GTX 1070 Firmware Overwritten by Malware - Unable to Reset

[EsaT]

Personally, I don't think firmware needs a webstack at all except for if it's explicitly doing some type of network boot function...

Indeed for security it's crazy how some people think cramming more features than necessary into something is always good.
Simply the more functionality and code there's in some device the more possibilities it has for exploiting.
Even if manufacturers try their best, the more there's code the higher the chances for (more) exploitable bugs.

And that hyped IoT is going to be nightmare for security.
If about everything (+ that kitchen sink) has miniature computer in it and is connected to internet, people not caring about others/willing to harm others/wanting to cause mess/doing malware for money won't be running out of places to look for holes.
Even without wireless connections between devices just small hope for some security is going to be extreme challenge.
But of course everything must be fashionably wireless...

 

[R-T-B]

Unfortunately, I am a victim of bad preperation on my part. Aparently my custom 3V power supply I used in my last chip programming project ruined my programmers ability to support 1.8v. I'm going to need to source another way to read this chip, but it will likely be a day or two. I'll keep you guys (and all parties) informed.

Chip in question is a Micron N25Q128A.

 

[rugabunda]

My previous account was banned without warning in response to your question, under the pretext of "spam". If you care about your own technological freedoms and the truth, back this up and save it. Here is my previous comment on security hardening which received many likes by the community. https://pastebin.com/c6jXZjtS And this very comment which was also censored https://pastebin.com/diZ0QGNC

Standard procedure is to give the manufacturer 30-days, and given these exploits aren't really patchable but more architectural design choices to implement "features", I'm debating how to best proceed honestly. Usual procedures don't really apply.

OEM manufacturers must begin shipping motherboards with jumper pins to disable flashing. OTP flash memory where practical, is another solution. These are the simplest and most comprehensive solutions available to the public; without adding extra unnecessary bulkware with their own potential security issues down the road. Other than that, software capable of dumping and scanning firmware for rootkits will be an important advancement for antivirus companies; Signature checks via security software on firmware is another mitigation. The only issue here is if these are state backed, state financed weapons being used illegally for espionage against American citizens and corporations, then what are the odds that any US antivirus agency, operating under the jurisdiction of the FISA courts, will have the legal means at their disposal, never mind the moral backbone to actually do what is right, and make their findings public?

Your infection does not look unlike Stuxnet. Greatis was the first antivirus firm who came out with a free cleaner for the state backed joint NSA-Israeli [1] [2] stuxnet virus which was found in the wild all throughout Japan just prior to the Fukushima incident; It was reported some Stuxnet modules were designed to infect simens SCADA controllers, to be used in particular against Iran's nuclear enrichment facilities. Siemens SCADA controllers are widely used in critical infrastructure all over the globe; it was reported from Japanese sources that the Simens controllers at the Diachhi nuclear site were infected with the Stuxnet virus, which caused the water cooling systems to malfunction and the resulting catastrophe.

Quoting this website: https://richardedmondson.net/2017/01/02/the-stuxnet-connection-to-fukushima/

"I am including, among the articles posted below, a piece by a Japanese writer reporting that Stuxnet had been found on 63 personal computers in Japan. That piece was published originally on October 5, 2010. The Fukushima nuclear disaster occurred just over five months later."

The original sources have since been taken offline from both:
http://www.yomiuri.co.jp/dy/national/T101004003493.htm
and https://web.archive.org/web/*/http://www.yomiuri.co.jp/dy/national/T101004003493.htm
leaving only these semi-official alternative news sites with copies of the original documentation.

If you don't think certain elements within the US, and Israel govt wouldn't do such a thing, then you're not up to speed on current events; and [2] And seeing that the US govt and all of its agencies have been completely infiltrated by Israeli spies, at the very least, the world would be much better off if these were given to the general public so one state cannot get the upper hand over another and security firms will actually offer the public protections. Common sense has it no one with an ounce of brain power and courage would give this exclusively to the very nation fomenting regime change, illegal wars of aggression, and has single handledly brought the world to the edge of global thermal nuclear war. Kapersky was previously under fire from the US government over the Russiagate scandal whereas now the CIA and FBI are the ones being blamed and investigated for these very allegations at the behest of Donald. J. Trump. Yes, the CIA and FBI are now under investigation for illegal spying and initiating the Russiagate conspiracy theory. [2] Muller has already publicly come clean on who colluded with the Trump administration during his campaign, and it wasn't Russia. As has been the case since the assassination of John F. Kennedy, Muller admits it was Israel [2] [3] who colluded with the US administration. Israel has had the US by the balls since they they bombed the twin towers on 911 and long before then, given the revelations of the USS Liberty. And that was on June 8'th 1967. A US house intelligence report last month had already officially cleared trump of any charges of collusion with Russia. Yet the charade goes on in the JMSM. Now there is massive infighting taking place within the swamp otherwise known as the US government, that will soon lead to revelations of Israel's direct involvement behind all of these atrocities, and the resulting wars, quote "I estimated that about 2.4 million Iraqis have been killed as a result of the illegal invasion of their country by the United States and the United Kingdom in 2003." From the article How Many People Has the U.S. Killed in its Post-9/11 Wars?

Actually, I'm open to advice on that front. I can't promise I'll follow it, but ethics advice here is appreciated if you can make a good argument for your point (even better if you can cite past cases).
It isn't going "exclusively" anywhere.

Here is one for your ethics, made by a dear friend of mine:

And this documentary that I had made on 911

Doesn't look to me like the Federal Beauro Of Investigation, nor the Criminal Intelligence Agency, two entities that should have been at the forefront of investigations into the greatest terrorist attack in the history of the United States, have come anywhere near providing the public with the truth of this event, in fact they were directly involved in covering up these crimes. But that may change very soon, as for current events, a massive internal purge is going on:

House Republicans Press Conference Demanding Second Special Counsel 5/22/18 [FBI currently under investigation for criminal activity]

Why?: Mindblowing Corruption At FBI - NSA Whistleblower Reveals

Here is my previous comment on hardening which received many likes by the community. https://pastebin.com/c6jXZjtS And my latest comment which was also deletedhttps://pastebin.com/diZ0QGNC

 

[dorsetknob]

Censored by the whores of Techpowerup

Man up if you post links as you have with the above as titled i fully expect your account to be Banned

@sneekypeet @Tatty_One

 

[W1zzard]

Here is my previous comment on hardening which received many likes by the community. https://pastebin.com/c6jXZjtS And my latest comment which was also deletedhttps://pastebin.com/diZ0QGNC

Your posting style keeps triggering our spam filter, so the post ends up in the manual approval queue.
It also doesn't help that you keep editing your post (every few minutes), which sends it back into the approval queue again.
Then we have to look at every single link you posted/added to ensure it's not spam.
I'm looking into why you got banned

 

[rugabunda]

Oh SORRY my apologies, I thought it may have been that as well, but the previous post, the same, didn't get tossed. I can spend a good 5-10 hours meticulously sourcing comments like that and I hate seeing my account suddenly banned along with 15 hours of hard work. Thanks for looking into it, I couldn't find any means of contacting admins with my banned account, I hope you can fix that. My apologies if I was way off in my judgements. Hopefully you'll be able to figure it out, it just seems so strange and out of place to me.

 

[R-T-B]

I'm really not going to accuse or otherwise exonerate anyone without concrete evidence, so honestly, linking random conspiracy theories (well-founded or otherwise) is completely offtopic here and of no-merit. I'm not considering state actors at this point due to several facts about how this virus was constructed, but that could change given actual evidence to the contrary once my programmer gets fired up for a proper dump.

 

[W1zzard]

I've unbanned rugabunda and merged your second user account into rugabunda. Sorry about this, thanks for the apologies.

Let me know if there's anything else you need

 

[rugabunda]

The problem with your statement is the official line fed by the FBI and all the rest of these criminal institutions was the most ridiculous conspiracy theory of all, especially given the fact they were involved in the cover up. What I present are facts and hard concrete evidence. There is far more then enough evidence in circulation to indict the criminals. What we need is not more evidence but indictments.

THANKS@W1zzard!. Anyway, R-T-B you are doing a great service for this gentleman, what I am suggesting is that it is wise to make the data open to the public, so the global community can respond to these kinds of threats appropriately and not hand it exclusively to one giant bureaucracy, agency, nation or another; no matter where it originated from... so more people will develop the means to counter firmware level threats at a global level. If its given to the FBI, they will probably thank you for giving their gift back, or strictly use it for hacking and spying and slap you with a gag order.

 

[R-T-B]

I chose to process the evidence in front of my very person, but thank you for your input.

I may note I don't exactly trust you nor the organizations and state groups you have suggested I hand this over to. You need not worry though. I don't plan on making this any kind of secret, and release will be done at the same time to many groups (av vendors and various cyber security law agencies) to prevent even theoretical "gag orders."

 

[cadaveca]

A TPM module may have prevented any of this. They have offered these since UEFI was possible. If you don't have one, many UEFI BIOSes are vulnerable, and ASUS boards are not the first to have a BIOS virus. You can check ASUS twitter feed to find this in the past. There are several other protections that run at start-up, prior to BIOS initialization, and use of a TPM is but one way to protect yourself. Such a device would not exist if a vulnerability had not been already recognized.

The idea that there would be any sort of disclosure to any parties that would not have known about this is perhaps a bit misguided.

There is kinda of a standard to protect PCs, from BIOS up, and there are kind of set guidelines for how a system must be configured to deal with such possibilities. These have existed for decades, and have been updated as time has passed. This is likely why the OP had his "paid" Symantec assessment give unsatisfying results... he clearly never had a secure system anyway. (no TPM = you obviously don't care about security).

This whole thing isn't new, novel, or even uncommon, in my books. It's just yet another example of why you need to configure your PC properly, and I know almost no-one that does (if merely because TPM is not common). I guess that might be a subject for an write-up, but telling people that they need to spend a bit more money to make their PC secure, after they've alteady bought a PC they thought might be secure, isn't going to go over well..

 

[trparky]

Um... Gamers Nexus just reported on this...

Spectre Attack Can Access Firmware

The security firm Eclypsium has published a new application of Spectre variant 1 which allows access to System Management Mode (SMM), an element of the BIOS. Eclypsium is headed by Yuriy Bulygin, former “Chief Threat Researcher and Senior Director of Advanced Threat Research” at Intel. According to Eclypsium, “this runtime part of firmware (often referred to as SMI Handler) has long been of interest to security researchers and a target for advanced attackers, since this code has high privileges and operates outside the view of other software including the OS and any security applications.” The exploit could be used to reveal secrets in memory, as well as expose the confidential workings of SMM and further vulnerabilities. Eclypsium has been working with Intel since March, and both Intel and Eclypsium agree that Intel’s Spectre mitigations should apply to this vulnerability. However, Eclypsium raises the point that fixing the problem will require customers to manually update firmware, which not everyone will do.

Source: https://www.zdnet.com/article/ex-in...ctre-attack-can-even-reveal-firmware-secrets/
Source: https://blog.eclypsium.com/2018/05/17/system-management-mode-speculative-execution-attacks/

HW News - Sony PS5 & Zen Architecture, Cringy Mining Ad | Gamers Nexus

 

[R-T-B]

A TPM module may have prevented any of this. They have offered these since UEFI was possible. If you don't have one, many UEFI BIOSes are vulnerable, and ASUS boards are not the first to have a BIOS virus. You can check ASUS twitter feed to find this in the past. There are several other protections that run at start-up, prior to BIOS initialization, and use of a TPM is but one way to protect yourself. Such a device would not exist if a vulnerability had not been already recognized.

The idea that there would be any sort of disclosure to any parties that would not have known about this is perhaps a bit misguided.

There is kinda of a standard to protect PCs, from BIOS up, and there are kind of set guidelines for how a system must be configured to deal with such possibilities. These have existed for decades, and have been updated as time has passed. This is likely why the OP had his "paid" Symantec assessment give unsatisfying results... he clearly never had a secure system anyway. (no TPM = you obviously don't care about security).

This whole thing isn't new, novel, or even uncommon, in my books. It's just yet another example of why you need to configure your PC properly, and I know almost no-one that does (if merely because TPM is not common). I guess that might be a subject for an write-up, but telling people that they need to spend a bit more money to make their PC secure, after they've alteady bought a PC they thought might be secure, isn't going to go over well..

I'm not a big fan of TPM, and neither are most serious security researchers Dave. They also don't provide firmware integrity checks, heck most TPM 2.0 solutions are actually implemented in firmware and could actaully be used against you in this instance.

 

[cadaveca]

I'm not a big fan of TPM, and neither are most serious security researchers Dave. They also don't provide firmware integrity checks, heck most TPM 2.0 solutions are actually implemented in firmware and could actaully be used against you in this instance.

A TPM alone isn't enough, for sure. There IS a way to secure a system so this is NEVER a problem. There IS a FPF that can be blown so no flashing is possible, too. You also might want to look yourself into how a TPM works, as well as the other secure booting tech, and you might come to a different conclusion than what is popular. To me, it's like people asking for Intel NICs... when without one, Intel AMT cannot be activated. Asking for an Intel NIC is asking for a security hole. Asking for no TPM is doing similar, in my books.

It's almost always the same sort of person that starts such discussions. For myself, a person that gets all this new tech free, and then tests and analyzes it for potential problems, and has been doing so for years, I do tend to see a very common trend to these sorts of things that I am sure you have recognized as well. One of those things is a vocal opinion about privacy and security, while at the same time, also doing things that mitigate actual security. It's a matter of attack by obscurity, IMHO. Nearly no one realizes that with Intel AMT, I can flash a board's BIOS with the board OFF. I don't need an OS, a CPU, or even memory present. We al know about certain brand's BIOS FlashBack "features". If this function is built into as system as a feature, you surely aren't truly going to be able to prevent it without taking extreme steps. I don't see very many enthusiasts taking those steps...

 

[R-T-B]

A TPM alone isn't enough, for sure. There IS a way to secure a system so this is NEVER a problem. There IS a FPF that can be blown so no flashing is possible, too. You also might want to look yourself into how a TPM works, as well as the other secure booting tech, and you might come to a different conclusion that what is popular. TO me, it's like people asking for Intel NICs... when without one, Intel AMT cannot be activated. Asking for an Intel NIC is asking for a security hole. Asking for no TPM is doing similar, in my books.

Meh, Intel AMT is both a scapegoat and a legitimate issue, but don't get me offtopic...

I have very little faith in vendor implementations of secureboot in regards to firmware. I have yet to find a single vendor that implements uefi module sig checking like the spec calls for. Most will run anything present in the rom. You can't tell me that's not a problem.

I think I can safely say in this domain too, you won't be able to simply tell me I need to "read up on how it works" either. This was my college field before funds dried up, and I never really lost touch with it.

 

[cadaveca]

You can't tell me that's not a problem.

Oh, it's a very real one. But it's also why you doing all this is a waste of time. These are FEATURES, not bugs. Yeah, the enthusiast market is rife with problems like this... I mean... you're trying to fix something that is sold as a benefit. To me, that is absurd and amazingly hilarious. I have talked about "nefarious devices" in the past... but most ignore it.

The OP could have spent $100 on a new board and this problem would be over, too.

 

[R-T-B]

These are FEATURES, not bugs.

You sound like a Jawa.

I'd say it's high time we rethought our features then. A simple "check bios signature at boot" jumper would satisfy all parties. We had these on some Core 2 duo servers, actually.

And no, I don't consider this a big, scary issue. I do consider it a problem though. I think the majority of users have blown what I considered an interesting malware cleaning WAY out of proportion.

 

[GC_PaNzerFIN]

Dip switch or jumper to enable SPI Flash hardware write protect. So simple, yet nobody does it on consumer motherboards.

 

[cadaveca]

A simple "check bios signature at boot" jumper would satisfy all parties. We had these on some Core 2 duo servers, actually.

This exists already. It is not a physical jumper though.

 

[GC_PaNzerFIN]

This exists already. It is not a physical jumper though.

The whole point is to have physical thing to prevent somebody from disabling the software write protection controlling the GPIO.

 

[cadaveca]

The whole point is to have physical thing to prevent somebody from disabling the software write protection controlling the GPIO.

How about you just put a password on the BIOS itself? Every BIOS offers this, and noone uses it.

I understand EXACTLY what you guys are saying. Don't get me wrong. However, if you haven't implemented even the basics, the advanced stuff is meaningless.

 

[R-T-B]

This exists already. It is not a physical jumper though.

It also doesn't work in nearly every implementation I have tested... I mean I've been posting bypasses for every sigcheck in existence here to TPU for some time with my modded bioses...

 

[cadaveca]

It also doesn't work in nearly every implementation I have tested...

it IS possible to build a hardened system. It does require use of a TPM along with several other features. Without the TPM present, you'll never have a chance. It's like VROC to me... people complain about that missing when fewer people have a use for it, but never TPM.


All a TPM does is generate & verify the keys...

That is the physical hardware required that isn't present. That's your "jumper". Nearly every Intel board has the possibility, and nearly none come with the hardware to activate it.

 

[GC_PaNzerFIN]

How about you just put a password on the BIOS itself? Every BIOS offers this, and noone uses it.

I understand EXACTLY what you guys are saying. Don't get me wrong. However, if you haven't implemented even the basics, the advanced stuff is meaningless.

That is the very very first thing pretty much any more serious corporate IT does anyway. But if you can write to the SPI Flash your password is meaningless.
Enable HW write protect and you need to have physical access to the board. Hack that!

it IS possible to build a hardened system. It does require use of a TPM along with several other features. Without the TPM present, you'll never have a chance. It's like VROC to me... people complain about that missing when fewer people have a use for it, but never TPM.


All a TPM does is generate & verify the keys...

This is your solution?
https://www.bleepingcomputer.com/ne...-insecure-rsa-keys-multiple-vendors-affected/

 

[R-T-B]

All a TPM does is generate & verify the keys...

And supposedly, protect them, which they have historically done horribly. It's a google away how to dump one with a simple serial port.

However, if you haven't implemented even the basics, the advanced stuff is meaningless.

I think the user should be presented with a more secure (ie write protected) default.

Why? I have no faith in the standard end user.

PS: I like how you have brought the TPM argument into this despite the fact they have nothing to do with firmware validation.

Um... Gamers Nexus just reported on this...

HW News - Sony PS5 & Zen Architecture, Cringy Mining Ad | Gamers Nexus

Sorry missed this until just now.

I don't think that's how he was infected but I could be wrong. I don't understand the malware well enough yet to make a statement either way.