This was an ISACA presentation by Nsale Ronnie a top hacker in Africa working with Ernst and Young. He demonstrated how other governments are leading by far in the nature of their espionage through hardware.

1. EMBEDDED GOVERNMENT ESPIONAGE AND CYBER CRIME
Ronald Nsale

2. Disclaimer
There is a need to discuss the problems in order to find solutions
This doesn’t represent the current status of malware/ security trends
I don’t know everything !!!!

3. Agenda
Motivation: State Level Back dooring?
X86 architecture
National Level attacks
Cyber criminal advantage
Introducing plasnito
Why cryptography won’t save us

4. Who am I?
Security Consultant (EY)
MSc. Security and Mobile computing (University of Massachusetts-Boston)
Author: Blindsecurity2010 (A hacker’s perspective)
Projects: BlueRonv0.1 Backtrack 2 and OwaspWeb Exploitation. Google can list the rest 

5. .
Motivation: State Level Back dooring?

6. Could Chinaa state backdoor all new computers on earth?

7. Creating 16:9 Presentations

8. Creating 16:9 Presentations

9. Creating 16:9 Presentations

10. Creating 16:9 Presentations

11. A bit of X86 architecture

12. A bit of X86 architecture

13. Previous
Early 80s : Brain virus, targets the MBR
80s, 90s : thousands of such viruses
2007, John Heasman(NGS Software) BlackhatUS: backdoor EFI bootloader
2009, Anibal Saco and Alfredo Ortega (Core security),
CanSecWest: patch/flash a Pheonix-Award BiosWindows, Truecrypt. Load arbitrary unsigned kernel module.
2010, Kumar and Kumar (HITB Malaysia) : vbootkit bootkitting of Windows 7.
Piotr Bania, Konboot : bootkit any Windows (32/64b)
2012 : Snare (Blackhat 2012) : UEFI rootkitting

14. Previous
Persistent
Stealth (0 hostile code on the machine)
Portable (OS independent)
Remote access, remote updates
State level quality : plausible deniability, non attribution
Cross network perimeters (firewalls, authproxy)
Redundancy
Non detectable by AV (goes without saying...)

15. National Level attacks

16. Firewalls: JETPLOW
Cisco 500 series PIX firewall, ASA (5505,5510,5520,5540,5550)

17. Routers: HEADWATER
•HEADWATER PBD transferred remotely over internet to target router
•PBD is installed in the router’s boot ROM via upgrade command
•PBD activated after a system boot
NOTE:
HEADWATER is the cover term for the PBD for Huawei Technologies routers. This was adopted for use in the joint NSA/CIA effort to exploit Huawei network equipment under project name TURBOPANDA

18. Servers: IRONCHEF
HP Proliant380DL G5 server

19. Computers: GINSU
Installed as a PCI bus hardware implant

20. Cyber criminal advantage

21. Cyber criminal advantage
Default usernames and passwords
Unsecured Debugging ports
Unencrypted Trojans and Back doors

22. Introduction to Plasnito

23. DEMO

24. Reality
This is not a vulnerability :
It is sheer bad design due to legacy.
Don't expect a patch.
Fixing those issues will probably require breaking backward compatibility with most standards (PCI, PCIe, TPM).

25. Why crypto won't save you
We can fake the bootking/password prompt by booting a remote OS (Truecrypt/Bitlocker)
Once we know the password, the BIOS backdoor can emulate keyboard typing in 16bit real mode by programming the keyboard/motherboard PIC microcontrollers
If necessary, patch back original BIOS/firmwaresremotely.

26. Why crypto won't save you
TPM + full disk encryption won't save you either :
It's a passive chip : if the backdoor doesn't want explicit access to data on the HD, it can simply ignore TPM.
Your HD is never encrypted when delivered to you. You seal the TPM when you encrypt your HD only. So TPM doesn't prevent backdooringfrom anyone in the supply chain.

27. How about Antivirus?????
Putting an AV on a server to protect against unknown threats is purely cosmetic.
You may as well put lipstick on your servers...

28. Example: 3 year old bootkit

29. Example: 3 year old bootkit

30. Remediation
Flash any firmware upon reception of new hardware with open source software you can verify
Perform checksums of all firmwaresby physically extracting them (FPGA..) : costly !
Verify the integrity of all firmwaresfrom time to time
Update forensics best practices :
1) Include firmwaresin SoW
2) Throw away your computer in case of intrusion
Even then... not entirely satisfying : the backdoor can flash the original firmwaresback remotely.

31. Questions ?
Contact me
Ronald.Nsale@ug.ey.com