8 ms·
I have a slow burn project where I simulate a supply chain attack on my own motherboard. You can source (now relatively old) Intel PCH chips off Aliexpress that
by invokestatic 8mo ago
I have a slow burn project where I simulate a supply chain attack on my own motherboard. You can source (now relatively old) Intel PCH chips off Aliexpress that are “unfused” and lack certain security features like Boot Guard (simplified explanation). I bought one of these chips and I intend to desolder the factory one on my motherboard and replace it with the Aliexpress one. This requires somewhat difficult BGA reflow but I have all the tools to do this.
I want to make a persistent implant/malware that survives OS reinstalls. You can also disable Intel (CS)ME and potentially use Coreboot as well, but I don’t want to deal with porting Coreboot to a new platform. I’m more interested in demonstrating how important hardware root of trust is.
- Nextgrid 8mo ago> persistent implant/malware that survives OS reinstalls Try attacking NIC, server BMC or SSD firmware. You will achieve your goal without any hardware replacement needed.
- invokestatic 8mo agoYeah, but that doesn’t give me a reason to use the hot air station and hot plate collecting dust on my desk ;)
- cbsks 8mo agoNothing drives more creativity from me than a tool in need of a project.
- da_chicken 8mo agoI mean, you could also do smartphone repairs.
- mschuster91 8mo ago> I want to make a persistent implant/malware that survives OS reinstalls. You want to look into something called "Windows Platform Binary Table" [1]. Figure out a way to reflash the BIOS or the UEFI firmware for your target device ad-hoc and there you have your implant. [1] https://news.ycombinator.com/item?id=19800807 https://news.ycombinator.com/item?id=19800807
- ronsor 8mo agoOnly works if the target is running Windows (paranoid people might be on Linux), so you'd probably want to slip in a malicious UEFI driver directly. Tools like UEFITool can be used to analyze and modify the filesystem of a UEFI firmware image.
- baby_souffle 8mo ago> You want to look into something called "Windows Platform Binary Table" [1]. Is this how various motherboard manufacturers are embedding their system control software? I was helping a family friend with some computer issues and we could not figure out where the `armoury-crate` (asus software for controlling RGB leds on motherboard :() program kept coming from
- BobbyTables2 8mo agoLikely so. I think that’s actually the intended use of this “feature”
- Nextgrid 8mo agoThat most likely comes from Windows Update though. It now has the ability to download "drivers". It actually had said ability for a long time (back from Vista days if I remember right) but back then it was only downloading the .inf file and associated .sys files/etc, where as nowadays it actually downloads and runs the full vendor bloatware.
- phatskat 8mo agoHave your friend grab https://github.com/seerge/g-helper https://github.com/seerge/g-helper which can disable armory crate. It’s also a lot lighter on your system - I was having constant gradual frame drops (games would start find and performance would slowly degrade) until I tried this and used the option to disable the AC processes.
- userbinator 8mo agoI don't want Boot Guard or any of that DRM crap. I want freedom. I want to make a persistent implant/malware that survives OS reinstalls. Look up Absolute Computrace Persistence. It's there by default in a lot of BIOS images, but won't survive a BIOS reflash with an image that has the module stripped out (unless you have the "security" of Boot Guard, which will effectively make this malware mandatory!) I’m more interested in demonstrating how important hardware root of trust is. You mean more interested in toeing the line of corporate authoritarianism.
- taneq 8mo ago> You mean more interested in toeing the line of corporate authoritarianism. That’s not what I got from their post. After all, they’re putting in some effort to hardware backdoor their motherboard, physically removing BootGuard. I read it as “if your hardware is rooted then your software is, no matter what you do.”
- invokestatic 8mo agoWell, this project is literally about me circumventing/removing Boot Guard so I don’t know how it’s corporate authoritarianism. I’m literally getting rid of it. In doing so I get complete control of the BIOS/firmware down to the reset vector. I can disable ME. To me, that’s ultimate freedom. As a power user, do I want boot guard on my personal PC? Honestly, no. And we’re in luck because a huge amount of consumer motherboards have a Boot Guard profile so insecure it’s basically disabled. But do I want our laptops at work to have it, or the server I have at a colocation facility to have it? Yes I do. Because I don’t want my server to have a bootkit installed by someone with an SPI flasher. I don’t want my HR rep getting hidden, persistent malware because they ran an exe disguised as a pdf. It’s valuable in some contexts.
- taneq 8mo agoSome days you’re the anarchist, some days you’re the corporate authority. :D
- fc417fc802 8mo agoI want an equivalent of boot guard that I hold the keys to. Presented only with a binary choice certainly having boot guard is better than not having it if physical device security is in question. But that ought to be a false dichotomy. Regulation has failed us here.
- yjtpesesu2 8mo agoDeath approaches. Slow burn until. When Death arrives, what you are doing now will be obviously irrelevant.