Guest MaxDamage Posted October 4, 2006 Share Posted October 4, 2006 ... Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 Yeah I just heard about this, it was released at the latest Demo in Denmark I believe? Are you using the same method? Quote Link to comment Share on other sites More sharing options...
VaKo Posted October 4, 2006 Share Posted October 4, 2006 Go for it. It looks like using something akin to drivelock will stop this, so we have a counter to it (my only concern about the project personally). As long as its known that its stopable, then I see no problems with your incredibly cool hack. Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 Grr. Now I can't find the link to the app that was demo'd at Demo. (Demo is a conference btw). I heard about it on Cnet's BOL and I cant seem to find the link on the forums. Grr. Quote Link to comment Share on other sites More sharing options...
Guest MaxDamage Posted October 4, 2006 Share Posted October 4, 2006 ... Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 No i actually havent seen it yet. I'm trying to track down the link right now. I know that it was released within the last week at a demoparty, but I'm not sure which one it was because Tom Merritt who mentioned it on Cnet BOL and it wasnt posted in the show notes. It was one of those things in passing but it's not really their thing so the other hosts didn't pick up on it. I assumed it was released at The Gathering but I'm not able to find it there. Now the 7th bit on the first byte on the disk, how exactly are you supposed to find that in a hex editor? I havent checked because I'm only familiar with hex editors that allow you to open files... no full volumes. Does it have to do with changing the device class from 0x08, or the bInterfaceSubClass? Quote Link to comment Share on other sites More sharing options...
moonlit Posted October 4, 2006 Share Posted October 4, 2006 I don't remember which ones can do it but I have come across hex editors that can mess with the raw data on a volume... I'll have to do some digging later and see what I can find, this sounds like an interesting method. Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 If this method can be documented in the next 12 hours it can be "slipstreamed"* into 2x03. *Yes, thats what I'm calling it. Yes, it does sound a lot better than "really effing behind schedule on editing" Quote Link to comment Share on other sites More sharing options...
moonlit Posted October 4, 2006 Share Posted October 4, 2006 I'm currently screwing with my MP3 playing in WinHex... I don't have a USB stick but I'm guessing it works the same way, I hope it doesn't brick... Will report back as soon as I work it out :) Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 URLs of possible interest: http://www.microsoft.com/whdc/whql/resources/support.mspx http://www.microsoft.com/whdc/device/storage/usbfaq.mspx http://www.usb.org/developers/defined_class/ http://en.wikipedia.org/wiki/Usb Quote Link to comment Share on other sites More sharing options...
moonlit Posted October 4, 2006 Share Posted October 4, 2006 The removable media device setting is a flag contained within the SCSI Inquiry Data response to the SCSI Inquiry command. Bit 7 of byte 1 (indexed from 0) is the Removable Media Bit (RMB). A RMB set to zero indicates that the device is not a removable media device. A RMB of one indicates that the device is a removable media device. Drivers obtain this information by using the StorageDeviceProperty request. Unconfirmed but may be of use. Edit: Thanks for linkage Darren :) Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 Yes but the question then becomes, if we can tell windows that the device is not removable, and it thinks its a cdrom, and it autoruns, are we then able to write to the device? or does it not think the device is a cdrom. does it consider the device a hard disk drive. and if so, does it then autorun? I wont be able to test this until I get back to the studio this in about 6 or 7 hours, at which point i need to devote all of my human resources into editing, so really I wont be able to get this hack going until after the episode is done, in which case no way of "slipstreaming" this new info. And no, we're not going to issue a patch (.5). So, I guess this is exactly what Dev5 was created for. Can we do it? It would be so perfect for the current topic of this episode. If we wait another month to do it, it may be old news. Gah. I need more time. Quote Link to comment Share on other sites More sharing options...
moonlit Posted October 4, 2006 Share Posted October 4, 2006 Well from what I've read so far, if it identifies as a CDROM device it's NOT writable, telling it that it's a HDD is hit and miss from my experience with fixed-disk autorun... So how about partitioning it? Partition however much we need for switchblade and define it as a CDROM device then have the remaining as a flash USB UMS device... I don't know if this would screw with the device identification though, I'm not sure if it needs to be a physical device or if it can be a logical partition that you trick Windows in to thinking is a CDROM... Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 It's a good idea and sounds like the perfect start for my trials. I'll pick up a couple small cheap USB flash disks on my way home from work today and try it out. Esentially what you've described is exactly what U3 is. In fact, the 1GB U3 drive I have is actually 6MB shy of 1GB on the FAT partition. The 6MB has been reallocated to the CDFS partition, so we might need to not only repartition the drive and edit the 7th bit to make it a "cdrom", but we may need to format it for CDFS... or do we? MaxDamage, can you maybe shed some light on this? Quote Link to comment Share on other sites More sharing options...
Guest MaxDamage Posted October 4, 2006 Share Posted October 4, 2006 ... Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 you may in fact be the first if i'm not able to find it. thanks for the report from the road. i'll add those keywords to my search criteria and hopefully have confirmation on this. either way i'll bet $20 that we'd be the first to use it in such a manner. moonlit & vako, don't forget that your concerns have been heard and as such you should expect a whitehat segment or two on prevention, both for the user side and system side. i dont want you guys to think we've gone blackhat. it was supposed to be in this episode but the security companies that we've been talking to want, for some reason, to mail us their products rather than email it, so it's taking a bit longer to get them in the labs for testing (and setting the labs up as a proper testing environment, etc) Quote Link to comment Share on other sites More sharing options...
Jester Posted October 4, 2006 Share Posted October 4, 2006 Give me about 2-3 hours and I will be at the house to test this out and report back on it. Darren what you need to make work as minimal as possible on so we can toss it into the episode? 8) Quote Link to comment Share on other sites More sharing options...
a5an0 Posted October 4, 2006 Share Posted October 4, 2006 I'm working on it under linux. Ill post when It works. I think I'm almost there... Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 Wow, so much great support. I don't know any more than what's been discussed in this thread, and what's in the links mentioned. Thanks guys. I'll check in when I get home from work... In about 240 kilometers (Yes, kilometers can be time as well as distance) Quote Link to comment Share on other sites More sharing options...
a5an0 Posted October 4, 2006 Share Posted October 4, 2006 I GOT IT TO WORK!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! AHHHHH!!!! EXCITEMENT!!!!!!!! heres what I did (I'm using linux btw): First off, I used my partition editor (gparted) to put an 8MB partition at the beginnng of the drive. This was set to be unformatted, just empty space. The remaining space was formatted as FAT32. Then I dl'd Max's Loader files (I used the cruzer, no reason, just did) I opened up the .iso file in ghex (hex editor) and changed the first byte to AB. Then, (this is important) I made sure the disk was unmounted, and did dd if=~/Desktop/cruzer-autorun.iso of=/dev/sdb1 Note that sdb was where my thumbdrive is. Unplug and replug the drive and it mounts the first part as a CDROM and the second part as a usbdrive! I looked in the CDROM, and there waws the loader! GOOD LUCK! edit: note also that you dont have to edit the actual disk, you just edit the iso and then dd it over to the blank space, effectivly making that partition CDFS. EDIT PART 2: I'm having trouble on the windows side of it. The drive is recognised as a CD in linux, but not windows. I would RECCOMMEND AGAINST doing what I just posted until I can figure out why. I dont want to be responsible for bricking anyoe's drive! In other words, I'm working on it, if you try my method, and it doesnt work, dont kill me Quote Link to comment Share on other sites More sharing options...
VaKo Posted October 4, 2006 Share Posted October 4, 2006 Windows won't see beyond the first partition on a USB stick. Thats why the u3 disks have special firmware/electronics/magic smoke, otherwise everyone would have done it. As for the whitehat/blackhat thing. I know the forums aren't representitive of the show, but it seemed like all the work was being done to make the switchblade harder hitting. And no work was being done (in that thread) to make sure there was an effective counter to it, which with an exploit like this should be an aim. Glad to see there is work being done on it, and i have had my concerns put to rest. So its all kosher matey. Quote Link to comment Share on other sites More sharing options...
a5an0 Posted October 4, 2006 Share Posted October 4, 2006 indeed. we need some magic smoke. No darren, not THAT magic smoke Quote Link to comment Share on other sites More sharing options...
Guest MaxDamage Posted October 4, 2006 Share Posted October 4, 2006 ... Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted October 4, 2006 Share Posted October 4, 2006 Ok I'm leaving work now. I'll be back on this in 3 hours (long drive) Quote Link to comment Share on other sites More sharing options...
Guest MaxDamage Posted October 4, 2006 Share Posted October 4, 2006 ... Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.