Unix forever!

DSR enhanced security and "formal verification" course

This is the analysis of CVE-2024-30078

The video: https://youtube.com/watch?v=I3tLkTdRvI0

What happend? Kunlun Cyber Labs from Beijing had unauthenticated access to all (zivil, military, enterprise) Microsoft Windows 10 / 11, Azure ... networks allover the world for - and this is most likely - almost 8 years now!

This may explain why US government is really, really nervous:

https://blogs.microsoft.com/bayarea/2016/02/17/department-of-defense-to-move-8-million-devices-to-windows-10/

https://www.heise.de/en/opinion/Opinion-The-BSI-s-risky-silence-on-Microsoft-issues-9687605.html

Kunlun Cyber Labs from Beijing now, after - most likely - 8 years, did generously share their insights with the world. So, for simplicity, let's assume, China government had full access to all secrets of all companies and organisations across the globe that are using Microsoft Windows on desktop computers, on notebooks, in remote Azure cloud. Everywhere on all disks. What they could have done with these informations?

Well, if they had replaced binaries or hidden some trojans on disk, that typically is easily detected or found by virus scanners.

A bit more difficult to detect would be a trojan that had been placed in the BIOS, e.g. within the EPROM, where the UEFI sits. That happend to german Bundestag. Complete hardware had to be replaced at once and US provider Verizon lost its job.

🇩🇪 https://de.wikipedia.org/wiki/Hackerangriffe_auf_den_Deutschen_Bundestag

Ok, let's assume this also can be detected sooner or later. Some few newer virus scanners are also able to scan there.

What can not easily be found, are backdoors that are deeply sticking in the certificates themselves within the TPM chip on the motherboard. I've written a short abstract about how that works a couple of years ago:

https://firmwaresecurity.com/2015/12/19/guido-stepken-on-linux-uefi-tpm-2-0-backdoors/

Linux UEFI TPM 2.0 security impacts:
The “security chain” begins with one or more TPM 2.0 “Endorsement Keys” (EK), that are stored on the motherboard and that cannot be overwritten without “allowance” by either the owner (hardware manufacturer) or somebody, that is “higher” in key hierarchy, such as Microsoft or U.S. government authorities. Key Exchange Keys (KEK) establish a trust relationship between the operating system and the platform firmware. Each operating system (and potentially each 3rd party application, that needs to communicate with platform firmware) enrolls a public key (KEKpub) into the platform firmware. When your hardware comes “Windows Certified”, the “Endorsement Key” already is initialized, is signed by Microsoft and U.S. authorities. “Windows certified” here automatically means “NSA backdoor” included and activated in all encryption modules. Hardware encryption on newer INTEL Xeon machines, at boot, load those key rings from UEFI tables into processor buffer. From then on, the CPU hardware encrypts everything with Microsoft and U.S. authorities keys being enclosed in the key ring, independent of used operating system!

Imagine you've bought an uninitialized motherboard from a Taiwan manufacturer. What happens, when you install Windows, why is it so slow?

That has to do with the way of initialization of the motherboard TPM chip with the Endorsement Key, which gets a nice backdoor certificate cross-signed (for equivalence) by NSA, FBI and by Microsoft, of course, for being able to send and to install software updates. Then the Enterprise Key gets generated, which again gets (only) co-signed by Microsoft for being able to disable your software any time, case you haven't paid your bills or your country gets sanctioned, as they did it to Iran:

https://web.archive.org/web/20100720100815/http://threatpost.com/en_us/blogs/verisign-revokes-certificate-used-sign-stuxnet-malware-071710
https://ccdcoe.org/uploads/2018/10/Falco2012_StuxnetFactsReport.pdf
https://iranhumanrights.org/2018/01/ir2017-ssl-security-certificates/
https://www.enisa.europa.eu/media/news-items/operation-black-tulip/

Note: "Co-signing" is not the same as "cross-signing"!!!

https://learn.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing
https://crypto.stackexchange.com/questions/94982/what-is-cross-signing-of-root-certificates-and-how-does-it-help-at-time-of-root

Then comes the Bitlocker Key, which again gets co-signed by NSA and Microsoft for them being able to decode your encrypted partitions via the famous Intel IME (Wake-On-Lan) backdoor. Then the admin keys get signed with the Enterprise Keys and only then, then you finally are allowed to type in your very private "User Password". Which is for the dustbin, because internally it gets replaced by another user certificate. That has become standard with introduction of biometrics, face- / iris- / fingerprint - recognition and such.

Those x.509 PKI software, programmed by "The Open Group", generate a hierarchy of keys. Some are higher, some are equivalent, some are universal (backdoor) keys that can open everything. This software you also find in (of course) Apple's Mac OS X and the heavily modified - Redhat Linux:

https://docs.redhat.com/en/documentation/red_hat_certificate_system/9/html-single/planning_installation_and_deployment_guide/index#Introduction_to_Public_Key_Cryptography

Btw.: What's the "Intel IME Backdoor"? It's an very energy efficient (low milliwatts on idle) ARM Cortex A15 chip that you can find within all Intel CPUs produced from 2008 on. It's running Minix. And it can be remotely switched on with a secret " Wake-On-Lan" (W-o-L) token while the Intel CPU itself is powered off. It is deeply connected with the Infineon TPM 2.0 chip and thus has full acccess to all data on your machine. It operates totally unnoticed by the user. Even works in parallel to your "operating system of choice" running: https://youtube.com/results?search_query=Intel+ime+blackhat

Due to bad publicity it was renamed to Active Management Engine: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology

Here an excellent video: https://youtube.com/watch?v=9fhNokIgBMU

And now imagine, that (nice) hacker club had the full 8 years time to carefully analyze the global PKI hierarchies in all organizations and enterprises in the world, and even had time to place its own backdoors at highest level to shutdown all Microsoft networks in case of e.g. a Taiwan conflict. Not a single airplane, no missile, no warship, no ICBM can start without its explicit OK from the corresponding US CentCom or N.A.T.O. HQ in Bruxelles. They're all running Windows, of course!

And a few - say - 8 years later, after being sure to have placed its trojans everywhere possible, the hacker club publishes it how easy it was to get into all Microsoft networks on earth: Enterprise networks, military networks, networks on all ships, aircraft carriers, networks of companies who control the GPS satellites, simply every fucking network, that at minimum has one Microsoft Windows 10 running in it.

Oh, Microsoft was so proud! Best deal of all times! Wasn't it?

https://blogs.microsoft.com/bayarea/2016/02/17/department-of-defense-to-move-8-million-devices-to-windows-10/

And then they also had plenty of time to install their trojans in protected networks behind firewalls even, because they could easily place their own hidden malicious code in the Microsoft signed "genuine" Windows Update Packages, your computer pulls from Microsoft Cloud servers.

And during their adventures they also might have found plenty of private keys, those of Microsoft and even those from Cisco, Checkpoint, NSA, FBI and those from N.A.T.O., Raytheon, BAE, Lockheed, Boeing and all others from the Military - Industrial - Complex: https://en.wikipedia.org/wiki/Military–industrial_complex

They - most likely - had full 8 years to do it. Unnoticed by enterprise firewalls and their admins or security response teams, because they had their "private" side channel access over WiFi, completely bypassing firewall logs.

Isn't it just frightening?

No, this is not some fairy tale, take it as a fact!

You certainly, in this moment, might be a bit confused. But when you carefully re-read this posting, you might come to the same conclusion, that it is impossible to thow out those hackers without taking your whole network offline for completely setting it up from scratch. But unluckily you can't do that without going online to be able to install Windows and so reinfecting your machines back again, taking it offline again, ... It's a vicious circle that never ends!

R.I.P. Microsoft!

Have a nice day!

Back to last lesson - https://rentry.co/dsrsecuritycoursepart2 Next lesson: https://rentry.co/dsrsecuritycoursepart4

Edit
Pub: 26 Jun 2024 17:09 UTC
Edit: 30 Jun 2024 08:26 UTC
Views: 392