Have I caught a firmware attack in the act? Or am I just paranoid?

From	"Rebecca N. Palmer" <rebecca_palmer@zoho.com>
Newsgroups	linux.debian.security
Subject	Have I caught a firmware attack in the act? Or am I just paranoid?
Date	2019-08-13 09:40 +0200
Message-ID	<yuzzs-7fV-11@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

(Warning: this is being sent from the affected computer, so don't trust 
"me".  BCCd recipients: anyone can post to the debian-security list, but 
be aware that its public archive does not spam-protect email addresses)

I use usbguard [0], set to allow only the specific USB devices I have.

One of my flash drives apparently stopped working, and investigation 
found that it had changed Product ID, causing usbguard to block it as an 
unrecognized device.

Possible explanations - all seem unlikely but it has to be something:
(a) Innocent device malfunction
(b) Malware infection [1-2] via physical access to the drive
(c) Malware infection that began in the computer then infected the drive

(a), innocent malfunction, has the problem that the new Product ID 
number is not just a bit flip away and the strings changed as well. 
(Unless the firmware has two descriptors and a switch bit? or a built-in 
default + a rewritable configuration, and the flash block containing the 
latter has died?)

(b), physical access attack, would require an attacker breaking into my 
home.  (It has been several years since I last took the affected flash 
drive anywhere else or plugged it into any other computer.)  If they're 
willing to do that, I seem a strange choice of target: a Debian 
Maintainer is high-value compared to a random user (because their 
uploads can infect others) but probably not the highest-value target in 
a tech-heavy city.

(c), malware on my computer, requires getting around the fact that I 
haven't recently installed anything from outside Debian except my own 
package.  Maybe a Firefox/Thunderbird sandbox escape?

My integrity_check.py script (checking that system files match the 
Debian packages they come from) and clamav don't find such malware, but 
that's not proof.  usbguard probably blocks the DFU method of writing to 
firmware (since I don't have any 0xFE interfaces in my allowed list), 
but at least some USB flash drives instead use an SCSI command [1], 
which usbguard won't catch.

Both the old and new Product IDs are listed in 
/lib/udev/hwdb.d/20-usb-vendor-model.hwdb as flash drives, and it 
continued to have only a mass storage (class 08: subclass 06: protocol 
0x50) interface, i.e. if it is malware it's not using the obvious 
"pretend to be a keyboard" route.

I'm also not sure whether firmware-based malware is common enough to be 
something the average developer should worry about.  I have seen many 
reports of the possibility, but the news tends to emphasize rare events, 
and the reports I've seen of actual in-the-wild examples are ones that 
target Windows not Linux.

I have unplugged the affected flash drive, but either (b) or (c) would 
imply that it may not be the only device infected - and also that even 
if I do replace my whole computer, they may be able to repeat the attack.

[0] https://usbguard.github.io/
[1] (non-trust warning: found via Wikipedia) 
https://srlabs.de/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackHat-v1.pdf
[2] https://opensource.srlabs.de/projects/badusb/wiki/USB_storage

syslog - before:

Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.758073] usb 3-2.1: New 
USB device found, idVendor=058f, idProduct=6387
Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.758077] usb 3-2.1: New 
USB device strings: Mfr=1, Product=2, SerialNumber=3
Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.758080] usb 3-2.1: 
Product: Mass Storage
Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.758082] usb 3-2.1: 
Manufacturer: Generic
Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.758084] usb 3-2.1: 
SerialNumber: F32402A6
Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.758274] usb 3-2.1: Device 
is not authorized for usage
[...]
Aug  5 07:21:51 rnpalmer-laptop kernel: [34901.953787] usb 3-2.1: 
authorized to connect

syslog - after:

[these are messages that are saved after hibernation, but the first ones 
may actually have been generated before it; it is not normal to get "new 
USB device" at this time]
Aug  6 21:52:26 rnpalmer-laptop kernel: [50368.297466] usb 3-2.1: reset 
high-speed USB device number 21 using xhci_hcd
Aug  6 21:52:26 rnpalmer-laptop kernel: [50368.605593] usb 3-2.1: device 
firmware changed [ from the source code this actually means "descriptor 
changed", 
https://sources.debian.org/src/linux/4.9.168-1/drivers/usb/core/hub.c/#L5520 
]
[...]
Aug  6 21:52:26 rnpalmer-laptop kernel: [50370.579113] usb 3-2.1: New 
USB device found, idVendor=058f, idProduct=1234
Aug  6 21:52:26 rnpalmer-laptop kernel: [50370.579117] usb 3-2.1: New 
USB device strings: Mfr=1, Product=2, SerialNumber=0
Aug  6 21:52:26 rnpalmer-laptop kernel: [50370.579119] usb 3-2.1: 
Product: Mass Storage Device
Aug  6 21:52:26 rnpalmer-laptop kernel: [50370.579121] usb 3-2.1: 
Manufacturer: Alcor Micro
Aug  6 21:52:26 rnpalmer-laptop kernel: [50370.579255] usb 3-2.1: Device 
is not authorized for usage

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-13 09:40 +0200
  Re: Have I caught a firmware attack in the act? Or am I just paranoid? Paul Wise <pabs@debian.org> - 2019-08-14 07:10 +0200
  Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-14 17:40 +0200
    Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-15 23:20 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Davide Prina <davide.prina@gmail.com> - 2019-08-16 10:40 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? CMH <chouck@binghamton.edu> - 2019-08-16 14:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just paranoid? Andrei Grosu <andrei_grosu@fastmail.net> - 2019-08-16 19:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:20 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:10 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:30 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 21:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-17 11:50 +0200
          Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-17 13:20 +0200
            Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-23 09:30 +0200
              Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-23 21:00 +0200
                debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-15 17:20 +0100
                Verified Boot, Secure Boot, dm-verity, debcheckroot Patrick Schleizer <adrelanos@riseup.net> - 2019-11-16 14:00 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:30 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Sylvain Beucler <beuc@beuc.net> - 2019-11-16 15:40 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:40 +0100
                Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-19 13:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-20 12:30 +0100
                Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-25 12:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-25 18:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-12-10 17:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-27 12:10 +0100
                Re: debcheckroot v2.0 released Cindy Sue Causey <butterflybytes@gmail.com> - 2020-01-17 14:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:50 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-23 17:10 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 04:40 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 11:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-24 15:50 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-25 03:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-25 11:30 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-26 11:10 +0100
                Re: debcheckroot v2.0 released "vince@vheuser.com" <vince@vheuser.com> - 2020-04-01 20:10 +0200
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-04-02 02:00 +0200
                Re: debcheckroot v2.0 released Lewis Yarema <lewisyarema91@gmail.com> - 2020-04-02 11:20 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 17:00 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:40 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 16:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:50 +0200
                Re: debcheckroot v2.0 released William Gagnebé <william.gagnebe@gmail.com> - 2020-04-05 12:20 +0200
                Re: debcheckroot v2.0 released l0f4r0@tuta.io - 2020-04-05 12:30 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-07 17:50 +0200
                Re: debcheckroot v2.0 released "Niall O'Reilly" <Niall.oReilly+lists@no8.be> - 2020-04-02 18:30 +0200
                Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-02 21:00 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 21:40 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:50 +0200
                Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-04 00:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:40 +0200
                Re: debcheckroot v2.0 released Bjørn Mork <bjorn@mork.no> - 2020-04-14 09:30 +0200
                arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:40 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:50 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:00 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:10 +0200
                Fwd: Re: arbitrary code execution on unformatted usb stick estellnb@elstel.org - 2020-05-02 20:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-21 17:40 +0100
      Probably a false alarm Re: Have I caught a firmware attack in the  act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-24 18:50 +0200

csiph-web