Slashdot Mirror
Malware Running On Graphics Cards
An anonymous reader writes "Given the great potential of general-purpose computing on graphics processors, it is only natural to expect that malware authors will attempt to tap the powerful features of modern GPUs to their benefit. In this paper, the authors demonstrate the feasibility of implementing a malware that can utilize the GPU (PDF) to evade virus scanning applications. Moreover, the authors discuss the potential of more sophisticated attacks, like accessing the screen pixels periodically to harvest private data displayed on the user screen, or to trick the the user by displaying false, benign-looking information when visiting rogue web sites (e.g., overwriting suspicious URLs with benign-looking ones in the browser's address bar)."
It says slashdot.org in my URL bar but since the last few months the comments of users appear to be from digg.
With this technology, new, more sophisticated Rickrolling is now possible.
trick the users by displaying false, benign-looking information when visiting rogue web sites (e.g., overwriting suspicious URLs with benign-looking ones in the browser's address bar).
I suppose editing the hosts file to redirect traffic wouldn't suffice?
except instead of doing that, it looked for textures that were generated anyway by games ads and swapped in other textures.
My friends looked at me like I was evil and crazy.
Non impediti ratione cogitationus.
"Moreover, the authors discuss the potential of more sophisticated attacks, like accessing the screen pixels periodically and harvest private data displayed on the user screen"
I guess we just change all fields to mask the entries with **** or if we want to really fool them use dots.
Should read "nvidia adds twitter and pop3 integration to newest line of GPUs"
In soviet Russia, God creates you!
Imagine starting to be target for specific porn habits. No amount of private browsing would keep the ads from showing up on your computer.
GENERATION 25: The first time you see this, copy it into your sig on any forum and add 1 to the generation. Social exper
I used to run a small computer repair and write-to-order software shop for a living while in the Uni with two more people. One of them had that idea around 1994. In those days it was just to store the code in the video RAM pages which are not directly accessible to a scanner and keep a small polymorphic backstrap routine in main memory.
What goes around comes around. Looks like this is using a similar approach. Even if you compute some stuff on the card you still need a bootstrap within the main system to use it and talk back to the "mothership".
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
This should make for some wonderful new kinds of pop up ads that can't be dismissed or in any way taken out of focus.
User and role based authentication/authorization is essential to security, but not sufficient. A machine that brings authentication/authorization down to the process level would be more secure.
I'd like a PC that enforced access control on each process running. Every call to any HW, whether CPU, MMU, GPU, or any bus, to require authentication. A crypto ASIC with scores of simultaneous auth units pointing at each process space and the ACL table for auth in just a few extra clock ticks on operations per process, at startup and randomly every dozen or so calls. More frequently when there's a "heightened alert" either by network notification or during and after other security events like DoS attacks and malware discovery.
--
make install -not war
So when can we expect the GPU port of the nam-shub to protect us from the Cult of A5h3rah?
Linking to a PDF...on Malware...on Slashdot...
Rrrrriiiiight. Thank god for Google Docs, for us poor schmedricks that are corporately damned to use Adobe Acrobat, at least there's SOME way to view PDFs without risking the local system. Dear editors, please consider pointing to cached html copies or other locales first.
I have seen somewhere botnets on routers here in slashdot.
What's the next device to be infected? Network printers? SSDs with that little ARM to perform GC? NICs?
Modern GPUs include memory protection, so different processes can be prevented from reading each others' VRAM, just as they can be prevented from running each others' RAM. This is not always used by the drivers, which may just map the entire physical VRAM into the GPU's virtual address space. With properly written drivers, this is much harder.
The big malware potential comes from WebGL. This allows you to run arbitrary GLSL code in the browser's (GPU) address space. Although you probably can't take over the entire display, you can potentially take over the entire browser window without permission. Hopefully, the driver will give you entirely separate GPU address spaces per GL context, but given how incompetent AMD and nVidia's driver teams have demonstrated themselves to be, I doubt it.
I am TheRaven on Soylent News
I don't want to plow the horn or wave the flag unless I know it's true. But given the various access levels and things that Linux uses in X.org and all that, I wonder if those same issues are more or less likely in a Linux + X situation?
To my understanding, there is not direct reading or writing to the screen. There is screen capture functionality, but I don't know how it works or if it is simply a standard feature of the X window system (and either way, is THAT a vulnerability to be wary of?).
In Windows land, with so many programs requiring "Administrator" level access (yes, I know, that situation is not nearly as bad as it once was, but still) this sort of malware attack vector seems as natural as any others. But does Windows security even consider this sort of breach? I imagine some aspects of device drivers are protected, but does it require privilege escalation to execute one of these attacks? I do recall that recently I was trying to use a PDF password cracker that enabled advanced CPU *and* GPU instructions to perform the processor work of trying to brute force attack a PDF open. I was not running as Administrator at the time but I don't recall that my user account has administrative privileges by default. (I don't believe it does though)
Headline: "Malware Running On Graphics Cards"
TFS/TFA: "Here's a paper showing that malware on graphics cards is theoretically possible and could possibly evade detection."
If you were trying to sensationalize the headline, you might as well have thrown "won't anyone think of the children!?!?" in there as well.
"Always forgive your enemies; nothing annoys them so much." - Oscar Wilde
Only if the X server or another root process is compromised, I think. Reminds me of this warning from Theo years ago:
http://marc.info/?l=openbsd-misc&m=114738577123893&w=2
"I was really not watching porn, it was just the virus that infected my geforce!"
Does anyone find it disturbing that taxpayers' money is used to do the bad guys' work for them? I can understand researching anti-malware strategies, but why are these people given money to come up with bad things to do to my computer?
No, you're thinking at the wrong level. The problem is that every application that gets an OpenGL context can upload programs to the GPU and run them. Fine in theory, and a modern GPU has the ability to isolate different context's memory from each other, but the drivers don't always use it (and don't always use it correctly when they do). If you're using an nVidia or ATi blob driver, then you have the same code controlling the GPU as a Windows user, so if the vulnerability is on Windows it will also be on Linux.
The latest versions of Nouveau do provide some support for giving different contexts different virtual address spaces, but this support may not always be used correctly. I've no idea about ATi / AMD drivers.
If you don't have on-GPU memory protection properly configured, then any GLSL, OpenCL, CUDA, HLSL, or whatever, program can access any of the GPU's memory. This means that anything in VRAM, including the contents of every on-screen window (and even some off-screen ones if you're on a system like OS X, X11 with a compositing manager, or Windows with Aero) is available to the malware.
I am TheRaven on Soylent News
With kernel modesetting, it is possible to run an accelerated X without root privileges (MeeGo does this) but currently there are safety caveats. To support multiple simultaneous users there is a need for a revoke syscall otherwise other users could snoop your input devices by not dropping previous access to devices (you can watch some X devs discussing the issue on Phoronix).
Does have the gpu in the cpu make it easy to get on the system / make it harder to get rid of?
If you were able to use the GPU to brute-force a password hash or similar authentication token for the system, you could install a rootkit on the card's option ROM.
1.It'd get to run with ring 0 access on each boot before the OS has a chance to do anything.
2. On EFI systems it'd have access to a TCP stack, full FAT and NTFS filesystem access, all included in the EDK. So it could update itself on the fly each boot.
The video card makes a great trojan horse to house your malware.
So does this mean that IE9 with its GPU acceleration can be used as the avenue for attack?
I advise reading "My Other Computer is Your GPU" by myself and Jason Rodzik from earlier this year:
http://dank.qemfd.net/dankwiki/images/d/d2/Cubar2010.pdf
It covers these topics, and many more. :D
Once a virus is running on a system, it can shut down virus scanners, and all that kind of stuff. That is always the case. Doesn't matter where it runs. The key is to keep it from running and that's what virus scanners do. They are the doormen, they stop people who are on the "Bad list" from coming in. Well even if your virus was GPU based, it'd still have to come in and execute on the CPU like normal. There is no way to directly load something in the GPU and run it there. As such the virus scanner would get to have a sniff at it and determine if it got to run.
Also, GPU code still has to have a CPU component. The system doesn't have tasks that run just in the GPU. They even note this in their paper. Their "proof of concept" solution? Oh the malware will be "packed" in the CPU code and then unpacked to the GPU. Oh, executable packing/encryption. Ya viruses haven't done that since always. Sorry guys, but virus scanners are wise to that. They check for packed code.
So really, I don't see anything special here. It is the same situation as now where you run the virus scanner to keep the baddies out. If a computer is already infected, it can keep the AV software out and you need to scan it offline.
Plus this kind of malware might be easier to deal with: Just shut down GPU processing. Unlike the CPU, that is a feasible thing to do. So if a system is infected, the GPU gets turned off, the malware cleaned, the GPU restarted. Graphics cards still work fine when addressed in old "Just a bunch of pixels," mode.
It's a good thing I don't have 3D acceleration, yay my lack of open source drivers is finally starting to pay off.
None of the described future attacks are feasible. Shared framebuffer is not accessible to applications directly for security reasons (authors think that this is "unfortunate"); direct access to framebuffer is not "inevitable" in the future -- much better technique is to use driver-controlled fast GPU blits: data doesn't leave GPU. Non-timesharing is non-issue -- driver can detect timeouts and reset hardware (TDR on Vista).
So the only issue is polymorphic virus that may use GPGPU decryption. If this happens, scanners will start using CUDA, or GPU virtualization.
And why not - it's a time-honored tradition to make code run anywhere you can. Those who owned C64s (especially those who read Transactor) will recall that for a while there, programming the 1541 floppy-drive CPU was just about as cool as could be.
... making things simple enough / safe enough for grandma has diminished / lulled many of us into blissful ignorance.
Nowadays systems are so complex, and tools to study them / keep an eye on them are so relatively clueless, there could be^H^H^H^H^H^H^H^H are dozens of things going on in our PCs that we are blissfully unaware of. Very unfortunate
"You must try to forget all you have learned. You must begin to dream." -- Sherwood Anderson
It's harder, therefore effort vs reward is not good enough unless they have some good malware. Just slap some code into a PDF and you're all set.
then this gives us hopes for the Gallium 3D driver stack to fix this and implement proper memory protection on hardware supporting it. Well, to bad for Windows users.
and nonetheless, AdBlock+ and NoScript will very probably block GLSL as they does with any other scripting language. So shoddy websites won't be able to assault you with unstopable full window ads. Well, to bad for IE users.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]