Daily Archives: September 10, 2020

BlindSide: Watch speculative memory probing bypass kernel defenses, give malware root control

Posted on by

Boffins in America, the Netherlands, and Switzerland have devised a Spectre-style attack on modern processors that can defeat defenses that are supposed to stop malicious software from hijacking a computer’s operating system. The end result is exploit code able to bypass a crucial protection mechanism and take over a device to hand over root access.

That’s a lot to unpack so we’ll start from the top. Let’s say you find a security vulnerability, such as a buffer overflow, in the kernel of an OS like Linux. Your aim is to use this programming flaw to execute code within the kernel so that you can take over the whole machine or device. One way to do this, and sidestep things like stack cookies and the prevention of data execution, is to use return-orientated programming (ROP). This involves chaining together snippets of instruction sequences in the kernel to form an ad-hoc program that does whatever you want: hand control of the machine to you, for example.

To thwart ROP-based exploits, a defense called Address Space Layout Randomization (ASLR) was devised some years back that, as the name suggests, randomizes the locations of an application or operating system kernel’s code and libraries in memory. That makes it difficult to write working ROP exploits as the snippets of code they need aren’t in their expected locations; they are randomly placed during boot. Some information needs to be leaked from the kernel that reveals the current layout of its components in RAM. If a ROP exploit just guesses the kernel’s layout and is wrong, it will trigger a crash, and this can be detected and acted on by an administrator.

Enter Spectre. This is the family of vulnerabilities that can be exploited by malware or a rogue user to obtain secret, privileged information – such as passwords and keys – by taking advantage of speculative execution, which is when a processor performs an operation before it’s needed and either retains or tosses the result, depending on the processor instructions ultimately executed.

What the team say they’ve done is designed a Spectre-style technique that can silently speculatively probe memory to determine the location of the kernel’s parts without triggering a crash. And that makes a blind return-oriented programming (BROP) attack possible, bypassing any ASLR in the way.

Hijack merchant

The technique, dubbed BlindSide, is explained in a paper [PDF] by Enes Göktaş and Georgios Portokalidis (Stevens Institute of Technology), Herbert Bos and Cristiano Giuffrida (Vrije Universiteit Amsterdam), and Kaveh Razavi (ETH Zürich). Scheduled to be presented at the ACM Conference on Computer and Communications Security (CCS) 2020, it involves memory-corruption-based speculative control-flow hijacking.

“Using speculative execution for crash suppression allows the elevation of basic memory write vulnerabilities into powerful speculative probing primitives that leak through microarchitectural side effects,” the paper stated. “Such primitives can repeatedly probe victim memory and break strong randomization schemes without crashes and bypass all deployed mitigations against Spectre-like attacks.”

The basic memory write vulnerability in this case was a heap buffer overflow patched some time ago in the Linux kernel (CVE-2017-7308). But the boffins insist other vulnerabilities that provide access to a write primitive, such as CVE-2017-1000112, CVE-2017-7294, and CVE-2018-5332, would work too. So to be clear: you need to find an unpatched hole in the kernel, get some kind of code execution on the machine in question, and then deploy the BROP technique with an exploit to gain root privileges.

The boffins show that they can break KASLR (Kernel ASLR) to run an ROP exploit; leak the root password hash; and undo fine-grained randomization (FGR) and kernel execute-only memory (XoM) protections to access the entire kernel text and perform an ROP exploit.

A video of one such attack shows that the technique takes a few minutes, but does manage to elevate the user to root privileges:

The computer scientists confirmed their technique on Linux kernel version 4.8.0 compiled with gcc and all mitigations enabled on a machine with an Intel Xeon E3-1270 v6 processor clocked at 3.80GHz with 16GB of RAM.

They also did so on Linux kernel version 5.3.0-40-generic with all the mitigations (e.g., Retpoline) enabled on an Intel i7-8565U chip (Whiskey Lake) with the microcode update for the IBPB, IBRS and STIBP mitigations. What’s more, the technique worked on Intel Xeon E3-1505M v5, Xeon E3-1270 v6 and Core i9-9900K CPUs (Skylake, Kaby Lake, and Coffee Lake) and on AMD Ryzen 7 2700X and Ryzen 7 3700X CPUs (Zen+ and Zen2).

“Overall, our results confirm speculative probing is effective on a modern Linux system on different microarchitectures, hardened with the latest mitigations,” the paper stated.

Potential mitigations involve preventing, detecting, and hindering speculative probing, but none of these approaches, the authors suggest, can deal with the issue very well. Intel and AMD did not immediately respond to requests for comment.

Source: Don’t be BlindSided: Watch speculative memory probing bypass kernel defenses, give malware root control • The Register

Several Fish Can Secretly Walk on Land, Study Suggests

Posted on by

A surprising number of hillstream loaches—a family of Asian fish—are capable of walking on land using all four limbs, according to a new study. It’s a discovery that could explain how some of the earliest animals managed to stroll on solid ground.

South Asian hillstream loaches are a family of small fish that can often be found clinging to rocks in fast-moving waters. New research published in the Journal of Morphology suggests at least 11 species of hillstream loaches can also walk on land, as evidenced by their peculiar anatomies. At least one species, a blind cavefish known as Cryptotora thamicola, has actually been caught in the act, but the new research suggests other hillstream loaches can do it as well.

Brooke Flammang, a biologist at the New Jersey Institute of Technology and the study’s lead principal investigator, along with her colleagues, analyzed 29 hillstream loach specimens. Using micro-CT scans, the team studied and compared the various specimens, looking at their distinctive shapes, muscle groups, and skeletal structures.

Cryptotora thamicola as seen in multiple perspectives.
Cryptotora thamicola as seen in multiple perspectives.
Image: Zach Randall, Florida Museum of Natural History, and BE Flammang, NJIT

This international team of researchers, which included scientists from the Florida Museum of Natural History, Louisiana State University, and Thailand’s Maejo University, also conducted some genetic work, sampling the DNA of 72 loaches in order to reconstruct their evolutionary family tree.

Together, the physical and genetic analysis revealed the fishes’ unusual land-walking capabilities.

“In most fishes, there is no bony connection between the backbone and the pelvic fins. These fish are different because they have hips,” explained Flammang in an email. “The hip bone is a sacral rib, and within the fishes we studied, we found three morphological variants ranging from very thin and not well-connected to robust and having a sturdy connection. We expect that those with the largest, most robust ‘hip’-bones have the best walking ability.”

Cryptotora thamicola in the wild.
Cryptotora thamicola in the wild.
Image: Florida Museum

Of the fish studied, 11 were found to have these robust hips, or pelvic girdles. Interestingly, the resulting gait is reminiscent of the way salamanders walk on land. As noted, the only documented example of a walking hillstream loach is Cryptotora thamicola, also known as the cave angel fish. These blind fish, in addition to walking on land, have been seen climbing up waterfalls, which they do using all four limbs.

[…]

Flammang said these fish don’t represent an intermediate species, that is, some kind of missing link between fully aquatic animals and those capable of living on land.

“But we know that throughout evolution, organisms have repeatedly converged on similar morphologies as a result of facing similar pressures of natural selection,” she said. “And we also know that physics does not change with time. Therefore, we can learn from the mechanics of how this fish walks and use it to better understand how extinct early animals may have walked.”

Source: Several Fish Can Secretly Walk on Land, Study Suggests

How Britain can help you get away with stealing millions: a five-step guide

Posted on by

Step 1: Forget what you think you know

If you want to commit significant financial crime, therefore, you need a bank account, because electronic cash weighs nothing, no matter how much of it there is. But that causes a new problem: the bank account will have your name on it, which will alert the authorities to your identity if they come looking.

This is where shell companies come in. Without a company, you have to act in person, which means your involvement is obvious and overt: the bank account is in your name. But using a company to own that bank account is like robbing a house with gloves on – it leaves no fingerprints, as long as the company’s ownership information is hidden from the authorities. This is why all sensible crooks do it.

[…]

Here is the secret you need to know to get started in the shell company game: the British company registration system contains a giant loophole – the kind of loophole you can drive a billion euros through without touching the sides.

[…]

. The true image associated with “shell companies” these days should not be an exotic island redolent of the sound of the sea and the smell of rum cocktails, but a damp-stained office block in an unfashionable London suburb, or a nondescript street in a northern city. If you want to set up in the money-laundering business, you don’t need to move to the Caribbean: you’d be far better off doing it from the comfort of your own home.

Step 2: Set up a company

The second step is easy, and involves creating a company on the Companies House website. Companies House maintains the UK’s registry of corporate structures and publishes information on shareholders, directors, accounts, partners and so on, so anyone can check up on their bona fides.

Setting up a company costs £12 and takes less than 24 hours. According to the World Bank’s annual Doing Business report, the UK is one of the easiest places anywhere to create a company, so you’ll find the process pretty straightforward.

[…]

While it has bullied the tax havens into checking up on their customers, Britain itself doesn’t bother with all those tiresome and expensive “due diligence” formalities. It is true that, while registering your company on the Companies House website, you will find that it asks for information such as your name and address.

[…]

Step 3: Make stuff up

This third step may be the hardest to really take in, because it seems too simple. Since 2016, the UK government has made it compulsory for anyone setting up a company to name the individual who actually owns it: “the person with significant control”, or PSC.

[…]

Here is the secret: no one checks the accuracy of the information you provide when you register with Companies House. You can say pretty much anything and Companies House will accept it.

[…]

Suspicious typos are everywhere once you start delving into the Companies House database.

[…]

Recently, while messing about on the Companies House website, I came across a PSC named Mr Xxx Stalin, who is apparently a Frenchman resident in east London.

[…]

Xxx Stalin led me to a PSC of a different company, who was named Mr Kwan Xxx, a Kazakh citizen, resident in Germany; then to Xxx Raven; to Miss Tracy Dean Xxx; to Jet Xxx; and finally to (their distant cousin?) Mr Xxxx Xxx. These rabbitholes are curiously engrossing, and before long I’d found Mr Mmmmmmm Yyyyyyyyyyyyyyyyyy, and Mr Mmmmmm Xxxxxxxxxxx (correspondence address: Mmmmmmm, Mmmmmm, Mmm, MMM), at which point I decided to stop.

As trolling goes, it is quite funny, but the implications are also very serious, if you think about what companies are supposed to be for. Limited companies and partnerships have their liability for debts limited, which means that if they go bust, their investors are not personally bankrupted. It’s a form of insurance – society as a whole is accepting responsibility for entrepreneurs’ debts, because we want to encourage entrepreneurial behaviour. In return, entrepreneurs agree to publish details about their companies so we can all check what they are up to, and to make sure they’re not abusing our trust.

[…]

The anti-corruption campaign group Global Witness looked into PSCs last year, and found 4,000 of them were under the age of two. One hadn’t even been born yet. At the opposite end of the spectrum, its researchers found five individuals who each controlled more than 6,000 companies. There are more than 4m companies at Companies House, which is a very large haystack to hide needles in.

You don’t actually even need to list a person as your company’s PSC. It’s permissible to say that your company doesn’t know who owns it (no, you’re not misunderstanding; that just doesn’t make sense), or simply to tie the system up in knots by listing multiple companies in multiple jurisdictions that no investigator without the time and resources of the FBI could ever properly check.

This is why step three is such an important one in the five-step pathway to creating a British shell company. If you can invent enough information when filing company accounts, then the calculation that underpins the whole idea of a company goes out of the window: you gain the protection from legal action, without giving up anything in return. It’s brilliant.

[…]

Step 4: Lie – but do so cleverly

Most of the daft examples earlier (Mmmmmmm, Mmmmmm, Mmm, MMM) would not be useful for committing fraud, since anyone looking at them can tell they’re not serious. Cumberland Capital Ltd, however, was a different matter. It looked completely legitimate.

[…]

When US police came looking for the people behind Cumberland Capital Ltd, they searched the Companies House website and found that its director was an Australian citizen called Manford Martin Mponda. Anyone researching binary-options fraud might quickly conclude that Mponda was a kingpin. He was a serial company director, with some 80 directorships in UK-registered companies to his name, and features in dozens of complaints.

It already looked like a major scandal that British regulation was so lax that Mponda could have been allowed to conduct a global fraud epidemic behind the screen of UK-registered companies, but the reality was even more remarkable: Mponda had nothing to do with it. He was a victim, too.

Police officers suspect that, after Mponda submitted his details to join a binary-options website, his identity was stolen so it could be used to register him as a director of dozens of UK companies. The scheme was only exposed after complaints to consumer protection bodies were passed onto the City of London police, who then asked their Australian colleagues to investigate.

[…]

So here is step four: don’t just lie, lie cleverly. British companies look legitimate, so look legitimate yourself. Steal a real person’s name, and put that on the company documents. Don’t put your own address on the documents, rent a serviced office to take your post: Paul Manafort used one in Finchley, the binary options fraudsters went to Liverpool, and Lantana Trade was based in the London suburb of Harrow.

[…]

Step 5: Don’t worry about it

I know what you’re thinking: it cannot be this easy. Surely you’ll be arrested, tried and jailed if you try to follow this five-step process. But if you look at what British officials do, rather than at what they say, you’ll begin to feel a lot more secure. The Business Department has repeatedly been warned that the UK is facilitating this kind of financial crime for the best part of a decade, and is yet to take any substantive action to stop it. (Though, to be fair, it did recently launch a “consultation”.)

[…]

In 2011, then-business secretary and Liberal Democrat MP Vince Cable decided to open up Companies House, and everything changed. After Cable’s reform, anyone with an internet connection, anywhere in the world, could create a UK company in about as much time as it takes to order a couple of pizzas, and for approximately the same amount of money. The checks were gone; there was no longer any connection to a verifiably existing person; it was as easy to create a UK company as it was to set up a Twitter account. The rationale was that this would unleash the latent entrepreneurship within the British nation by making it easy to turn business ideas into thriving concerns.

Instead of unchaining a new generation of British businesspeople, however, Cable let slip the dogs of fraud. At first, this rather technical modification to an obscure corner of the British machinery of state did not garner much attention, but for people who understood what it meant it was alarming.

[…]

There is, it turns out, a simple explanation for why successive governments have failed to do anything about it. Last year, when challenged in the House of Commons, Treasury minister John Glen stated that Companies House simply couldn’t afford to check the information filed with it, since that would cost the UK economy hundreds of millions of pounds a year. This is almost certainly an exaggeration. Anti-corruption activists who have looked at the data say the cost would in fact be far less than that, but the key point is that the reform would pay for itself. As Brewer has pointed out, “the burden of cost is one thing. But the cost of fraud is far greater.”

VAT fraud alone costs the UK more than £1bn a year, while the National Crime Agency estimates the cost of all fraud to the UK economy to be £190bn. The cost to the rest of the world of the money laundering enabled by UK corporate entities is almost certainly far higher.

[…]

lesson number five: don’t worry about it. Commit as much fraud as you like, fill your boots, the only reason anyone would care is if you kick up a fuss. And what sensible fraudster is going to do that?

Source: How Britain can help you get away with stealing millions: a five-step guide | World news | The Guardian

Researchers reveal a much richer picture of the past with new DNA recovery technique

Posted on by

Researchers at McMaster University have developed a new technique to tease ancient DNA from soil, pulling the genomes of hundreds of animals and thousands of plants—many of them long extinct—from less than a gram of sediment.

The DNA extraction method, outlined in the journal Quarternary Research, allows scientists to reconstruct the most advanced picture ever of environments that existed thousands of years ago.

The researchers analyzed permafrost samples from four sites in the Yukon, each representing different points in the Pleistocene-Halocene transition, which occurred approximately 11,000 years ago.

This transition featured the extinction of a large number of animal species such as mammoths, mastodons and ground sloths, and the new process has yielded some surprising new information about the way events unfolded, say the researchers. They suggest, for example, that the survived far longer than originally believed.

In the Yukon samples, they found the genetic remnants of a vast array of , including mammoths, horses, bison, reindeer and thousands of varieties of plants, all from as little as 0.2 grams of sediment.

The scientists determined that woolly mammoths and horses were likely still present in the Yukon’s Klondike region as recently as 9,700 years ago, thousands of years later than previous research using fossilized remains had suggested.

[…]

The technique resolves a longstanding problem for scientists, who must separate DNA from other substances mixed in with sediment. The process has typically required harsh treatments that actually destroyed much of the usable DNA they were looking for. But by using the new combination of extraction strategies, the McMaster researchers have demonstrated it is possible to preserve much more DNA than ever.

[…]

Source: Researchers reveal a much richer picture of the past with new DNA recovery technique