How many of your raspis have an mmc1? I can give you a file system dump but it won’t help much as the fun stuff is loaded into a ramdisk from inaccessible hidden partition and only the unmodified components are available to dump. Offline forensics won’t make much headway.
-
-
Replying to @dragosr @AndreaBarisani and
All of them have mmc1, you idiot. The Raspberry Pi 3 B has built-in WiFi. *SDIO* WiFi. How do you think it connects to the SoC, magic pixie dust?pic.twitter.com/buAT7zvlIH
2 replies 0 retweets 1 like -
Seriously, you have *no excuse* for this stuff. The moment you saw "mmc1" you should've looked at sysfs to find out what that is used for, or the device tree to figure out how it's configured. This is just shoddy research. https://github.com/raspberrypi/linux/blob/rpi-4.14.y/arch/arm/boot/dts/bcm2837-rpi-3-b.dts …
1 reply 0 retweets 1 like -
Replying to @marcan42 @AndreaBarisani and
Don't care what it's used for there, as long as adversary has multiple control links in (probably multiple operators). Static thinking again. A few lines of code and dev will deploy other use in 15 minutes. Analysis needs to wait for control neutralization/isolation.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
You said "How many of your raspis have an mmc1?" and I explained to you how the answer is ALL OF THEM (of this model). Are you going to ever admit you confused something completely benign for an IOC, or just keep bullshitting forever?
1 reply 0 retweets 2 likes -
Replying to @marcan42 @AndreaBarisani and
Look at some raspi boot dmesgs and you will get what I'm talking about. I do that so often I can sometimes pick out lines that are wierd as it scrolls by even. Please stop being patronizing. Maybe these folks are already on your some of your computers. Would you know?
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
I'm still waiting for a single piece of verifiable evidence that something is out of place. Where are these "weird" boot logs? Perhaps you should start considering that if everyone else can find a benign explanation for everything you point out, maybe the problem is in your head.
3 replies 0 retweets 2 likes -
Replying to @marcan42 @AndreaBarisani and
You seem to think my job is to convince you. My task's securing my computers. Ocasionally advice for others own good/public benefit. And pick big problems/threats for conferences so folks can work on. You think I'm crazy? Enjoy life in the Prepositioned Cyberasset Club.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
*My* job is security, and when stuff like BadBIOS makes headlines it's an embarrassment to my field. *You* have a delusional paranoia problem, and I'm trying to help you because otherwise you'll convince other, less clueful people of your nonsense and it'll spiral out of control.
3 replies 0 retweets 4 likes -
Replying to @marcan42 @AndreaBarisani and
Meanwhile I consider such obliviousness to advanced attackers somewhat embarrasing. I think we have detente.
1 reply 0 retweets 0 likes
I'm cognizant of advanced attackers. They just don't happen to be your problem. Your problem is delusional paranoia.
-
-
Replying to @marcan42 @AndreaBarisani and
Really now? When was the last time you analyzed a rootkit on your machine? Caught any APTs and learned any cool new tricks from them lately? That's the fun part when they suprise you. But it sounds like you'd rather stay sleepy and oblivious.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
You see, my thing happens to be *hardware* security, not soft APTs. Which is what *you're* stumbling through, cluelessly mistaking every second triviality for an IOC. I have no idea how to analyze Windows kernel rootkits but I can damn well tell you your scope traces are normal.
2 replies 0 retweets 1 like - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.