-1

Scenario

An attacker successfully infiltrates the LAN and infects a device that acts as a future bridge. Once inside, the infected device can communicate with a malicious source outside of the local area network. We assume that only one device is infected and that the malware is located anywhere in the computer but it's unable to migrate to other devices in the same LAN. I'd imagine that the tools available today are much more sophisticated and can probably spread across devices by itself, in this case you can provide an answer with this alternative scenario described.

Security Measures

The scenario should be realistically simulated which means that there are some security measures put in place, like there are in most homes today. In this case, the scenario described that the attacker was already inside and had successfully infected a device, which means that the security measures were penetrated.

Question

The infected device is turned off and the power input is active. Can the infected device still function as an access-point from the outside of the LAN?

If so, what measures are needed to completely cut off the malicious communication?

5
  • 1. What do you mean by "it's unable to migrate to other devices in the same LAN"? That the malware is not able to spread to another device? From what you are describing it sounds like, the device itself can't migrate. 2. What exactly do you mean by device? This term is quite ambiguous.
    – Tom K.
    Nov 23 '17 at 12:39
  • Post was edited to clarify what was described. What I mean by device can be understood here [ux.stackexchange.com/questions/89876/… Nov 23 '17 at 12:48
  • Homework question by any chance? Nov 23 '17 at 13:06
  • "The infected device is turned off and the power input is active" - if the power input is active or if the device is battery powered it might look off but can still be somehow on. But, this depends on the specific device, especially if the off-switch is software-only or what does it actually do even in case of real hardware. Nov 23 '17 at 13:08
  • 2
    Does the device support wake-on-LAN? If so, it could be booted up again by a suitable network packet.
    – Simon B
    Nov 23 '17 at 14:35
4

Some devices support Wake-on-LAN, which allows a magic packet to power up a device. In order to do this for malicious purposes, there would need to be another insider that turns the infected system back on.

If the device is infected and displays malicious behavior, it could very well change boot settings (if available) to automatically turn on at a certain time. It could also simply enter a low-power mode when you attempt to shut it off, without actually turning it off. If it truly is off, then it cannot execute code at all, including malicious code.

The best mitigation is to ensure it is powered off or physically lacks any network connection. It is unsafe to use a malicious device, especially if it is on your LAN or any other privileged network. It could attack other devices (such as insecure routers), and perform general lateral movement.

2

The answer is generally no, but technically it is possible.

While the other answer here focuses upon a scenario in which Wake-on-LAN is used to turn other machines on, in order to infect them, that doesn't really directly answer the question of whether or not a machine can be infected while it is powered off.

First, it's worth clarifying what "powered off" means. When you shut your laptop's lid, what power state is it actually in? This is actually rather complicated. Modern systems support quite a wide range of sleep states, each with its own specific details around which system resources are powered.

At a high level, "sleep" means that the system's state is maintained through some means, in such a way that the computer will retain that state when powered back on. The exact implementation details of this depend on the specific sleep state that the system is in.

Sleep states are part of the ACPI specification for computers. S0 is the running state, i.e. what your computer is in right now if you're reading this.

S1, known as Power on Suspend (POS), is the type of suspend you might expect your laptop to be in if you shut the lid and then opened it again a moment later - the CPU and RAM are still powered, but the CPU is halted and does not execute instructions. Non-essential peripherals may be powered off. This is used in order to maintain responsiveness if the user quickly resumes use after the device starts to go to sleep. The power savings are low to moderate, but the system doesn't use this state long-term.

S2 is a slightly deeper sleep state, where the CPU is powered off, but RAM remains powered, and CPU cache information is backed up to RAM. The RAM continues to be fully powered and is refreshed at full speed. Some system peripherals may stay on, but most are powered down.

S3 is what most people are familiar with, and what the "Sleep" button usually does in an OS. The CPU is powered off, like with S2, but the RAM is refreshed at a lower speed, most onboard supervisory circuits are put into a sleep state, the power supply runs in more efficient low-power mode, and all peripherals are powered off or put into a standby mode. This takes longer to resume from, but is the lowest power mode where the RAM stays active.

For all three states above, you lose the system state if you disconnect power from the system, because the RAM loses power.

S4 is an interesting one, because it's functionally the same as powering the system off. It is more commonly known as "Hibernate". The contents of memory are written to non-volatile storage, such as a hard drive, and the system is powered down. The CPU is off, the RAM is not powered, and the system is effectively switched off in the same way that it would be on a normal shutdown. When the computer is powered back on, it recovers the system state from storage and resumes from where it was before. This is separated out as its own power state because it is important for devices to be aware that the system is resuming from an S4 state when it powers back up, rather than doing a "fresh" boot.

S5 is the Soft Off state, which most of us would think of as shutdown. This is where the system is effectively "off", but the PSU is still plugged into a power source. In this state, the PSU continues to provide a small amount of standby power to the motherboard, allowing it to be powered on when the user presses the power switch. Supervisory circuits on the motherboard continue to be powered, and standby functions of peripherals (e.g. Wake-on-LAN on NICs, USB charging ports, etc.) remain operational.

Below S5 is G3, aka. "Mechanical Off". This is where the system has been disconnected from its power source, e.g. by removing the power cable or laptop battery. Supervisory circuits are powered down and no standby functionality can operate.

Another more recent approach is "Hybrid Sleep", wherein the operating system performs the setup steps for S4 (i.e. writing system state to disk) but enters S3 instead. This offers the responsiveness of resuming from S3 sleep without a full power on sequence, but retains state if the system loses power (G3) or is moved into Soft Off state (effectively S4) by the onboard supervisory circuits.

Even when the computer is operating in a Mechanical Off state, some components still retain power through a small onboard battery. The primary two components that are powered by this battery are the real-time clock (RTC) used to maintain the date/time on the system, and the volatile memory IC (aka "CMOS", although this is a misnomer) used to store BIOS/UEFI settings. Modern systems may use an non-volatile EEPROM for the latter, which does not require battery power.

The reason this all matters is because a computer that is quiet and has no display may be in any number of sleep states. The question of "can my computer be attacked while it is off?" is dependent on exactly how "off" it is.

A basic rule of thumb here is that the operating system is not functional in any other sleep state than S0, i.e. fully running. If we're talking about regular malware trying to exploit an OS vulnerability or write malicious files into shared folders, S0 is the only state this can occur in. The applications and operating system are not executing in the S1 state or lower, so any regular vulnerabilities in them are effectively moot at that point.

But that doesn't mean the system isn't vulnerable to attack over the network.

The clearest example here is out-of-band management, also known as lights-out management. OOB management allows you to communicate with the system while it is powered off (Soft Off), over the network, independently of the system state and operating system. You may be familiar with implementations such as AMT, iLO, and DRAC. This functionality is implemented by a Baseboard Management Controller (BMC), which remains powered independently of the current sleep state. This allows administrators to remotely monitor the system, change hardware settings (think of it like remote BIOS/UEFI config), change the boot device, power the system on and off, and other administrative tasks. An OOB management solution may offer other features like remote access (VNC) so that POST and the OS display can be viewed and interacted with remotely.

Most consumer systems do not come with a BMC. On server platforms the BMC is usually a dedicated piece of hardware that plugs into the motherboard, with its own CPU, RAM, and network interface. Higher-end Intel CPUs come with a feature called Active Management Technology (AMT), which is effectively an integrated BMC. This feature is implemented by the CPU itself, and the Intel Platform Controller Hub (PCH), which is more commonly referred to as the chipset.

These systems have access to privileged system resources such as memory. If an attacker can gain control over the BMC, they can maintain access to the system as long as it is in a Soft Off power state or higher. Vulnerabilities in the OOB management stack can be very powerful, and many have been found over the years.

A more advanced approach would be to attack the peripheral devices themselves. Network controllers (NICs) are extremely feature-rich these days, and have a significant amount of firmware. It is entirely possible that a network card could be compromised over the network using a vulnerability in its firmware. Once the card is compromised, it could be leveraged to access system memory using DMA over the PCIe bus. This may still occur in low sleep states if a wired network card is kept running.

As for why you're not hearing about attackers using these tricks all the time: it's really hard work to develop these exploits, and it's generally not worth the effort. Vulnerabilities in iLO, DRAC, and network cards only work against specific targets (i.e. systems with a vulnerable version of that technology) and require a ton of knowledge and development time to build. Discovering and exploiting vulnerabilities in more widespread management technologies like AMT also requires a lot of advanced R&D, and it makes no sense to burn a capability like that on an average bit of banking malware or ransomware - you can make a lot more money selling it to governments, with the added bonus of not worrying about jail in the process.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.