Schneier on Security

Clive Robinson • October 9, 2011 4:11 AM

@ Gabriel,

There are a number of ways the flash memory in various parts of a PC can be changed and often it depends on where it is.

As some know even CPU chips contain flash memory to correct “bugs” in the micro code etc, sometimes protected by code signing sometimes not. And flash memory hides away in other even less obvious places, sometimes known only to the chip manufacture and those who might have worked there at some point.

With regards,

“However, being a classified environment, no PC should be used unless they know how to clear every bit of programmable memory/storage on that system.”

That’s the ‘ideal’ but in practice there are two many unknowns one of which is “second source” components.

We know there are counterfit chips entering the supply lines, sometimes these are obvious in use and sometimes they are not. For instance a lower spec part having the package markings altered to make it look like a higher spec part, and in the past the chip for chip price difference was a couple of hundred USD, so well worth a little effort…

[How do they get away with this? simple as “overclockers” know you can get away with quite a bit of abuse this way. One reason for this is that. quite often the actual silicon inside the chip is of higher spec than the package markings indicate. This happens because the chip manufacturer trys to make all the chips to the higher spec to start off with and yield patterns dictate what actually makes the individual specs or not, but sales and marketing determins the quantaties of what get sold at what spec.]

Some other chips are compleate duds slipped in amongst real chips thus usually getting by “goods inward test” that uses “10% sampling” not 100% test.

And some in the past were actually fakes at the silicon level that were made using stolen IP etc.

However there is a newish game in town based on the fact for various reasons even the chip designers don’t actually know what goes onto their chips.

This is because they don’t design from the “transistor up” any longer but use libraries of functional blocks often purchased in under licence from other companies.

Likewise most “chip designers” don’t actually manufacture the chips they sub contract this out to just a handfull of fab plants around the world.

If you have a look at past discussions between Nick P, RobertT and myself you will see that there is in effect no real security in the process.

So how do you tell if your chip design has been compromised and had extra malicious features added or not? The simple answer is you cann’t…

So the manufactures of PC motherboards and IO boards cann’t tell either, thus nor can those buying the COTS into a project secret or otherwise…

This might account for why the US Gov DoD is sponsering research projects into changing this state of afairs.

However there is an other problem COTS projects have and that is the speed of change in the market. Just the collection, colation and checking of the paperwork for a PC motherboard is longer than the likely manufacturing life of the motherboard.

Basically the cycle of continuous improvment in chip revisions, interchangability of chip parts etc etc means that quite often many of the parts will actually change during the design and manufacturing cycle which can be less than a year…

COTS might be seductivly cheap, but the hidden price of “not knowing” can render any such price advantage non existant.

Finally, there is the issue of what is secret and what is not, take a GPS receiver module, if it goes in a mobile phone it’s not secret, if it goes in a drone then it might be secret. But as we know increasingly soldiers are taking mobile smart phones onto the battle field as they work way way better than the kit they get issued with. Thus with an increasingly greater probability insecure comms equipment is going to end up on the battle field in areas where the equipment should be classified to the higher levels. Such insecure equipment represents a real EmSec issue especialy when it comes within a certain range of secure equipment.

But COTS is also less reliable thus has a higher turn over in component parts, this has a significant cost in “secure disposal” and with the likes of thumb drives and smart phones it is beyond control already.

COTS is a security nightmare but the lid of the Pandora box has been opened and we are going to have to live with the consiquences…

Clive Robinson • October 9, 2011 12:15 PM

@ Gabriel,

“First, my apologies, with my back hurting me, I must not have paid attention when I wrote Cliff”

No worries, I suffer from amongst other things chronic back pain, for which other medical conditions stoop me taking normal NSAID pain killers, which leaves the CNSD type opiates and their analogues which unfortunatly stop the old grey porridge working the way it should (and give mild hallucinations). Having recently hurt my back in a small accident (I was not looking…) I’ve been a bit out of (it) myself, and cannot concentrate for more than a few minutes hence my lack of comments recently 8(

I agree that as described in the article those involved with sorting out this particular malware attack do not appear to have acquitted themselves that well. However I reserve judgment due to the way the journo has written the piece (and when it comes to malware reporting few journos appear to be able to grasp the details accuratly or avoid sensationalism). Oh and there is also the issue of “painting it big” which the APT mob are fond of doing.

What I will note is that crossing the air gap the way it did is one of a number of ways I worked out how to propogate “fire and forget” malware across “air gaps” to the likes of voting machines etc. Which leaves the questions of,

1, targeting.
2, phoning home.
3, in AV definiton files

That is was the keylogging software “targeted” at these specific systems or was it more general, aimed at anything .mil or just anything.

And importantly did it contain a mechanism to get the logged key strokes back across the “air gap” and back to a speciffic destination.

Further if it was “known malware” in a standard AV companies definition files would tell us quite a bit more about it and why it was not picked up before crossing the air gap.

If the malware was more general I would have expected it to have been picked up long before it got close to these systems. The fact that it was not picked up gives us a number of potential clues,

A, If not specificaly targeted, it was either cleaver malware or the general level of IS security on .mil is not good.

B, It is likely that these systms are at most one hop away from the Internet or other infection vector, or again the general level of IS security on .mil is not good.

C, If the malware is designed to cross air gapped systems in both directions then it is more sophisticated than the majority of malware and the game has gone up another notch.

The problem is we don’t know quite enough to say more definatly, which also makes me wonder if the whole incident has been less than objectivly reported for some reason.

As ever in these things we need more details to eliminate hypotheses (but I guess they are not going to get reported)