Hidden Functionalities in Electronic Devices and Computer Software

1
Hidden Functionalitiesin Electronic Devices and
Computer Software

• Lt Pawel Koszut
• Ministry of National Defence (POLAND)?

2
Hidden Functionalitiesin Electronic Devices and
Computer Software

• Simple backdoor implementation

3
XOR Example

• function xor (int a,b)
• if (a?b) return 1 else return 0

4
XOR Example
5
XOR Example
6
Prosty przyklad XOR
7
XOR Example
8
XOR Example
9
XOR Example

• It is important to take notice of the following
  
• The length n of secret triggering sequence
  secret_sequence can be long enough to
  effectively prevent triggered_action() from being
  called unintentionally
• The triggering strategy presented above is only
  an example - an adversary's creativity in
  developing other triggering conditions is not
  constrained by this example
• Hidden functionalities may exist in multiple
  locations of a device, and can be designed to
  interact each other

10
Applicationin Telecommunication Devices
11
Przyklad urzadzen telekomunikacyjnych
12
Threat analysis
13
Threat Analysis
14
Threat Analysis
15
Threat Analysis
16
Threat Analysis
17
Threat Analysis
18
Critical Security Vulnerabilities
19
Critical Security Vulnerabilities
20
Critical Security Vulnerabilities

• 365 days most computers have already been
• updated
• 1 day few computers have been updated, most
• of them remain vulnerable
• 0 day all computers are vulnerable

21
Critical Security Vulnerabilities

• Applications

22
Critical Security Vulnerabilities
23
Critical Security Vulnerabilities
24
Critical Security Vulnerabilities
25
Critical Security Vulnerabilities

• Where can we get 0-day vulnerbilities ?

26
Critical Security Vulnerabilities
27
Critical Security Vulnerabilities

• We sometimes pay for exploits. An average price
  for a 0-day Internet Explorer flaw is US10,000
  in case of good exploitation.
• Zródlo
• http//www.securityfocus.com/news/11476
• Robert Lemos, SecurityFocus 2007-07-20

28
Critical Security Vulnerabilities
29
Critical Security Vulnerabilities
30
Hidden Functionalitiesin Electronic Devices and
Computer Software

• Covered in the Analysis
• 1. Information on possible security threats and
  ideas for law-enforcement applications
• 2. Proposals of counter-measures strategies

31
Hidden Functionalitiesin Electronic Devices and
Computer Software

• Thank you