a processor. Essentially, it's a set of specific signals to the muxes, demuxes, and various components (ALUs, register bank, L1 cache, branching unit, etc.). Microcode, unto itself, is not a patch to a hardware flaw, it's just a means of making a processor work.

What you're talking about is "writable microcode" or a "writable control store" which is when the code to microcode translation process is controlled using a rewritable store of some sort rather than hard-wired, thus allowing limited patching of the translation process which can sometimes work around hardware flaws in a manner which is transparent to the applications running on the computer.

I hate to ask, but... (3, Informative)

spywhere (824072) | more than 3 years ago | (#34192428)

"Windows/Office/IE monoculture is disappearing faster than equatorial glaciers..."
Do you actually work in corporate IT? Windows XP and IE6/7 dominate. Apple has little hope of taking hold in anything bigger than the art department at Comcast, and Linux is what the geekiest artist-type there uses at home.

I'm not advocating Windows... I'm simply pointing out that they are not going anywhere.

Re:I hate to ask, but... (2, Insightful)

Un pobre guey (593801) | more than 3 years ago | (#34192572)

They can always dream, can't they?

Re:I hate to ask, but... (1)

Eskarel (565631) | more than 3 years ago | (#34192606)

Not to mention that Android and iOS are part of the smart phone segment where there never was a Windows/Office/IE monoculture.

Re:I hate to ask, but... (1)

Grishnakh (216268) | more than 3 years ago | (#34193452)

Exactly. The Windows/Office monoculture hasn't gone anywhere, but the computing field itself has expanded a lot. Now, people do computing in many more places than just their desktop, thanks to small mobile devices, so a giant new market has opened up, and in that market, MS is a bit player. They've had their own offerings in the mobile device arena for quite a while, but it's never been very popular, and now iOS and Android are growing by leaps and bounds while MS's mobile offerings continue to languish.

On desktops and laptops, however (esp. corporate ones), Windows/Office/IE/Outlook are still king, though in many places they're still using ancient XP with little plans to upgrade to 7. So people are generally using MS's products because they have to, not because they want to.

Re:I hate to ask, but... (4, Insightful)

DrgnDancer (137700) | more than 3 years ago | (#34192640)

I dunno. I was a Linux Systems Administrator for a fortune 50 company. I'm now a Linux Systems administrator for the Federal Government. In both cases we also had limited use of Macs too. You didn't see that 10 years ago. I'll grant you "Faster than equatorial glaciers" may be hyperbole, but the monoculture is disappearing (Windows isn't disappearing by any means, just the monoculture).

To a certain extent it's also somewhat of a moot point anyway. If people are using Macs or Linux at home that's still impacting malware authors. In fact it's impacting them worse in some respects. They count on the unpatched boxes in ma and pa's bedroom for a botnet vector. Smartphones are also a growing presence on the 'Net. They're not hugely important *yet* but at the rate they're going they will be.

So yeah, for the time being you can still feel safe that 9/10 clients are Windows (which is still down a lot from 9.7/10). Smart criminals, just like smart companies, look ahead though. If trends continue as they are, 10 years from now it might be 7/10 clients (With the rest split between Macs, some Linux, and lots of mobile) . 10 years after that? Who knows?

Apple has even less hope now (2, Insightful)

Sycraft-fu (314770) | more than 3 years ago | (#34192778)

With the discontinuation of their Xservs they've quite clearly said "We don't really care about the enterprise market." Can't say I'm surprised, consumer electronics is where they've been making tons of money. However it does mean that any growth potential they had in business markets is likely to dry up. That just means the market will continue to be solidly MS for now.

Re:Apple has even less hope now (2, Interesting)

h4rr4r (612664) | more than 3 years ago | (#34192850)

The enterprise market for servers has never been solidly MS. The Xserve was not a popular product, no one wanted to pay apple prices to run a unix. if you want to do that you could have alway bought a Sun box. The rest of the enterprise wanted to run linux on commodity hardware.

Re:Apple has even less hope now (2, Informative)

wvmarle (1070040) | more than 3 years ago | (#34193492)

Personally I see Apple's strong point as the user interface, and the design of the cases they put their hardware in. Neither are important for servers.

A server has to sit in a corner, fit nicely so square (or for bigger setups: rackable) is preferred. Most of them don't have a monitor attached so a GUI is also unwanted.

Then what reason is there to pay an Apple price for a server?

Microsoft has a similar problem: their strong point is also the user interface, as that's what Windows is about after all. Windows is a desktop oriented OS, with server capabilities tacked on to it.

Re:I hate to ask, but... (1)

sheehaje (240093) | more than 3 years ago | (#34193246)

How many phones is Microsoft on? I'm sure that cuts into the 9.5 out of 10 percentages over computing platforms quite a bit. Phones aren't phones anymore, they are full blown computers.

Also, I know a lot of local governments, state governments are starting not extend their enterprise agreements with Microsoft.

I work for a sizable county government and we are moving off of Exchange/Outlook next year in favor of Zimbra. We are a 2007 shop now and were thinking of migrating to 2010, but won't. Microsoft is demanding Windows 2008 Enterprise to do things like Exchange replication, which more than triples our licensing cots. There is much talk of Microsoft ending Public Folder support after the 2010 version of Exchange in favor of full blown Sharepoint... A lot of money for government agencies now feeling big budget cuts.

We are also moving to OpenOffice (or should I say LibreOffice) for departments that didn't go Access crazy next year. After looking at how our users were using MS Office, we determined 90% of our users don't use it for much more than simple word processing. About 10% of those also used Excel.

A lot of this is being driven by the economy and the fact that we face set backs. But with this in mind, we also don't think we loose any functionality with these alternatives.

I know Windows/Office/IE is still embedded in a lot of the business culture, but there are plenty of places it isn't a "requirement" anymore, and it actually makes sense to replace it.

Nike Shoes OnSale (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#34192440)

Dear Author, Nice written,Look forward your updates,I also like this,thank you,Cheap Nike Shoes [shoes-vip.com] , Nike Shox [shoes-vip.com] On Sale at shoes-vip.com,Discount and Free Shipping,Save43%-60%

Um... (1)

pinkwarhol (1913356) | more than 3 years ago | (#34192464)




Glad to hear someone's working on this...

Am I missing something? (4, Insightful)

by (1706743) (1706744) | more than 3 years ago | (#34192502)

From TFS:

Malware targeting one or more of those processors would work regardless of what OS or applications were installed.

Ok...but how are you planning on executing that? You can write a piece of code that exploits some chip vulnerability, and compile it for Windows -- but it still gives you no advantage over just writing something which targets Windows in the first place.

And if you're capable of running arbitrary machine code on the host -- which is sort of what I take this article to suggest -- then you've got way bigger fish to fry in the security department...

Re:Am I missing something? (0)

Anonymous Coward | more than 3 years ago | (#34192568)

Apple patented something that involves forcing adverts on the iPhone calling it a feature, seems to me this is basically the same thing but called malware.

Re:Am I missing something? (5, Insightful)

antifoidulus (807088) | more than 3 years ago | (#34192570)

Actually the biggest threat would be to VMs running on some big iron machine. If you and I are both running on a VM and I can exploit a CPU bug that allows me to break out of my sandbox then your data is in trouble even if you didn't let anyone else execute code in your VM.

Re:Am I missing something? (1)

KeithIrwin (243301) | more than 3 years ago | (#34193280)

I had the same thought as the grand-parent poster, but the parent post is definitely correct. It's quite common for a lot of smaller web sites to run on VPS's. If you can hack or rent one VPS and use this to execute code which compromises the physical machine, that means that you can take over everyone else's VPS that is ever executed on that same machine. If you're trying to get malicious code onto a lot of web sites (which they are), that would be a very good way to do it. Plus, who knows what else might be living on the same machine in a different VM.

Re:Am I missing something? (2, Insightful)

phantomfive (622387) | more than 3 years ago | (#34193004)

Not only that, when was the last time you heard of an exploit that attacked a chip? I can remember hearing about a vulnerability six years ago or so, but it was hard to exploit. Such an exploit would be nice, but I don't think they happen very often.

Peak windows. (4, Insightful)

mevets (322601) | more than 3 years ago | (#34193026)

My guess is the AV companies are sensing that 'peak windows' has passed, and are manufacturing a new market.
The reason to run AV software on other platforms is to avoid inadvertently forwarding viruses to Windows users. Not a compelling story.

Catch 22 much ??? (2, Insightful)

Zero__Kelvin (151819) | more than 3 years ago | (#34192512)

"Malware targeting one or more of those processors would work regardless of what OS or applications were installed. "

This is complete bullshit. First, you have to get your code to execute on my hardware, which you aren't about to do unless you compromise my OS. If you can't get your assembly code to run on the CPU in Ring 0 on the Intel Platform, for example, your processor specific malware, no matter how clever, is useless. If you can do so, you have already compromised my OS, so your code is useless.

Re:Catch 22 much ??? (2, Insightful)

h4rr4r (612664) | more than 3 years ago | (#34192856)

Not quite. If I am only in one VM and I want to break out then this sort of thing might be quite useful. If I had already exploited the host, then yes it would be a waste of time.

Re:Catch 22 much ??? (1)

Zero__Kelvin (151819) | more than 3 years ago | (#34192882)

"If I am only in one VM"

I already said that you need to have already compromised my OS. The fact that it runs in a VM is completely immaterial. If you have compromised my paravirtualized OS, you have compromised my OS, but again you have a catch 22. We can both agree that if you have already compromised my OS, then you can continue to compromise my OS.

Re:Catch 22 much ??? (1)

h4rr4r (612664) | more than 3 years ago | (#34192918)

This lets me get further. I can now get a shot at the host from inside a vm.

I do of course agree you need a way into the hardware to begin with.

Re:Catch 22 much ??? (1)

Zero__Kelvin (151819) | more than 3 years ago | (#34193118)

I just re-read what I originally wrote, and I realized that I was attempting to imply that it was useless for compromising a machine in an OS independent manner . I can see how you thought I meant that it had no use at all under any circumstance, but we agree that as a means of accomplishing privilege escalation rather than breaking down the front door it has a use. Also, I was discussing malware rather than interactive system cracking, the latter which - almost by definition - involves knowledge of the target OS. In the malware scenario, the malware needs to have OS knowledge to get the initial privilege in order to escalate, thereby making the malware not OS independent.

Re:Catch 22 much ??? (1)

Darinbob (1142669) | more than 3 years ago | (#34192930)

My guess is that the article and summary are just a bit too vague and misleading. You could have an interpreted script or bytecode do the work, it wouldn't care what the processor was, and as for the OS it'll probably just assume something that has the script interpreter builtin or in the browser. Ie, Java, Javascript, .net, etc. Then it figures out what browser you have, what CPU type and maybe model, and a really good guess of the OS.

The processor privilege and ring 0 thing is a bit off. The whole point of malware is figuring out how to get the processor privilege it needs. Some malware can do major damage without ever having the highest processor privilege (you don't need privilege to erase all your personal files or upload an address book). If it does want higher privilege, the first step is often being able to run any arbitrary machine code at any privilege level, and then it's got the crowbar into the system and just needs to start prying to get in further. Getting to ring 0 is the goal, not the starting condition.

Processor specific malware can be very useful. It'll know that your processor has broken security features, or that double exceptions aren't recoverable, or all sorts of ideas gleaned from the errata. It knows which x86 models have bugs and which ones don't.

Re:Catch 22 much ??? (1)

Zero__Kelvin (151819) | more than 3 years ago | (#34193042)

"The whole point of malware is figuring out how to get the processor privilege it needs."

That is not the whole point of most malware. It cares about getting application level privileges running in user space, most often in an interpreted environment. If you are trying to do so in an OS independent way the security landscape changes drastically. The only way to accomplish that is with Assembly Language. Therefore the "processor privilege and Ring 0 thing" is, as Marisa Tomei said in "My Cousin Vinny" dead on balls accurate. We can certainly agree that for OS dependent code, knowing the processor might help.

The road to profit. (0)

Anonymous Coward | more than 3 years ago | (#34192516)

Step 1: Fingerprint CPU
Step 2: ????
Step 3: Profit!

(workable exploits against the CPU are far more rare than attacks against applications)

Re:The road to profit. (1)

h4rr4r (612664) | more than 3 years ago | (#34192860)

Step 1. cat /proc/cpu
Step 2. NO STEP TWO, you are done.

Re:The road to profit. (2, Insightful)

arth1 (260657) | more than 3 years ago | (#34193008)

Except that by adding the requirement of "cat /proc/cpu", you're back to being OS-specific, which defeats the premise of TFA.

CPUID registers ? (2, Insightful)

NemoinSpace (1118137) | more than 3 years ago | (#34192522)

seems a lot easier to me for the majority of cases. a little ASM goes a long way. When in doubt, ASK!
ok, now you can list all the architectures that don't specifically use CPUID, But they all (even PLC's) report what they are.

Re:CPUID registers ? (1)

Darinbob (1142669) | more than 3 years ago | (#34192976)

CPUID is an Intel x86 specific thing. Other CPU types do things differently, and they certainly don't run the same machine code. I can think of several CPUs that have no sort of identifier register. What about being able to tell if the device has an ARM9, AVR, PPC 603, etc?

CPU Microcode is the next malware frontier (1)

BKCat (844270) | more than 3 years ago | (#34192544)

The Holy Grail of malware would be to modify the microcode on the CPU. Once they can do that, they *own* the machine

Re:CPU Microcode is the next malware frontier (2, Insightful)

AuMatar (183847) | more than 3 years ago | (#34192678)

To be useful, you'd need a microcode memory big enough to fit a decent program (doubtful), and do so without breaking the integrity of the machine (almost impossible) as well as have a chip that has writable microcode caches (does anything do this, other than maybe transmeta)? Number 2 is a biggie- malware that breaks the CPU will quickly get the machine offline and RMAed. If you aren't online, you aren't doing anything useful for the malware. The trick for malware is to do what you want, while appearing as if you didn't even exist to the user.

Re:CPU Microcode is the next malware frontier (0)

Anonymous Coward | more than 3 years ago | (#34192912)

Intel processors have supported microcode upload for quite a while, since Pentium3 or whenever. AMD added support at some point during the Athlon64/Phenom line. [IIRC]

Upload is only temporary though, it doesn't 're-flash' the chip (I think the micro is hard-wired) but merely replaces the active cache so a power cycle (reset) will flush it.

The obvious thing to do with a microcode program is just to add new instructions on the unused opcodes but that's easier said than done. Alternatively, you can modify the existing instructions to remove the security tests so the instructions don't check if you are in kernel mode or not before doing an IO op or something. Ultimately though, good luck figuring out the microcode language; I'm not saying it can't be done but the language changes [by definition] with every CPU revision, Sandy Bridge is different from Nehalem (i7, i5, i3) is different from Core2 is different from Pentium4, etc.

Who sponsored the research? (3, Interesting)

Un pobre guey (593801) | more than 3 years ago | (#34192582)

So is the Ukrainian Mob giving out academic research grants these days? Not such a bad idea from their end.

Re:Who sponsored the research? (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#34192890)

PLEASE let me know how to start my site

  ------interracialsearching DOT com------- ,~a nice and free place for sexy women and rudust men, or white/blackr women and black/white men, to interact with each other. Maybe you wanna check out or tell your friends.

Not just useful for malware (1)

Angst Badger (8636) | more than 3 years ago | (#34192600)

This kind of thing would be handy to have for ordinary software, especially code that depends on floating point performance and routines that can optionally take advantage of processor-specific features (or route around misfeatures). The interface would still have to deal with the local OS, but the underlying libraries could be written without recourse to platform-specific code to identify the hardware -- especially since some operating systems either don't make that information available to apps or do so incorrectly.

i call bullshit (0)

Anonymous Coward | more than 3 years ago | (#34192612)

First all intel cpus can get the cpu and stepping number easily. So why would you need to profile floating point ops.

Second, in order to send a network packet you need to comunitate with the os device driver, the os will likely crash if you bypass the os and talk to the network card directly, so how is this virus software supost to be os agnostic.

Lastly the memory maps and perifs of arm (or other) microcontrollers are very different. If you try to write to read only memory, an exception occures and it jumps to the exception vector.

I don't get it (1)

Johnno74 (252399) | more than 3 years ago | (#34192672)

The researchers claim to be working on a tool, dubbed Proc_Scope that will use specific numerical expressions to identify the processor type, and to be working on an algorithm that can help identify a specific processor.

That all sounds quite involved and somewhat fragile.

Or you could just use the CPUID [wikipedia.org] instruction. Its been around since the original pentium.

Re:I don't get it (1)

Microlith (54737) | more than 3 years ago | (#34192712)

Assuming you're using a Pentium-class x86 platform. ARM requires something entirely different.

Re:I don't get it (1)

jrumney (197329) | more than 3 years ago | (#34193112)

Presumably Proc_Scope will run in a cross platform VM (eg Java) that allows them to start with no assumptions about the target platform at all.

Do it from Javascript (1, Interesting)

Anonymous Coward | more than 3 years ago | (#34192716)

You know, assuming Javascript engines in web browsers use the FPU to do floating point math operations, you could roughly categorize what hardware visitors to your website use.

And/or you could run a JS benchmark, and on the server side have baseline benchmark results for different web browsers and web browser versions on known hardware configurations - and then use that to deduce the user's clock speed. That is assuming that they aren't running anything else at the same time, but 99% of the time desktop systems are idle. You could do a run of 5 benchmarks over a period of say 30 seconds and throw out the outliers.

Of course you could combine this with the kind of stuff Panopticlick [eff.org] does, like detect the screen size, time zone, flash variables etc. For extra evil points, combine it with Samy Kamkar's evercookie [samy.pl] .

Re:Do it from Javascript (1)

T-Bone-T (1048702) | more than 3 years ago | (#34192940)

I'm not sure how it would appear to others but my Core i3 frequently clocks down to save electricity.

Re:Do it from Javascript (1)

arth1 (260657) | more than 3 years ago | (#34193020)

I'm not sure how it would appear to others but my Core i3 frequently clocks down to save electricity.

While your premise is correct, your conclusion is not. Downclocking wasn't added to CPUs to save electricity, but to reduce temperature. Saving electricity is a side effect.

"Faster than equitorial glaciers". . . (1)

JSBiff (87824) | more than 3 years ago | (#34192830)

It's true! He just forgot to mention *which* equator he was referring to. I believe in this case, it would be the equator of Uranus.

absurd (0)

Anonymous Coward | more than 3 years ago | (#34192980)

Platform independent malware is simply not reasonable. Different strains can be written for different systems but one piece of code to rule them all is probably a form of thought masturbation for this author, welcome to the reality.

The problems with the initial execution aside (anyone already running code on ur box can plant any strain they want anyway). The routines in malware will always be platform specific, and in some case version specific, even application specific. How can you go about harvesting information if you don't have a clue where to look? Functions need to be hooked and there is no universal function to hook for getting CCs or SSNs.

I suppose you could interact directly with the network card, but then you're going to need to build your own network stack and drivers for each of the most common types of NICs.

Re:absurd (1)

robot256 (1635039) | more than 3 years ago | (#34193150)

Platform independent malware is simply not reasonable. Different strains can be written for different systems

Exactly. Just like how dogs don't get lyme disease and birds don't get swine flu, or something like that. Writing a virus that could mutate to port itself to a different system, however, would be truly amazing.

I think I can explain the real threat here... (2, Insightful)

junglebeast (1497399) | more than 3 years ago | (#34193080)

There is no cross-platform instruction to call the CPUID assembly instruction...so you can only use CPUID if you can run native code on the computer, and if youcan do that, you've already broken in so you don't need it.

Now imagine that you are running some generic code like javascript...which has a limited instruction set and is possibly even being run in a browser based sandbox. If you can use simple floating point arithmetic to detect the processor type, and then you know that this particular processor has a flaw such that if you evaluate: "44.5 / 222.3 + 1" then the following benign string literal in javascript gets interpreted as native binary code which executes outside of the "sandbox" imposed by the limitations of the language...do you get what I'm saying?

Re:I think I can explain the real threat here... (3, Interesting)

wvmarle (1070040) | more than 3 years ago | (#34193544)

Reason to launch an attack like this (I get your idea; but no idea whether it really works like that) is that the ecosystem is smaller, just a few processors to care about. Now you're exploiting a specific bug: I wonder whether such bugs (if they are possible and exist) would last in between major revisions of Intel's or AMD's processor lines.

Regardless it makes me wonder why you need to know the processor type in the first place? Isn't it possible to craft your software in a way that if the bug is hit the next code is run as assembly (a few bytes is enough to jump to where the real code is), but if the attack fails the program will continue to execute and just launch the next attack? Trial and error basically... just try a bunch of attacks and see which works... and as soon as one works you're in and can forget about the rest of your original javascript program.

Did anyone else read this as (2, Funny)

Snufu (1049644) | more than 3 years ago | (#34193168)

'...professor specific malware?

I've had to sit through my share of boring lectures, but isn't this carrying things a bit far?

So now the French are helping the malware authors? (1)

gstrickler (920733) | more than 3 years ago | (#34193210)

This type of research doesn't appear to have any legitimate uses, it appears that it will only be useful to the malware authors.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>