badBIOS revisited - it is possible to bridge the airgap after all

[40hz]

This topic came up in an earlier DoCo post started by Renegade here.

[attach]

[ewemoa]

Nice find.

With a higher bandwidth, it might be interesting to use as an alternative network

[40hz]

^Yeah. My thoughts exactly. An acoustic mesh network sounded intruguing - and useful

[ewemoa]

Could we practice injecting into the network by voicce?

[x16wda]

Could we practice injecting into the network by voicce?

How about with a whistle?  Maybe a nice cheap one from a box of crunchy sugar-laden cereal...

[ewemoa]

Is that a historical reference?  Perhaps it's actually doable as may be it's doubtful humans can produce the necessary sounds with their in-born equipment

[40hz]

@x16wda- LOL! Worked for Mr. Draper (aka Cap'n Crunch). It could work for us!  

--------------------

Is that a historical reference?

You betcha! Look here.

[attach]

[Stoic Joker]

Zoiks! 20bps is a lot more respectable a speed than previously thought. Even with a high overhead you can still pack a lot of sneaky in a pipe that size.

[40hz]

Zoiks! 20bps is a lot more respectable a speed than previously thought. Even with a high overhead you can still pack a lot of sneaky in a pipe that size.

Yup. Something small. Maybe a fork bomb such as [# {‘s -m (){ :| :& };:] y'know?

(Note: I pooched the above string. It's purely for illustration purposes. It doesn't run as is. )

[Stoic Joker]

Zoiks! 20bps is a lot more respectable a speed than previously thought. Even with a high overhead you can still pack a lot of sneaky in a pipe that size.

Yup. Something small. Maybe a fork bomb such as [# {‘s -m (){ :| :& };:] y'know?

(Note: I pooched the above string. It's purely for illustration purposes. It doesn't run as is. )

So...I wonder how many watch lists I'm on now for googling that?? ...Not really a "Linux Guy" so the term didn't ring a bell right away.

There are actually some much shorter variants on that theme ... that I may play with this evening using a VM as a target.

[40hz]

There are actually some much shorter variants on that theme ... that I may play with this evening using a VM as a target.

Knock yourself out...or just blow some poor VM off the face of the earth. I sure did when I first learned about that sort of exploit!

[SeraphimLabs]

First time I played with a fork bomb, I turned it loose on a benchtop machine. Poor old Sparc-powered Sun4U, the linux load was up to 2600 and it was still stable. A sign? Maybe.

What interests me is how it is able to infect other machines on the other side of the airgap. Somehow I don't think most computers routinely check their microphones for incoming data, let alone execute data recorded from the air.

You would have to first breach the airgrap, but once you did you could control stuff across it.

[40hz]

What interests me is how it is able to infect other machines on the other side of the airgap. Somehow I don't think most computers routinely check their microphones for incoming data, let alone execute data recorded from the air.

Correct. The problem is primarily on machines that do have (and leave) the microphone enabled. The paper mentioned Skype and related users. But any infection that availed itself of this concept would not need to be limited to acoustic communications. It merely adds yet another vector for infection (as you noted) to the palette of methods we're already familiar with.

For example, suppose you could infect a machine in the usual way (i.e. wire, wireless, media, download), and covertly enable the sound system to transmit keystroke data. And also have the microphone listening for an "I'm listening" signal from a zombie routing machine to start playing it. Then that same zombie device could start recording and transmitting your keystrokes elsewhere via whatever network it's connected to for analysis and possible later use.

It's not so much what this can do now. But give it some time. Just sitting with some of my "in the biz" cronies, we came up with a few dozen viable ideas. That was without even trying. And none of us are real hacker types. Just imagine what the real professional 'naughty folks' will come up with.

[Innuendo]

(see attachment in previous post)
John Draper - THE Man!

This guy looks like he protected his PCs from this acoustic malware by blaring the Grateful Dead at loud volumes while he was computing.

[Vurbal]

I'll stick with Motorhead for my malware protection.