Re: Stego-empty hard drives... (fwd)
Forwarded message:
Date: Tue, 22 Sep 1998 20:29:28 -0400 From: Sunder <sunder@brainlink.com> Subject: Re: Stego-empty hard drives... (fwd)
Why would they implement it when they can simply have their software scan the BIOS code if that's what they feared? It may cost them $10k each, but it'll cost them millions to design and scan every notebook type on the planet, and
No, again, they only have to scan the BIOS types and there are only a couple thousand (if that many) of those. It really isn't that complicated, there are only a few cpu's, there are only a few glue chip sets, only a few video driver chip sets, only a few LCD panels, etc. Admitted when multiplied together there are a lot of combinations. Now the board manufacturers, the BIOS manufacturers, and the various glue chipset makers get together and share data and the manufacturers look to their marketing to define their target point. Then they do a cost analysis on the chipset combo's and pretty soon you find the market only handles a handful of fundamentaly different machines. If there was as much variety at the hardware level as you assume nobody could afford to introduce new computers every few months.
then they'll have to get their hands on newer models as soon as they hit the market. You're talking about a project that's bigger in magnitude than the NSA.
No it isn't. All it takes to get the BIOS before it hits the market is get a license agreement with the BIOS manufacturer. Hell, when I worked at Compu-Add we did this sort of stuff with Award and Phoenix all the time. We would get alpha copies to test in our new hardware on a regular basis.
Why should YOUR BIOS need to contain encryption code or device drivers for that matter? All it needs to do is to HIDE the existance of the extra partition.
And the code in the BIOS which means it needs to be hidden just like some viruses. Realisticaly it isn't this complicated. All one needs to do is write a program that allows the operator to talk directly to the hard drive controller. At that point it's a trivial matter to go out and find those hidden partitions. You could use normal drive recovery software if you had a mind, and that only costs a few hundred to a few thousand dollars and can be bought in the back of Computer Shopper.
You patch your BIOS by replacing a few bytes of code with CALL's and NOP's. Maybe 4-8 bytes at most to modify. The routine that checks for the track range is only several bytes:
Somehwere in INT13 code: blah blah blah CALL biospatch NOP ; to fill in the overwritten code to the next opcode
biospatch PUSH AX ;save the register if you need it MOV AX,switch ;get the value of the hack switch switch JE popbye POP AX CMP AX,1234 ;or whatever register or whatever value JLE bye deny MOV AL,FAIL ;some reg and some value that says error, likely AL RET
popbye POP AX bye ;insert the code that you overwrote with your CALL to this patch re RET
Homework: Someone please take this code, optimize it for size and build a TSR patching INT 13 that JIM can install and run under DOS.
Don't bother, I already know how to do that. This would stand out like a sore thumb. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage@ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------
Jim Choate wrote:
If there was as much variety at the hardware level as you assume nobody could afford to introduce new computers every few months.
Whatever.
Realisticaly it isn't this complicated. All one needs to do is write a program that allows the operator to talk directly to the hard drive controller. At that point it's a trivial matter to go out and find those hidden partitions. You could use normal drive recovery software if you had a mind, and that only costs a few hundred to a few thousand dollars and can be bought in the back of Computer Shopper.
Yes, and depending on the threat model this was about 5-6 on the last I've last sent. To get around that, you either modify the hard drive's on board controller, or you build a CPU emulator. There is one that's freely available called Bochs which will do this. They can happily boot from their floppy and talk directly to your virtual "hardware" and you still get through. Yeah, I know, ol'e paranoid Jim will reply to this using the word "Tempest" signature, to which I reply, if you're that paranoid, tempest shield your notebook and put in several RF transmitters to spit back pre-recorded tempest noise to play in synch. Shit, and why not? If you're gonna get THAT paranoid, you might as well take all the precautions in the universe. Oh, it's too expensive? Well that's just waaay too fucking bad. Gee, but one would have to think, why would they go to that extent and expense to find hidden bits of data on your drives, and not do body cavity searches and MRI and XRay scans of your body? Hell, why don't they buy electron tunneling microscopes just incase you might have encoded your data on the surface of that perfectly innocent looking CD jewel case in which you're carrying your music?
Don't bother, I already know how to do that.
This would stand out like a sore thumb.
Shaaa, now that I've shown you how, of course you already know how to do that. Now that I've shown you the code and told you how it works, of course to you it would stand out like a sore thumb because you know what to look for. The question is will it stand out to the minimum wage customs drone? You seem to think these guys are actually super spies, not clueless overpaid (for their level of skills) bored burrowcrats working on an assembly line. You're over estimating their abilities by at least four orders of magnitude there. Gee, I bet you use RSA with 65536 bits too and superencrypt with 3DES, IDEA, and Blowfish and Misty. -- =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Sunder |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ==========================
participants (2)
-
Jim Choate -
Sunder