Re:Rooting Out Malware with a Side-Channel Chip Defense System
by fabulist on Friday February 27, 2015 @10:18PM
(#9122648)
Some thoughts on how a hacker might defeat this;
* Broadcast signals at the PFP enabled devices to cause false alarms, in order to convince the operators that the devices are unreliable.
* Hack the system at a time where the administrators are performing an "unusual" operation (such as installing a firmware update).
* Write your exploits such that they establish a minimal beachhead in the hacked daemon faster than would cause alarm (the article said it could detect malware in "milliseconds" -- you can do a lot in a millisecond), and then proceed very, very slowly. The PFP would still detect your malicious activity, but you would keep the signal/noise low enough that an alarm wouldn't be raised.
* In some circumstances it may be possible to achieve exploitation while restricting yourself to "usual" activity. Turning a switch into a hub would raise alarms; enabling a disabled ethernet port probably wouldn't. Similarly, using functionality which is already included on the device (such as functions in libc) would probably go unnoticed.
* Broadcast signals at the PFP enabled devices to cause false alarms, in order to convince the operators that the devices are unreliable.
* Hack the system at a time where the administrators are performing an "unusual" operation (such as installing a firmware update).
* Write your exploits such that they establish a minimal beachhead in the hacked daemon faster than would cause alarm (the article said it could detect malware in "milliseconds" -- you can do a lot in a millisecond), and then proceed very, very slowly. The PFP would still detect your malicious activity, but you would keep the signal/noise low enough that an alarm wouldn't be raised.
* In some circumstances it may be possible to achieve exploitation while restricting yourself to "usual" activity. Turning a switch into a hub would raise alarms; enabling a disabled ethernet port probably wouldn't. Similarly, using functionality which is already included on the device (such as functions in libc) would probably go unnoticed.
This is, of course, pure speculation.