Hacking the hackers

Automating the search for loopholes in software
Mar 28th 2015 | From the print edition

Timekeeper

“SET a thief to catch a thief.” Security-conscious companies, from banks to newspapers, often hire, if not thieves, then the analogues of thieves, to test their computer systems for weaknesses. These professional hackers, called penetration testers, poke and prod at their clients’ systems. If they find a way in, they inform the client, who can then fix the problem. Penetration testing, though, is expensive—for the skills required to be a good tester are rare. That is why a French firm called Cryptosense is hoping to automate the job.

One part of ensuring that a program is secure is checking that it is free of bugs and that it responds to odd or malformed sequences of commands without spilling any of the secrets it is meant to be guarding. This is a big task. The number of combinations of commands that can be entered into a piece of software increases exponentially as it gets more complicated. And many firms modify programs they have bought off the shelf, inadvertently introducing new bugs as they do so. It is thus no use relying on what a programmer has told you about how his code works.

Cryptosense’s penetrator, therefore, starts from scratch. First, it works its way through the list of commands that can be given to the program it is trying to subvert, in order to see how it responds. “At the end of that process it has two piles,” says Graham Steel, one of Cryptosense’s founders, “one where [the target program] did what it was supposed to do, and another pile full of error messages.” Armed with those experimental data, the virtual penetrator can work backwards, reconstructing a simulacrum of the target program whose behaviour, mistakes and all, matches reality.

Thus armed, it can begin trying to break things. Even with a computer rather than a human being doing the testing, an exhaustive search of all possible sequences of commands can be time-consuming. But the testing algorithm is smart enough, says Dr Steel, to give priority to those combinations most likely to prove fruitful. (Unsurprisingly, he will not disclose how exactly that is done.)

Even if Cryptosense’s automated hacker can find and plug all the holes in a particular piece of software, there will still be weak links. Software is used by people, and people can be tricked, threatened or charmed into spilling secrets. Also, what works for the good guys can work for the bad. If automatic hacking proves itself, there is nothing to prevent malicious hackers coming up with their own versions, and using those to scan for weaknesses.

Nevertheless, the prospect of automated security checks has already garnered Cryptosense several customers. Many of these are banks, which are frequent targets for hackers. Others operate in more esoteric settings. Security experts like to tell tales of “back doors” built into weapon systems, designed to allow their makers to disable them remotely. Cryptosense has found at least one flaw in a security module used in a modern weapon system which seems capable of doing just that.

From the print edition: Science and technology

BitWhisper: Stealing data from non-networked computers using heat

By Ryan Whitwam
No matter how secure you think a computer is, there’s always a vulnerability somewhere that a remote attacker can utilize if they’re determined enough. To reduce the chance of sensitive material being stolen, many government and industrial computer systems are not connected to outside networks. This practice is called air-gapping, but even that might not be enough. The Stuxnet worm from several years ago spread to isolated networks via USB flash drives, and now researchers at Ben Gurion University in Israel have shown that it’s possible to rig up two-way communication with an air-gapped computer via heat exchange.

Researchers call this technique of harvesting sensitive data “BitWhisper.” It was developed and tested in a standard office environment with two systems sitting side-by-side on a desk. One computer was connected to the Internet, while the other had no connectivity. This setup is common in office environment where employees are required to carry out sensitive tasks on the air-gapped computer while using the connected one for online activities.

BitWhisper does require some planning to properly execute. Both the connected and air-gapped machines need to be infected with specially designed malware. For the Internet box, that’s not really a problem, but even the air-gapped system can be infected via USB drives, supply chain attacks, and so on. Once both systems are infected, the secure machine without Internet access can be instructed to generate heating patterns by ramping up the CPU or GPU. The internet-connected computer sitting nearby can monitor temperature fluctuations using its internal sensors and interpret them as a data stream. Commands can also be sent from the Internet side to the air-gapped system via heat.

The malware is able to use the heat patterns as a covert data channel between the machines, thus defeating the air-gap. The data rate between the connected and air-gapped computers isn’t particularly fast — it’s somewhere around eight bits per hour. Still, that’s enough to snatch passwords and text files over time. Because all the data theft takes place over invisible heat signals, there are almost no signs of intrusion in the secure network.

Once the malware has found a home in the air-gapped network, it can be instructed to spread to other computers in search of more heat-driven communication channels. The researchers say a secure network is vulnerable to BitWhisper anywhere an internet-connected PC is 15-inches or less away from an air-gapped system. BitWhisper can seek out new connections by sending out periodic “thermal pings” to link up nearby computers.

The researchers demonstrated BitWhisper using a computer with a USB missile-launcher toy attached. In the video above, they were able to send heat commands from the connected system over the air-gap to the isolated system and control the missile launcher. There are a lot of things that can go wrong with this system — something as small as a desk fan could break the connection. Still, it’s an ingenious proof-of-concept.