1. [Cryptography] This is why we have Stuxnet
2.  
3. Peter Gutmann pgut001 at cs.auckland.ac.nz
4. Mon Mar 21 01:59:26 EDT 2016
5. Previous message: [Cryptography] iMessage cryptography is broken
6. Next message: [Cryptography] This is why we have Stuxnet
7. Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
8. I usually do embedded cross-development under Linux, typically with some
9. hacked-up ancient version of gcc and obtuse command-line utilities that fail
10. with cryptic error messages until you've spent several hours hacking around
11. with them.  This time though I had to use Windows because getting the drivers
12. going under Linux just wasn't working.  So I go to the web site of the $20B
13. global hardware vendor that makes this stuff and download their SDK tools.
14.  
15.   "We've detected that you've got A/V running.  You should disable this in
16.   order to run our tools.  Are you sure you want to continue?".
17.  
18. Yeah, I'm not doing that, so I click continue.
19.  
20.   "I said, WE'VE DETECTED THAT YOU'VE GOT A/V RUNNING AND YOU REALLY NEED TO
21.   DISABLE IT.  Waiting for A/V to be disabled".
22.  
23. OK, so I'll disable A/V.  At which point Windows goes to about Defcon 2 and
24. starts screaming about the imminent collapse of civilisation, but I don't have
25. any choice.
26.  
27. So the install starts, except it won't install in $Program_Files because that
28. has, you know, security applied to it.  It wants to create its own public
29. directory off $SystemRoot and install to that.
30.  
31. OK, so I'll allow it to do that.
32.  
33. Now Windows Firewall is throwing up warnings about tclsh groping around on the
34. Internet (they install a complete Cygwin environment, presumably because their
35. Windows SDK is all scripted in Tcl).  So I allow that, and various other
36. things that I get warnings about.
37.  
38. It then proceeds to download and install a 2-year-old version of Java, which
39. apparently is needed by their SDK.
40.  
41. After that, it reaches out to about a hundred-odd HTTP URLs, downloads binary
42. blobs from them, and installs them.  I tried setting up a tunnel to an HTTPS
43. equivalent but it only does HTTP.
44.  
45. Finally, it's finished.  The app starts up and requests elevation to
46. Administrator.  Then it starts grabbing more binary blobs from HTTP URLs and
47. installing them.
48.  
49. All that was just from watching what was happening, I didn't do any further
50. checking to see what other horrors lurked beneath the surface, but given what
51. I'd seen so far it was bound to be pretty bad.
52.  
53. I think we need to treat any embedded device developed via this vendor as pre-
54. compromised.  And that includes the aerospace and military ones.
55.  
56. Peter.