Hacker News Reader

RazorOfOccamon Mysterious Mac and PC malware that jumps airgaps?

Wireshark doesn't listen on audio devices though. You have to choose an interface. There is no obvious way to capture what he claims to be seeing, and if he used wireshark or tcpdump, he would have a log. Furthermore, if you had a covert audio channel, you wouldn't encapsulate it in TCP or IP. Under close examination, these claims don't make any sense.

RazorOfOccamon Mysterious Mac and PC malware that jumps airgaps?

For what it's worth, he has dumped several files, including the ME firmware, which have all been found to be clean by experts.

https://twitter.com/esizkur/status/389226368514289664

https://twitter.com/0x0000EBFE/status/394216393282830336

He doesn't even have a way to test whether or not a machine is "infected". He claims that it's based on problems booting from a CD and/or hearing audio interference. Extremely dubious.

RazorOfOccamon Mysterious Mac and PC malware that jumps airgaps?

It's a giant leap to go from this to what his claims are. Technically, and logically. Once you've solved the technical leap, logic handily defeats this as a possibility.

RazorOfOccamon Mysterious Mac and PC malware that jumps airgaps?

There is no audio in the link you provided.

RazorOfOccamon Mysterious Mac and PC malware that jumps airgaps?

> The technical aspects are all known to be practical.

No, they aren't. Not by a long shot. They sound vaguely similar to some that are however, so people are overlooking the details that would take this from advanced malware to hollywood fantasy.

RazorOfOccamon Mysterious Mac and PC malware that jumps airgaps?

This story is false. Not intentionally so, but evidently some technical misunderstandings and a lot of paranoia have led to the claims being made. I'm using a throwaway because I don't want to get involved in a public battle, but I've analyzed everything that he provided, and he jumped to wrong conclusions for everything so far. I am sorry that I'm making this claim without data, but I ask that you consider that he has also made extraordinary claims without providing any data.

The entire audio channel theory is based on a simple twitter suggestion from a third party, and Dragos saying it must be correct because he has also been unable to remove audio interference from his home audio system.

He has yet to provide anyone else with anything but perfectly clean files, with signed and matching hashes from clean Windows 8 installations.

Although some of the methods he claims are rooted in things that have been demonstrated as a proof-of-concept in previous research, his claims represent added twists in ways that are very difficult to swallow. More importantly, it's based on assumptions, and not anything that has actually been analyzed.

(For what it's worth, I analyze malware professionally)