radBIOS: Bsides LV

#radBIOS, as given at bsides LV

Transcript

1. radBIOS Yolo audio networking
2. This guy •richo (rich-oh!) •rust warrior •duck enthusiast •security jerk for Stripe •many past lives
3. #radBIOS
4. #radBIOS “A rollicking adventure in building on top of components you don’t understand”
5. badBIOS
6. #radBIOS
7. badBIOS
8. Recap •Nation state malware • exfiltrates data via audio • infects via audio • platform agnostic; doesn’t care about your • os • hardware • Runs in uefi/bios
9. Recap •Nation state malware • exfiltrates data via audio • infects via audio • platform agnostic; doesn’t care about your • os • hardware • Runs in uefi/bios
11. Demo Time! •If you’re not good at high pitched noises speak now •This part once gave someone a nose bleed • But I’m mostly convinced it wasn’t actually my fault
12. groundstation •https://github.com/richo/groundstation •Distributed graph database •Content addressable •Eagerly distributed
13. groundstation •Originally mostly a toy •Wrote it to avoid interacting with JIRA (srsly)
14. Architecture •object graph •protocol drivers •transport drivers
15. Data Structures •Immutable graphs are neat •Only operation is insert
16. Graphs
17. Graphs
18. Graphs
19. Graphs
20. Graphs ?????
21. D’you like dags? Dags DAG Source of truth is here Root of the graph is here
22. Protocol Drivers Architecture •Protocol Drivers • Encapsulate data • Handle presentation • Handle ingestion
23. Protocol Drivers Architecture •Protocol Drivers
24. • TCP/UDP Hybrid Transport Driver Homogenousish link layer network
25. Transport Driver • Shriek UDP Broadcast to find new friends Homogenousish link layer network
26. Transport Driver • Then communicate with them Homogenousish link layer network
28. Why didn’t you just.. •Use soundmodem? •Use gnuradio? •Use $thing?
29. Quietnet • Cool project from Kate Murphy • Easy enough for a non radio person to understand • Not hugely fault tolerant • Easy to hack on and embed!
30. Quietnet
31. Encoding •Quietnet uses PSK31
32. PSK 31 •Geared toward encoding natural language •Symbols optimised for english •Doesn’t need syncwords or the like
33. How even to audio? •Audio driver gives you a stream of frames •FFT your frames into points •Walk along your points with a sliding window, looking for tones •Transform your tones into bits •Ham the bitstream into symbols •Unpack the symbols into bytes
34. SO SIMPLE right?
35. Fourier Transforms •Transform signal from its original domain • In our case time •To the frequency domain •Tl;dr let’s us answer the question “How strong was this frequency in this sample” •Programmatically, you can treat it as an array of floats
36. Fourier Transforms
37. Walking our points 0 1.25 2.5 3.75 5 1.266
38. Walking our points 0 1.25 2.5 3.75 5 2.466
39. Walking our points 0 1.25 2.5 3.75 5 4.0
40. Walking our points 0 1.25 2.5 3.75 5 3.03
41. Walking our points 0 1.25 2.5 3.75 5 1.83
42. Tones -> Bits •Naively: • Tone Present => 1 • Tone Absent => 0
43. Unambiguous Encapsulation •Ossman & Spill at Shmoocon ’14 •Linearly isolated hamming codes
44. Unambiguous Encapsulation 000000 101001 110110 011111
45. Unambiguous Encapsulation 000000 101001 110110 011111
46. Unambiguous Encapsulation 000000 101001 110110 011111 000001 -> 000000 100001 -> 101001
47. I don’t actually know DSP •Decided that I could solve all my problems with this hammer
48. First steps •My first attempt was awful •Gigantic sigils, binary encoding slapped onto PSK31
49. ihavenoideawhatimdoing.jpg
50. ihavenoideawhatimdoing.jpg
51. Actual Airgap Hopping •By this point I have a thing that Sort Of Works In The Lab •Figured it’s probably done •Slap a BSD socket interface on it, call it a day
52. Actual Airgap Hopping •Audio is hard •Duplex is harder •Doing this in a room full of jerks while I’m speaking is really damn hard
53. FAIL: Duplex •Hacked at this for ages •Concocted a bunch of exciting schemes
54. Handshaking Tone Match Tone Match
55. Handshaking: 2 Announce Random tone Duplex comms, retransmit failure
56. Reexamining •Duplex actually wasn’t really what I wanted •Didn’t allow for 1:many exfil •Complex •Error prone •Monstrosity to debug
57. D’you like dags? Dags DAG Source of truth is here Root of the graph is here
58. D’you like dags? Content Addressable Dags { name: sha1(body), data: body } Naming
59. D’you like dags? Content Addressable Dags { name: sha1(body), data: body } Naming { parents: [parents], payload: [bytes] } Encoding
60. D’you like dags? Dags DAG Source of truth is here Root of the graph is here ??????
61. (Sometimes) Dumber is better •Cranked back the hamming a little to make the messages smaller •Just keep yelling all the data all the time •Eventual consistency ftw •This got me remarkably far
62. DSP redux •I decided to actually do some research •Originally mostly didn’t out of: • Hubris • Desire to actually know how the damn thing works
63. DSP redux •UE insulates us from bitflips •Doesn’t help us at all working out where we are in the stream
64. Keying •What I’ve done so far is FSK •Read a lot about PSK •Lots of math, hard to scrutinize
65. Keying •Separate the sigil bit from the signal bits •Ham the snot out of everything afterward
66. Tones -> Bits •nFSK: • 19000hz => 1 • 17000hz => Sigil • 18000hz => 0
67. Keying
68. Keying
69. Unambiguous Encapsulation 000000 101001 110110 011111 000001 -> 000000 100001 -> 101001
70. Unambiguous Encapsulation 000000 101001 110110 011111 000001 -> 000000 100001 -> 101001 0000_0 -> 000000
71. How’s that demo going?
72. Conclusions •You probably shouldn’t use this to steal docs from journalists •You maybe should use this for a research project! •Audio isn’t super inscrutable •Hillclimbing totally works •You will get really used to coding with a splitting headache
73. gr33tz y0 •snare for tooting about #radBIOS •mossmann for schooling me about DSP •mike and dom for repeatedly telling me that my SUPER NOVEL INVENTION was created forever ago •Kate Murphy for quietnet •dragos for not killing me that time I went to cansec
74. Resources: •github.com/richo/groundstation •github.com/katee/quietnet •soundmodem •gnuradio •Me: @rich0H richo@psych0tik.net •I’ll tweet the link to these slides