Schneier on Security

Clive Robinson • July 28, 2022 11:29 AM

@ Bruce, ALL,

“Also relevant are the NSA’s capabilities—now a decade old—in this area.”

Also relevant, as @RapidGeek, and @Shoal Creek allude to, is that there is a gaping great hole in the whole “hard reset to loaded OS” process that has been in personal computers of most flavours since the 1970’s…

It’s still there, and not going anywhere any time soon, because it is one of the most usefull features IBM’s “Skunk works” stole from Apple in the 1980’s.

Apple realised that to be usefull and not a cul-de-sac / dead end a computer needed to be able to expand that is to do two basic things,

1, Have interchangable and upgradable software.
2, Have interchangable and upgradable hardware.

However they also realised there was a “Gordian Knot” issue that any hardware upgrade required a software upgrade, especially boot time storage devices.

The solution, put a basic I/O driver on the hardware device, and have it appear in the computers memory map, at a place assigned by the hardware slot it was pluged into.

So Apple asigned two kilo-bytes of space to each card slot and had a magic number in the first two bytes that identified a driver was present.

As for the OS rather than run directly from ROM it ran in part from RAM which was initialised by the “boot-up” process.

The result of both these was great flexability to expand in almost any way you could reasonably conceive.

However… That “driver code” that was run as part of the bootup, had to stay untill the OS was fully loaded so it could still be used.

Back then in the 1970’s there was no notion of security on a personal computer and especially not any idea about code signing. So even though it was a gaping security hole, it was not realised as such.

IBM for their PC did almost exactly the same only in a larger memory map the 8088/6 allowed for. Only by the 1980’s people were starting to understand that it was a security threat…

Thus this “security hole” became embedded in all IBM PC OS’s of the time and crossed a tipping point where it became a “legacy issue” that could not be reversed.

Worse every hardware slot upgrade carried the hole forward. Even UEFI still carries the security hole forwards in the name of backwards compatability.

This hole has had two majorly visable exploits,

1, BadBIOS and all that followed.
2, Lenovo consumer PC’s having un removable malware embedded in the BIOS chip.

But these were by no means the first exploits of this security hole. Many hardware designers who developed very early PC2PC communications looked at using either the PC speaker or an IR LED. We knew how to do not just the IO hole, but how to use it with another security hole which was “track zero” malware that would easily spread on floppy disks via “sneaker-net”.

So when in late 2013 Dragos Ruiu’s story about magic malware that could not be erased came out we already knew exactly how to do it, though the consense was Dragos had “flipped his lid” or was “barking at the moon”.

The first place you will find this correctly discussed was on this blog, and the “not possible” commenters came out in droves. Even though @RobertT and myself gave quite precice details of how to do it we were likewise apparently “lid flippers”. Then two universiry students took a couple of laptops into a corridor and effectively “followed the recipe” and published a paper and suddenly the whole world were believers, and lots and lots of malware quickly followed and it’s still around in various forms today.

Whilst @RobertT and myself were the first to detail it publicly, the techniques from the early to mid 1980’s behind it must have been known to hundreds of hardware engineers in the last couple of decades of the 1900’s.

So I would be more suprised than not if the NSA were not aware of this gaping security hole that by the mid 1980’s was effectively on every personal computer, mini-computers and big-iron computers.

About the only computers it was not on were microcontroller embedded systems (though it’s on many these days including just about every IoT device running a *nix clone).

For some unacountable reason the ICT industry, especially the ICTsec sub industry, apparently never learns from it’s history. Even it’s history of less than a decade ago…

As the old saying has it,

“Go figure…”

Clive Robinson • July 30, 2022 4:04 AM

@ Dave, Andy, ALL,

“In practice there’s a neverending stream of BIOS updates patching an equally neverending stream of vulnerabilities”

And that will never stop due to the “Unknown Unknown” issue of “Classes and Instances” of vulnarabilities.

As you can not solve this you can only mitigate.

One mitigation is to make the BIOS not overwritable from software. But this only mitigates attacks that need to overwrite the BIOS. It does not stop all the other classes of attack.

After a while of going around the loop you realise that the only mitigation that works is to fully issolate / segregate the computer from all kinds of input…

Which kind of makes general purpose computers pointless.

The trick is to firstly split the users into three classes,

1, SysAdmin (insider)
2, Authorised user (insider)
3, Everyone else (insiders & outsiders).

By fully issolating and segregating –removing all comms paths puting in secure container– the computer whilst being vulnerable is secure from attack as attackers can not reach it.

To use it you need to bridge the issolation by providing “mandated communications” that is the insider user has everything they type checked by instrumentation to sanitize it before it gets sent to the issolated computer.

Whilst it’s not 100% it raises the bar to a sort of sweet spot where security and usability cross at an acceptably high security level.

And that’s about the best you can do, and we knew this back in the 1950’s and 60’s long before Personal Computing came over the horizon…

Clive Robinson • July 31, 2022 5:50 PM

@ Security Sam,

In the eighties they had DAC and MAC in place.

But where…