radBIOS: Bsides LV

radBIOS: Bsides LV

#radBIOS, as given at bsides LV

1cdddd72590e862319c7f484ecd85a1e?s=128

Richo Healey

August 04, 2015
Tweet

Transcript

  1. radBIOS Yolo audio networking

  2. This guy •richo (rich-oh!) •rust warrior •duck enthusiast •security jerk

    for Stripe •many past lives
  3. #radBIOS

  4. #radBIOS “A rollicking adventure in building on top of components

    you don’t understand”
  5. badBIOS

  6. #radBIOS

  7. badBIOS

  8. Recap •Nation state malware • exfiltrates data via audio •

    infects via audio • platform agnostic; doesn’t care about your • os • hardware • Runs in uefi/bios
  9. Recap •Nation state malware • exfiltrates data via audio •

    infects via audio • platform agnostic; doesn’t care about your • os • hardware • Runs in uefi/bios
  10. None
  11. Demo Time! •If you’re not good at high pitched noises

    speak now •This part once gave someone a nose bleed • But I’m mostly convinced it wasn’t actually my fault
  12. groundstation •https://github.com/richo/groundstation •Distributed graph database •Content addressable •Eagerly distributed

  13. groundstation •Originally mostly a toy •Wrote it to avoid interacting

    with JIRA (srsly)
  14. Architecture •object graph •protocol drivers •transport drivers

  15. Data Structures •Immutable graphs are neat •Only operation is insert

  16. Graphs

  17. Graphs

  18. Graphs

  19. Graphs

  20. Graphs ?????

  21. D’you like dags? Dags DAG Source of truth is here

    Root of the graph is here
  22. Protocol Drivers Architecture •Protocol Drivers • Encapsulate data • Handle

    presentation • Handle ingestion
  23. Protocol Drivers Architecture •Protocol Drivers

  24. • TCP/UDP Hybrid Transport Driver Homogenousish link layer network

  25. Transport Driver • Shriek UDP Broadcast to find new friends

    Homogenousish link layer network
  26. Transport Driver • Then communicate with them Homogenousish link layer

    network
  27. None
  28. Why didn’t you just.. •Use soundmodem? •Use gnuradio? •Use $thing?

  29. Quietnet • Cool project from Kate Murphy • Easy enough

    for a non radio person to understand • Not hugely fault tolerant • Easy to hack on and embed!
  30. Quietnet

  31. Encoding •Quietnet uses PSK31

  32. PSK 31 •Geared toward encoding natural language •Symbols optimised for

    english •Doesn’t need syncwords or the like
  33. How even to audio? •Audio driver gives you a stream

    of frames •FFT your frames into points •Walk along your points with a sliding window, looking for tones •Transform your tones into bits •Ham the bitstream into symbols •Unpack the symbols into bytes
  34. SO SIMPLE right?

  35. Fourier Transforms •Transform signal from its original domain • In

    our case time •To the frequency domain •Tl;dr let’s us answer the question “How strong was this frequency in this sample” •Programmatically, you can treat it as an array of floats
  36. Fourier Transforms

  37. Walking our points 0 1.25 2.5 3.75 5 1.266

  38. Walking our points 0 1.25 2.5 3.75 5 2.466

  39. Walking our points 0 1.25 2.5 3.75 5 4.0

  40. Walking our points 0 1.25 2.5 3.75 5 3.03

  41. Walking our points 0 1.25 2.5 3.75 5 1.83

  42. Tones -> Bits •Naively: • Tone Present => 1 •

    Tone Absent => 0
  43. Unambiguous Encapsulation •Ossman & Spill at Shmoocon ’14 •Linearly isolated

    hamming codes
  44. Unambiguous Encapsulation 000000 101001 110110 011111

  45. Unambiguous Encapsulation 000000 101001 110110 011111

  46. Unambiguous Encapsulation 000000 101001 110110 011111 000001 -> 000000 100001

    -> 101001
  47. I don’t actually know DSP •Decided that I could solve

    all my problems with this hammer
  48. First steps •My first attempt was awful •Gigantic sigils, binary

    encoding slapped onto PSK31
  49. ihavenoideawhatimdoing.jpg

  50. ihavenoideawhatimdoing.jpg

  51. Actual Airgap Hopping •By this point I have a thing

    that Sort Of Works In The Lab •Figured it’s probably done •Slap a BSD socket interface on it, call it a day
  52. Actual Airgap Hopping •Audio is hard •Duplex is harder •Doing

    this in a room full of jerks while I’m speaking is really damn hard
  53. FAIL: Duplex •Hacked at this for ages •Concocted a bunch

    of exciting schemes
  54. Handshaking Tone Match Tone Match

  55. Handshaking: 2 Announce Random tone Duplex comms, retransmit failure

  56. Reexamining •Duplex actually wasn’t really what I wanted •Didn’t allow

    for 1:many exfil •Complex •Error prone •Monstrosity to debug
  57. D’you like dags? Dags DAG Source of truth is here

    Root of the graph is here
  58. D’you like dags? Content Addressable Dags { name: sha1(body), data:

    body } Naming
  59. D’you like dags? Content Addressable Dags { name: sha1(body), data:

    body } Naming { parents: [parents], payload: [bytes] } Encoding
  60. D’you like dags? Dags DAG Source of truth is here

    Root of the graph is here ??????
  61. (Sometimes) Dumber is better •Cranked back the hamming a little

    to make the messages smaller •Just keep yelling all the data all the time •Eventual consistency ftw •This got me remarkably far
  62. DSP redux •I decided to actually do some research •Originally

    mostly didn’t out of: • Hubris • Desire to actually know how the damn thing works
  63. DSP redux •UE insulates us from bitflips •Doesn’t help us

    at all working out where we are in the stream
  64. Keying •What I’ve done so far is FSK •Read a

    lot about PSK •Lots of math, hard to scrutinize
  65. Keying •Separate the sigil bit from the signal bits •Ham

    the snot out of everything afterward
  66. Tones -> Bits •nFSK: • 19000hz => 1 • 17000hz

    => Sigil • 18000hz => 0
  67. Keying

  68. Keying

  69. Unambiguous Encapsulation 000000 101001 110110 011111 000001 -> 000000 100001

    -> 101001
  70. Unambiguous Encapsulation 000000 101001 110110 011111 000001 -> 000000 100001

    -> 101001 0000_0 -> 000000
  71. How’s that demo going?

  72. Conclusions •You probably shouldn’t use this to steal docs from

    journalists •You maybe should use this for a research project! •Audio isn’t super inscrutable •Hillclimbing totally works •You will get really used to coding with a splitting headache
  73. gr33tz y0 •snare for tooting about #radBIOS •mossmann for schooling

    me about DSP •mike and dom for repeatedly telling me that my SUPER NOVEL INVENTION was created forever ago •Kate Murphy for quietnet •dragos for not killing me that time I went to cansec
  74. Resources: •github.com/richo/groundstation •github.com/katee/quietnet •soundmodem •gnuradio •Me: @rich0H richo@psych0tik.net •I’ll tweet

    the link to these slides