GPU Malware Can Also Affect Windows PCs, Possibly Macs

itwbennett writes: A team of anonymous developers who recently created a Linux rootkit that runs on graphics cards has released a new proof-of-concept malware program that does the same on Windows. A Mac OS X implementation is also in the works. The problem the developers are trying to highlight lies not with the operating systems, such as Windows or Linux, nor with the GPU (graphics processor unit) vendors, but rather with existing security tools, which aren't designed to scan the random access memory used by GPUs for malware code.

Comments

using the OpenCL APIs is *noisy*

[flowerp]

I question why anyone would go that route for writing malware. When you start using the OpenCL APIs, your graphics cards will clock up and leave their low power states. The graphics card resource utilization (compute, memory transfers, memory usage) is shown by monitoring tools such as GPU-z and command line tools such as nvidia-smi. You can't hide anything on the GPU.

Re:using the OpenCL APIs is *noisy*

[Anonymous Coward]

They go that way because its there, obviously. Malware writers find the blindspot and that is a blindspot.

If the malware writers don't find that then the NSA hackers will. Remember the hard disk flash is used by that NSA malware not the hard disk? That may in turn have had help from the hard disk vendors, by providing the NSA with the code for their hard disks:

http://www.stuff.co.nz/technology/digital-living/66279485/NSA-hiding-Equation-spy-program-on-hard-drives

Or that the NSA phone spyware that installs/runs itself in the modem chip of the mobile phone, not the computer of the mobile phone. That is easier because there are fewer modem makers than mobile phone makers. Qualcom LTE being common among many handsets.

Or that spyware that runs inside the USB driver flash chip not the computer?

If you don't notice the activity on your CPU why would you notice it on your GPU?

Re:using the OpenCL APIs is *noisy*

[gstoddart]

Honestly, it's an attack vector.

Assuming that a particular attack vector couldn't ever happen sounds rather shortsighted.

What's more likely ... this takes more work, but people will do it because of the same reasons they always write malware? Or that they'll just throw up their hands?

Because if there's money to be made, or fun to be had ... why the hell wouldn't they exploit anything they can?

Load of overhyped bullshit.

[Anonymous Coward]

The linux rootkit doesn't "run on GPUs".
It allocates a buffer on the GPU and then stores strings in that buffer.
So they've demonstrated that ... you can store data in RAM.
Whoop-dee-fucking-doo.

Found the link

[Anonymous Coward]

The are lots of OSs in your computer that are hacked already. The wireless keyboard software or the wifi modem, or the ethernet card software running there. Even on an Apple HDMI *CABLE*, there was an ARM chip (doing re coding) that happens to be upgradeable, i.e. hackable by malware. The vendors leave the OS flashable since it might need a bug fix later, but in doing so they leave it exposed to malware.

Apples HDMI cable is an ARM chip that can be 'upgraded':
http://www.theverge.com/2013/3/1/4055758/why-does-apples-lightning-to-hdmi-adapter-have-an-arm-computer-inside

Phone SIM Card OS hacked, yes the sim card even has an OS:
http://www.extremetech.com/computing/161870-the-humble-sim-card-has-finally-been-hacked-billions-of-phones-at-risk-of-data-theft-premium-rate-scams

The modem in the OS hacked:
http://www.extremetech.com/computing/170874-the-secret-second-operating-system-that-could-make-every-mobile-phone-insecure

Sigh.

[ledow]

1) It's misleading. The code is not executing on the GPU, it's just stored there.

2) It's obvious. If you're just storing code as data, it doesn't matter what OS you use to do that.

3) It's blatant pandering to media. Two stories (at least) on this, no extra content besides the bleeding obvious.

4) It's a symptom of stupidity. If your only safety comes from being able to scan RAM or storage devices and find a "signature" amongst them of a known virus, you're an idiot. It's a stupid, pointless waste of time and computing resources. That there's an area of RAM available that DOESN'T have live protection built into existing antivirus is not shocking at all. Hell, you could store string stuff in the TPM chip, or in the HPA of a hard drive, or in an onboard EEPROM or anywhere else that antivirus can't scan. They'll be unable to "certify" it as safe (as if they could anyway!) and will have to rely on somehow spotting the loader program before execution no matter what variant of it is used, or how the actual data payload is encrypted. (Hint: They can't. Antivirus is exclusively "after the horse has bolted" security.

5) Really, Slashdot?

...with no memory protection.

[DrYak]

except that with big vendors like Nvidia, there is no memory protection (no good IOMMU support yet).

So they've demonstrated that ... you can store data in RAM.
Whoop-dee-fucking-doo.

Except that, due to the above, that *RAM* happens to be accessible to anyone who might give a try.

CPU:
Imagine you have a software in which you are editing your *super secret* document.
Imagine that there's a different software running in user space.
That software can't access your document - there's a MMU on the CPU enforcing memory protection. A piece of software can't reach out to a memory block it doesn't have explicit access granted.

GPU:
Now imagine that the editor displays your document on the screen. It goes through the compositor onto a buffer on the graphic card (either GPU RAM, or RAM accessed by the GPU), before finally getting assembled for displaying on the screen (that's a normal behaviour).
Now imagine you're also running a 3D game on the same computer. That game uses OpenCL to compute its physics. ...but...
one of the shader run on the GPU is actually a trojan: instead of reading from some buffer used for the physics computation, it reads using a pointer to the location of CPU RAM where the display buffer of the first program is.
It shouldn't be allowed to do so, but it does anyway. (e.g.: Nvidia's proprietary drivers) The request goes through and the game can siphon the output of the super secret editor. There's is (currently) nothing to enforce such memory protection and prevent one GPU shader to peek into buffers from another applications. Currently any shader running on the GPU can peek from any location it wants to.

Nvidia and AMD need to properly implement support for IOMMU & the MMU inside the GPU itself.

Re:...with no memory protection.

[Anonymous Coward]

except that with big vendors like Nvidia, there is no memory protection (no good IOMMU support yet).

So then why not demonstrate that instead of "look mommy, I can store data in a buffer I own"?

Currently any shader running on the GPU can peek from any location it wants to.

Go ahead, try it. Hint: it won't work.

Nvidia and AMD need to properly implement support for IOMMU & the MMU inside the GPU itself.

They did. About 8 years ago.