Originally Posted by kevmatic
Man, I'm having trouble believing this....
Malware that can inject code into the Harvard-architecture microcontroller in a USB stick? Beee Esss. It'd have to be a USB stick specifically designed to... Smash the BIOS's USB handling stack? Does the BIOS even look at the USB bus after the OS is loaded?
I would think that if this whole was true, he'd have a LINE of security researchers at his door ready to help him out.
I want to see an oscilloscope capture of the supposed high-frequency audio communications on the speaker lines on one of these things. Would the audio system in a laptop even reproduce ultrasound?
This smells bad. Either way, should be interesting going forward.
It's a rootkit, it is deeper than OS. Probably like "Bluepill" rootkit.
Given that you can flash BIOS while in the OS it's plausible ; see ASUS USB BIOS flashing too.
Given the amount of focus on hardware "bare metal" hypervisors, it is inevitable people will try to infest more than the OS.
Strangest of all was the ability of infected machines to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed. Further investigation soon showed that the list of affected operating systems also included multiple variants of Windows and Linux.
This I don't believe though. It was likely infected on boot
USB was likely the attack vector. See the recent infections of phones through the USB chargers. http://www.telegraph.co.uk/technology/apple/10096352/Charger-can-hack-Apple-devices-with-alarming-ease-researchers-claim.html
, http://www.infosecurity-magazine.com/view/32733/malicious-charger-can-compromise-iphone-and-ipad-in-under-one-minute/Edited by AlphaC - 10/31/13 at 9:57am