Tag Archive for: .bit

A bit of C and some shell scripts to the rescue • The Register

/in


On Call It’s another tale from the world of telephony where everything goes wrong in this week’s On Call.

Today’s story comes from a Register reader Regomised as “Greg.” Greg was the applications manager for a now-defunct telco, and was the throat to choke for all the applications in the customer-facing side of the business. The network side, where telephone calls were actually connected, was a whole other ball game for which he was most definitely not responsible.

“On my side of the world,” he told us, not at all highlighting a worryingly siloed side to the business, “we had a customer service application, which is where the sales clerks entered the details of new customers.

“The clerk would type up the new customer’s details, the application would save them and tell the network side to set up the customer on the telephone exchanges. When done, the network side would tell the customer front end that this was all complete.”

The system hadn’t been so much designed as “evolved” over time, the dependencies likely lost in the mists of poorly commented code and unhelpful documentation that had accumulated over the years like crud in a cutlery drawer.

“It worked, most of the time,” he said, “but that was all you could say.”

And as much as one might hope for.

However, there came a time when a total power-down was needed. Everything in the building had to be turned off – computers, servers, everything. There was to be no UPS, no battery backup. All kit was to be shut down.

This shouldn’t have presented a problem in itself. The remote telephone switches would deal with network calls, but customer service was to be totally offline.

“It took weeks of planning,” said Greg. “We had never tested a total power down before, because we had redundant systems, so a…

Source…

Researchers demonstrate how malware can detect its environment using the trap bit

/in


Recently, security researchers demonstrated how the use of the trap bit in x86 processors could inform running malware if it is running in a virtual environment or not. What is the purpose of the trap bit, how can it benefit malware, and what does this mean for future CPU hardware and virtualisation?

In the x86 CPU architecture, the trap bit is a special flag in the EFLAG register that raises an interrupt after completing a single instruction once the flag is set. For example, a piece of machine code would first set the trap flag, execute an instruction, and this would then trigger the CPU to execute a special interrupt that runs a subroutine.

While there is no specific purpose for the trap flag, it is convenient for debugging as it allows for code to be executed step-by-step. Furthermore, the interrupt allows for viewing the CPU contents, including registers, program counter, and stack pointer.

Recently, researchers from Palo Alto Networks demonstrated how the trap bit in x86 processors could be abused by malware to determine if the malware is being executed on a real computer or in a virtual machine. The cause of the exploit lies in how virtual machines emulate the behaviour of the trap flag. If a piece of malware sets the trap flag after executing certain special instructions such as RDTSC and CPUID, the CPU should return to the malware code with the trap bit cleared. While this is the case in real hardware, virtual machines may not catch this and return to the code with the trap bit still set.

The calling of a special instruction sees the CPU handle the interrupt, but if the trap bit is enabled on a basic instruction such as NOP, the malware can use its interrupt handler to detect this. Thus, if the malware interrupt handler is fired with the trap bit set, it knows it is running on a virtual machine. If no exception is thrown, then the malware knows that it is running on a real system.

One practical use of virtualisation is to test unknown code and applications to see how they behave. For example, an individual could find a USB flash drive lying around with no idea what is inside. While one could risk…

Source…

OpenNIC drops support for .bit domain names after rampant malware abuse – ZDNet

/in

OpenNIC drops support for .bit domain names after rampant malware abuse  ZDNet

OpenNIC maintainers also worried about cyber-criminals hosting child pornography on .bit domains.

“malware news” – read more