Tag: backdoor

Cavium (被 Marvell 併購) 在 Snowden leak 中被列為 SIGINT "enabled" vendor

標題可能會有點難懂，比較簡單的意思就是在 Snowden 當年 (2013) 洩漏的資料裡面發現了不太妙的東西，發現 Cavium (現在的 Marvell) 的 CPU 有可能被埋入後門，而他們家的產品被一堆廠商提供的「資安產品」使用。

出自 X (Twitter) 上面提到的：

這段出可以從 2022 年的「Communication in a world of pervasive surveillance」這份文件裡面找到，就在他寫的 page 71 (PDF 的 page 90) 的 note 21：

While working on documents in the Snowden archive the thesis author learned that an American fabless semiconductor CPU vendor named Cavium is listed as a successful SIGINT "enabled" CPU vendor. By chance this was the same CPU present in the thesis author’s Internet router (UniFi USG3). The entire Snowden archive should be open for academic researchers to better understand more of the history of such behavior.

Ubiquiti 直接中槍...

而另一方面，在 Hacker News 上的討論「Snowden leak: Cavium networking hardware may contain NSA backdoor (twitter.com/matthew_d_green)」就讓人頭更痛了，像是當初 Cavium 就有發過新聞稿提到他們是 AWS CloudHSM 的供應商：「Cavium's LiquidSecurity® HSM Enables Hybrid Cloud Users to Synchronize Keys Between AWS CloudHSM and Private Clouds」。

而使用者也確認有從 log 裡面看到看到 Cavium 的記錄：

Ayup. We use AWS CloudHSM to hold our private signing keys for deploying field upgrades to our hardware. And when we break the CI scripts I see Cavium in the AWS logs.

Now I gotta take this to our security team and figure out what to do.

居然是 CloudHSM 這種在架構上幾乎是放在 root of trust 上的東西...

Google 也透過同樣機制蒐集使用者的行為

Update：Google 的憑證也被 revoke 了，另外 Facebook 的恢復內部使用的部分了：「Apple blocks Google from running its internal iOS apps」。

昨天是 Facebook 被發現在 iOS 上使用 Enterprise Certificate 取得使用者的行為記錄 (參考「Facebook 花錢向使用者購買他們的行為記錄」)，後來 Apple 撤銷了這張 Enterprise Certificate (因為不符合 Enterprise Certificate 的使用條款)，並且使得 Facebook 內部符合 Enterprise Certificate 的應用程式都失效。

而 Google 也被抓出幹同樣的事情，叫做 Screenwise Meter：「Google will stop peddling a data collector through Apple’s back door」。

目前 Google 自己已經下架，但這表示已經有的 spyware 還是會生效，就看 Apple 要不要拔了...

CIA 老大告訴參議員，在加密系統裡放後門是可行的，因為沒有公司可以逃離美國魔掌

如同標題講的，CIA 老大 John Brennan 告訴參議員，因為實務上不存在「Non-US encryption」，所以強制任何要進入美國的企業使用美版帶有後門的加密系統是可行的：「Non-US encryption is 'theoretical,' claims CIA chief in backdoor debate」。

CIA director John Brennan told US senators they shouldn't worry about mandatory encryption backdoors hurting American businesses.

And that's because, according to Brennan, there's no one else for people to turn to: if they don't want to use US-based technology because it's been forced to use weakened cryptography, they'll be out of luck because non-American solutions are simply "theoretical."

這位腦袋已經壞掉了啊，你知道有個叫做 China，拼做 C-h-i-n-a 的經濟體系嗎... 然後中美共用同一套有後門的加密系統瞬間就會被一堆人打槍，如果真的發生，還有個歐盟... 而且這些事情只是促進以色列的安全系統加速脫離美國掌控啊？以色列才是目前資安的超級強國啊...

這世界上有太多已經不是掌握在美國的東西了啊...

在 Python 的 pip、Nodejs 的 npm、Ruby 的 RubyGems 上面放木馬研究？

在 Python 領域裡常用 pip 安裝軟體：

$ pip install reqeusts

或是：

$ sudo pip install reqeusts

其他的平台也大致類似於這樣的動作。而在「Typosquatting programming language package managers」這篇文章裡，作者用 typo 之類的方式列出可能的名稱，像是這樣的名稱：

$ sudo pip install reqeusts

然後在這三個平台上發動攻擊，上傳了數百個套件並且觀察：

All in all, I created over 200 such packages and equipped them with a small program and uploaded them over the course of several months. The idea is to add some code to the packages that is executed whenever the package is downloaded with the installing user rights.

而這是「成果」：

用 DNS 控制的後門

在「Wekby APT Gang Using DNS Tunneling for Command and Control」這邊看到用 DNS 做為控制的後門系統，原報導是「New Wekby Attacks Use DNS Requests As Command and Control Mechanism」。

用 DNS 控制的穿透性比 HTTPS 高不少，被拿來做為 APT 類的攻擊威脅高不少...

關於 Juniper ScreenOS 防火牆被放後門的研究

一樣是從 Bruce Schneier 那邊看到的：「Details about Juniper's Firewall Backdoor」，原始的研究連結在「Cryptology ePrint Archive: Report 2016/376」這邊。

ScreenOS 被放了兩個後門，一個是 SSH 的後門：

Reverse engineering of ScreenOS binaries revealed that the first of these vulnerabilities was a conventional back door in the SSH password checker.

另外一個是「Dual EC 的 Q 值」被放了後門，而「NIST 所制定的 Dual EC 的 Q 值」本身就是個後門，所以有人把這個後門又給換掉了：

The second is far more intriguing: a change to the Q parameter used by the Dual EC pseudorandom number generator. It is widely known that Dual EC has the unfortunate property that an attacker with the ability to choose Q can, from a small sample of the generator's output, predict all future outputs. In a 2013 public statement, Juniper noted the use of Dual EC but claimed that ScreenOS included countermeasures that neutralized this form of attack.

第二個後門更發現嚴重的問題，Juniper 所宣稱的反制措施根本沒被執行到：

In this work, we report the results of a thorough independent analysis of the ScreenOS randomness subsystem, as well as its interaction with the IKE VPN key establishment protocol. Due to apparent flaws in the code, Juniper's countermeasures against a Dual EC attack are never executed.

也因此團隊確認選定 Q 值的人可以輕易的成功攻擊 IPSec 流量：

Moreover, by comparing sequential versions of ScreenOS, we identify a cluster of additional changes that were introduced concurrently with the inclusion of Dual EC in a single 2008 release. Taken as a whole, these changes render the ScreenOS system vulnerable to passive exploitation by an attacker who selects Q. We demonstrate this by installing our own parameters, and showing that it is possible to passively decrypt a single IKE handshake and its associated VPN traffic in isolation without observing any other network traffic.

Linux Mint 網站被黑，ISO 被加料

Linux Mint 官方放出警告，通知使用者網站被黑以及 ISO 被加料的資安事件：「Beware of hacked ISOs if you downloaded Linux Mint on February 20th!」，開頭的說明：

Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.

不幸中獎的人建議的步驟是先離線，然後備份資料，再用確認安全的 ISO image 重新安裝，並且修改各網站的密碼 (尤其是 mail，可以被拿來重設各種服務)：

Put the computer offline.
Backup your personal data, if any.
Reinstall the OS or format the partition.
Change your passwords for sensitive websites (for your email in particular).

荷蘭政府捐贈五十萬歐元給 OpenSSL

在一堆政府想要立法放後門進系統的情況下，荷蘭政府則反對這樣的想法，並且決定捐贈五十萬歐元 (目前約五十四萬美金) 給 OpenSSL：「Dutch govt says no to backdoors, slides $540k into OpenSSL without breaking eye contact」：

The Dutch government has formally opposed the introduction of backdoors in encryption products.

A government position paper, published by the Ministry of Security and Justice on Monday and signed by the security and business ministers, concludes that "the government believes that it is currently not appropriate to adopt restrictive legal measures against the development, availability and use of encryption within the Netherlands."

以及：

The formal position comes just months after the Dutch government approved a €500,000 ($540,000) grant to OpenSSL, the project developing the widely used open-source encryption software library.

Mac OS X 的安全性漏洞：蘋果沒打算修 10.9 以下的版本...

在「Hidden backdoor API to root privileges in Apple OS X」這邊揭露了這個漏洞 (接近於後門的設計)。

10.10.3 修正了這個問題，但沒打算修 10.7.x 到 10.9.x 的版本：

Apple has now released OS X 10.10.3 where the issue is resolved. OS X 10.9.x and older remain vulnerable, since Apple decided not to patch these versions. We recommend that all users upgrade to 10.10.3.

從 2014 年十月發現回報，2015 年一月蘋果建立 CVE-2015-1130，到 2015 年四月才正式修復 10.10.x 的部份：「About the security content of OS X Yosemite v10.10.3 and Security Update 2015-004」。

靠靠，我不想升到 10.10 啊...

Cisco 會將硬體寄送到貨運商，以提高 NSA 攔截安裝後門的難度

在「To Avoid NSA Interception, Cisco Will Ship To Decoy Addresses」這篇看到的報導，出自「Cisco posts kit to empty houses to dodge NSA chop shops」這篇。

去年 Snowden 揭露的資料顯示 NSA 會攔截 Cisco 的硬體，並且在上面安裝後門再打包寄出：「Greenwald alleges NSA tampers with routers to plant backdoors」：

"The NSA routinely receives – or intercepts – routers, servers and other computer network devices being exported from the US before they are delivered to the international customers."

The agency then implants backdoor surveillance tools, repackages the devices with a factory seal and sends them on. The NSA thus gains access to entire networks and all their users.

不過 Cisco 的反應好慢，去年五月就有的消息，現在才提出改善方案。

改善的方法是寄送到集散地，再請人去拿。讓 NSA 之類的單位想要攔截的成本提高。