We received the note below about spyware allegedly created for a Maryland agency with code which needs to be tested. We'd appreciate feedback on the note and the code. Beware of a sting. The code: http://cryptome.org/ExpCode.ASM ----- The note: CPR Tools Inc. of Labelle, Florida is engaged in the development of software which becomes part of the firmware BIOS of a PC motherboard and takes control of a users PC before the operating system is loaded. This enables the software to spy on the user and remain hidden to the operating system. The software is designed to be installed from a floppy disk which modifies the original BIOS, replacing it with the modified BIOS containing the "spyware" The software was developed for a government agency in Maryland. Versions of the software for a ASUS P4B266 motherboard and an IBM Netvista 8311 motherboard have been developed with other versions under development. Attached is a copy of the software, ExpCode.ASM, the version for the P4B266 motherboard. The .ASM file is assembled and converted into a .BIN file which is then pasted over a section of the original BIOS .BIN file. The checksum at the end of the BIOS is subsequently adjusted to make the BIOS checksum valid. Details: CPR Tools [http://www.cpr-tools.com] 730 East Cowboy Way Labelle, FL 33935 (863) 674-0120 Owners: Antonio Jesus Alvarez tony@netwacci.net Candy Michelle Alvarez -----
On Tue, Oct 14, 2003 at 12:44:20PM -0700, John Young wrote:
We received the note below about spyware allegedly created for a Maryland agency with code which needs to be tested. We'd appreciate feedback on the note and the code. Beware of a sting. The code:
So what? The code hooks into the bootstrap phase of the BIOS, decompresses some unspecified stuff (I have not verified whether it actually *CAN* successfully decompress anything and what algorithm it uses; just skimmed the code to see whether it tries something really spiffy) and executes the injected code at the end of the BIOS bootstrap. This is *NOT* the interesting part. The interesting part is the payload it is to deliver. The claim "This enables the software to spy on the user and remain hidden to the operating system." rather interests me. How do they achieve this in an OS-agnostic fashion? I know this may be passing premature judgement, but to be honest I think the code looks pretty amateurish and has at most beta quality. Most Romanian virus writers should be able to come up with something better in less than a day. Give them a week and they have something that works on a *MUCH* wider range of hardware than just two types of mobos/machines. Thanks for the demonstration though. Does this agency seriously think we believe they might be using the above mentioned code in a "production environment" some day? Tsk tsk tsk... Cheers, Ralf -- Ralf-P. Weinmann <rpw@uni.de>
On Tue, Oct 14, 2003 at 12:44:20PM -0700, John Young wrote:
We received the note below about spyware allegedly created for a Maryland agency with code which needs to be tested. We'd appreciate feedback on the note and the code. Beware of a sting. The code:
Note to author of code: Look into the "Scan User Flash Area" option if you ever have to pull this trick on a motherboard with an Intel BIOS. See [1] for instructions on how one might make use of it. Additional exercise: Enable "Scan User Flash Area" regardless of user setting. Cheers, Ralf [1] How to modify your PR440FXs BIOS images for netbooting http://www.beowulf.org/software/PR440FXNetboot.html -- Ralf-P. Weinmann <rpw@uni.de>
participants (2)
-
John Young -
Ralf-P. Weinmann