Re: Stego-empty hard drives... (fwd)

Forwarded message:

> Date: Tue, 22 Sep 1998 20:29:28 -0400
> From: Sunder <sunder@brainlink.com>
> Subject: Re: Stego-empty hard drives... (fwd)

> Why would they implement it when they can simply have their software scan the
> BIOS code if that's what they feared?  It may cost them $10k each, but it'll
> cost them millions to design and scan every notebook type on the planet, and

No, again, they only have to scan the BIOS types and there are only a couple
thousand (if that many) of those. It really isn't that complicated, there are
only a few cpu's, there are only a few glue chip sets, only a few video driver
chip sets, only a few LCD panels, etc. Admitted when multiplied together
there are a lot of combinations. Now the board manufacturers, the BIOS
manufacturers, and the various glue chipset makers get together and share
data and the manufacturers look to their marketing to define their target
point. Then they do a cost analysis on the chipset combo's and pretty soon 
you find the market only handles a handful of fundamentaly different
machines.

If there was as much variety at the hardware level as you assume nobody
could afford to introduce new computers every few months.

> then they'll have to get their hands on newer models as soon as they hit the
> market.  You're talking about a project that's bigger in magnitude than the
> NSA.

No it isn't. All it takes to get the BIOS before it hits the market is get a
license agreement with the BIOS manufacturer. Hell, when I worked at
Compu-Add we did this sort of stuff with Award and Phoenix all the time. We
would get alpha copies to test in our new hardware on a regular basis.

> Why should YOUR BIOS need to contain encryption code or device drivers for that
> matter?  All it needs to do is to HIDE the existance of the extra partition. 

And the code in the BIOS which means it needs to be hidden just like some 
viruses.

Realisticaly it isn't this complicated. All one needs to do is write a
program that allows the operator to talk directly to the hard drive
controller. At that point it's a trivial matter to go out and find those
hidden partitions. You could use normal drive recovery software if you had a
mind, and that only costs a few hundred to a few thousand dollars and can be
bought in the back of Computer Shopper.

> You patch your BIOS by replacing a few bytes of code with CALL's and NOP's. 
> Maybe 4-8 bytes at most to modify.  The routine that checks for the track range
> is only several bytes:
> 
> 
> Somehwere in INT13 code:
>             blah
>             blah
>             blah
>             CALL biospatch
>             NOP ; to fill in the overwritten code to the next opcode
> 
> 
> biospatch  PUSH AX         ;save the register if you need it
>            MOV AX,switch   ;get the value of the hack switch switch
>            JE  popbye
>            POP AX
>            CMP AX,1234 ;or whatever register or whatever value
>            JLE bye
> deny       MOV AL,FAIL ;some reg and some value that says error, likely AL
>            RET
>            
> popbye     POP AX
> bye        ;insert the code that you overwrote with your CALL to this patch
> re           
>            RET
> 
> 
> Homework: Someone please take this code, optimize it for size and build a TSR
> patching INT 13 that JIM can install and run under DOS.

Don't bother, I already know how to do that.

This would stand out like a sore thumb.


    ____________________________________________________________________

                            The seeker is a finder.

                                     Ancient Persian Proverb

       The Armadillo Group       ,::////;::-.          James Choate
       Austin, Tx               /:'///// ``::>/|/      ravage@ssz.com
       www.ssz.com            .',  ||||    `/( e\      512-451-7087
                           -====~~mm-'`-```-mm --'-
    --------------------------------------------------------------------

Jim Choate wrote:

> If there was as much variety at the hardware level as you assume nobody
> could afford to introduce new computers every few months.

Whatever.
 
> Realisticaly it isn't this complicated. All one needs to do is write a
> program that allows the operator to talk directly to the hard drive
> controller. At that point it's a trivial matter to go out and find those
> hidden partitions. You could use normal drive recovery software if you had a
> mind, and that only costs a few hundred to a few thousand dollars and can be
> bought in the back of Computer Shopper.

Yes, and depending on the threat model this was about 5-6 on the last I've last
sent. To get around that, you either modify the hard drive's on board
controller, or you build a CPU emulator.  There is one that's freely available
called Bochs which will do this.  They can happily boot from their floppy and
talk directly to your virtual "hardware" and you still get through.

Yeah, I know, ol'e paranoid Jim will reply to this using the word "Tempest"
signature, to which I reply, if you're that paranoid, tempest shield your
notebook and put in several RF transmitters to spit back pre-recorded tempest
noise to play in synch.

Shit, and why not?  If you're gonna get THAT paranoid, you might as well take
all the precautions in the universe.  Oh, it's too expensive?  Well that's just
waaay too fucking bad.

Gee, but one would have to think, why would they go to that extent and expense
to find hidden bits of data on your drives, and not do body cavity searches and
MRI and XRay scans of your body?  Hell, why don't they buy electron tunneling
microscopes just incase you might have encoded your data on the surface of that
perfectly innocent looking CD jewel case in which you're carrying your music?
 

> Don't bother, I already know how to do that.
> 
> This would stand out like a sore thumb.

Shaaa, now that I've shown you how, of course you already know how to do that. 
Now that I've shown you the code and told you how it works, of course to you it
would stand out like a sore thumb because you know what to look for.  The
question is will it stand out to the minimum wage customs drone?  You seem to
think these guys are actually super spies, not clueless overpaid (for their
level of skills) bored burrowcrats working on an assembly line.  You're over
estimating their abilities by at least four orders of magnitude there.

Gee, I bet you use RSA with 65536 bits too and superencrypt with 3DES, IDEA,
and Blowfish and Misty.

-- 

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|       Sunder       |Prying open my 3rd eye.  So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were      |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run  |\/|\/
../|\..| "A toast to Odin,  |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were....            |.....
======================= http://www.sundernet.com ==========================