B
BadBIOSVictim
In November 2011, after booting to Privatix, a live German Tor distro, my linux boxes became infected with BadBIOS. BadBIOS infects burning of DVDs. Recently, I purchased two live Fedora 20 DVDs from a honest and nice Ebay seller. They are tampered. I don't believe the seller tampered them.
Fedora 20 has similar packages as the tampered Privatix.
http://www.linuxforums.org/forum/sec...tml#post950611
I could not find a list of preinstalled packages in Fedora 20 filesystem nor on Fedora's wiki. Could someone refer where to find it?
Is Privatix and Fedora injecting BadBIOS as microcode into the video card? Is Privatix and Fedora 20 PXE booting using squashfs, busybox and dracut? Are they keylogging keystrokes using AmigaOS and Atari keymaps to stream data via hamradio and GNUradio using the dialup modem's piezo electric two way transducer? I had removed the wifi card, conductive speakers and internal hard drive. Hard drives have a piezo transducer.
I will ship the Fedora 20 DVD to anyone interested in conducting forensics. Please PM me.
Fedora's clock is four hours behind using both computers.
Microcode can be a malicious firmware rootkit. Microcode injection in Tails a backdoor? : onions
Both Privatix and Fedora 20 are injecting microcode into the videocard of my HP Compaq Presario V2000. DMESG in terminal:
[ 3.192977] [drm] radeon: irq initialized. [ 3.192997] [drm] Loading R300 Microcode [ 3.193823] [drm] radeon: ring at 0x0000000060001000 [ 3.193847] [drm] ring test succeeded in 1 usecs [ 3.194191] [drm] ib test succeeded in 0 usecs [ 3.194723] [drm] Panel ID String: QDS [ 3.194726] [drm] Panel Size 1280x768
[ 52.754086] microcode: AMD CPU family 0xf not supported
Fortunately, this AMD processor does not support microcode.
The R300 radeon microcode injection by Privatix was fake microcode. I suspect the R300 radeon microcode in Fedora is also fake. The fake microcode is some type of firmware rootkit, possibly BadBIOS. Microcode injection in Tails a backdoor? : onions
Last week, I discarded my BadBIOS infected HP Compaq Presario V2000 and continued conducting forensics on the Fedora 20 DVD using a Dell Vostro 200.
Fedora 20 injected microcode into Dell Vostro 200 CPU:
[ 38.492840] microcode: CPU1 sig=0x6fd, pf=0x1, revision=0xa1 [ 38.493074] microcode: CPU1 updated to revision 0xa4, date = 2010-10-02 [ 38.493169] microcode: Microcode Update Driver: v2.00 tigran@aivazian.fsnet.co.uk, Peter Oruba
Fedora 20 file manager does not ask guest if want to open removable media. Guests has to click on activities > file manager > removable media.
Fedora 20 Disk Utility is tampered. Option to rename partition is missing.
Fedora 20 has no boot splash unless booting freezes in which case an error message is displayed. Boot splash can detect tampering that /var/logs do not. Boot splash should be the default setting for all linux distros.
/var/log is missing dmesg.log, kernel.log, messages.log, sys.log, etc. Of the logs that are in /var/log, the majority guests do not have the file permissions to read.
There is another /var/log at /run/media/_Fedora_Live_Desvar/log and /run/media/_Fedora_live_Des1/var/log
/var/boot.log: "Starting dracut mount hook... [[32m OK [0m] Started dracut mount hook. [[32m OK [0m] Reached target Initrd Default Target.
Welcome to [0;34mFedora 20 (Heisenbug)[0m!
[[32m OK [0m] Stopped Switch Root. [[32m OK [0m] Stopped target Switch Root. [[32m OK [0m] Stopped target Initrd File Systems. [[32m OK [0m] Stopped target Initrd Root File System. Starting Collect Read-Ahead Data... [[32m OK [0m] Reached target Login Prompts. [[32m OK [0m] Reached target Remote File Systems."
A search forbusybox in filesystem found: 05busybox folder located: /usr/lib/Dracut/modules.d
Both Fedora 20 and Privatix have many unknown file types in their filesystems. For example, var/log.boot.log: Starting Load/Save Random Seed... I searched 'seed' in filesystem: seed type: unknown location: /usr/lib/seed-gtk3
Search for 'initrd' in filesystem found:
initrd-plymouth.img type: unknown location: /boot initrd0.img type: unknown location: run/initramfs/live/isolinux
Search for 'squashfs' found: squashfs.img type: unknown location: /run/initramfs/live/LiveOS
Search for 'pxe' in filesystem found:
pxeboot.img type unknown location: /usr/lib/grub/i386-pc pxe.pyc type:unknown location: /usr/lib/python2.7/site-packaes/sos/plugins
Dragos Ruiu, discoverer of BadBIOS, noted an increase in 8 bit fonts. Fedora 20 and Privatix have preinstalled hamradio and 8 bit packages: Amiga, MacIntosh, MacOS, lilypond (sheet music for MacOS), atari and TOS (Atari's operating system). German Tor CD has PXE server streaming Amiga Soundtracker audio, multiple squashfs, multiple busybox, preseeds & initrd.imgs : onions
Fedora 20's atari files at:
atari type: folder location: /usr/lib/kbd/keymaps/legacy ataritt type: text location: /usr/share/X11/xkb/geometry attaritt type: text location: /usr/share/X11/xkb/keycodes attaritt type: text location: /usr/share/X11/xkb/symbols/xfree68_vndr
atari-de-map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari
atari-se.map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari
atari-us.map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari atari-uk-falcon.map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari
A search for TOS (Atari's operating system)found:
fonttosfnt type: executable location: /usr/bin libxt_
tos.so type: shared library location: /usr/lib/xtables libgtossaudio.so type: shared library location: /usr/lib/gstreamer-0.10
libgtossaudio.so type: shared library location: /usr/lib/gstreamer-1.0
Nintendo files at:
x-nintendo-ds-rom.xml type: markup location: /usr/share/mime/application
vnd.nintendo.snes.rom.xml type: markup location: /usr/share/mime/application
All the amiga files have the word 'amiga' in them:
part_amiga.mod type: amiga soundtracker audio (audio/x-mod) location: /usr/lib/grub/i386-efi
part_amiga.mod type: Amiga SoundTracker audio (audio/x-mod) location: /usr/lib/grub/i386-pc part_amiga.module type: object code location: /usr/lib/grub/i386-efi
part_amiga.module type: object code location: /usr/lib/grub/i386-pc
amiga type: folder location: /usr/lib/kbd/keymaps/legacy amiga-de.map.gz type: archive Location: usr/lib/kbd/keymaps/legacy/
amiga-us-map.gz type: archive Location: usr/lib/kbd/keymaps/legacy
Are AmigaOS and Atari keylogging keystrokes to stream data using audio and hamradio or GNURadio?
A search for 'MacIntosh' files found:
MACINTOSH.so type: unknown location: /usr/lib/gconv MACINTOSH.gz type: archive location: /usr/share/i18n/charmaps
MACINTOSH.so type: unknown location: /run/media/liveuser/_Fedora-Live-Des1/usr/lib/gconv
MACINTOSH.so type: unknown location: /run/media/liveuser/_Fedora-Live-Des/usr/lib/gconv
MACINTOSH.gz type: archive location: run/media/liveuser/_Fedora-Live-Des1/usr/share/i18n/charmaps
MACINTOSH.gz type: archive location: run/media/liveuser/_Fedora-Live-Des/usr/share/i18n/charmaps
macintosh_vndr type: folder location: /run/media/liveuser/_Fedora-Live-Des1/usr/share/X11/xkb/symbols
A search for MacOS found:
20macosx type program location: /usr/libexec/os-probes/mounted
macosx.html type: text location: /usr/share/doc/cyrus-sals-lib
macosxSupport.pyc type: unknown usr/lib/python2.7/idlelib macosxSupport.pyo type: unknown /usr/lib/python2.7/idlelib macos.xml type: markup /usr/share/libosinfo/db/oses macosxSupport.cpython-33 type: unknown /usr/lib/python3.3/idlelib/pycache
macosxSupport.cpython-33 type: unknown usr/lib/python3.3/idlelib/pycache
A search for lilypond (sheet music for MacOS) found:
lilypond.lang type: text location: /usr/share/highlight/langDefs x-lilypond.xml type: markup location: /usr/share/mime/text
A search for 'hamradio' in filesystem found:
hamradio type: folder location: /usr/lib/modules/3.11.10-301.fc20.i686/extra/drivers/net
hamradio type: folder location: /usr/lib/modules/3.11.10-301.fc20.i686/extra/drivers/net
Is BadBIOS using 8 byte operating systems such as MacIntosh, MacOS, lilpond via hamradio?
Gedit text editor tampering:
Gedit is missing 'Preferences' in the 'Edit' tab. Gedit is mising 'Help' tab in the menu. Therefore, no 'Contents' and 'About' tabs.
After guest edits a text file on removable media, a hidden backup file is created and permanently saved on removable media. Fedora does not detect the permanent backup file as a backup file. Type: unknown
Timestamps of the backup files go backwards in history. First backup file has today's date, June 5, 2014. The others created on same date are dated March 12, 2014, February 7, 2013 and November 14, 2012.
Both Fedora 20 and Privatix copies entire photographs from guests' removable media. German live Tor distro has xulrunner, webinspector, eMusic & duplicates personal files : onions. After guest opens a folder on removable media containing photographs and opens one of the photographs, Fedora 20 takes a screenshot of all the photographs in the folder. The 43 hidden thumbnails is at home/liveuser/.cache/thumbnails/large.
In home/liveuser/.cache/thumbnails/fail/gnome-thumbnail-factory are 60 hidden pngs. They are solid black. Possibly failed attempts to take webcam screenshots. HP Compaq Presario V2000 does not have a external webcam. I removed the conductive speakers. Yet, Privatix's boot splash detected:
input: PC Speaker as /devices/platform/pcspkr/input/input5 Linux video capture interface: v2.00 uvcvideo: Found UVC 1.00 device USB2.0 UVC VGA WebCam (13d3:5702) input: USB2.0 UVC VGA WebCam as /deices/pci0000:00/0000:00:1d.7/usb1/1/-6/1-6:1/0/input/input6 usbcore: registred new interface driver uvcvideo USB Video Class driver (v.0.1.0) (drm) Initializing drm 1.1.0
I wish Fedora's default boot would display boot splash.
home/liveuser/.local/share/gvfs-metadata. Contains root log, three uuid logs, etc. Clicking on the logs does not bring up gedit.
systemctl detected three virtual blocks k-dm/x2d0 - x2d2 and four virtual blocks loop0 - loop4
Disk Usage Analyzer detected:
Other devices:
4.3 GB Block Device /dev/mapper/live-rw volume: _Fedora-Live-Des mounted at Filesystem Root
4.3 GB Block Device /dev/mapper/live-base mounted at /run/media/Liveuser/_F
4.3 GB Block Device /dev/mapper/lilve-osming-min
8.2 KB Loop Device /osmin.img(deleted) Volumes: squashfs Location: /run/media/liveuser/disk1
1.3 MB Loop Device /osmin volumes: DM-snapshot-cow device: /dev/loop1
930 MB Loop Device /run/initramfs/live/Live volumes: squashfs Mounted: /run/media/liveuser/disk Cannot scan: "permission denied"
Continue reading...
Fedora 20 has similar packages as the tampered Privatix.
http://www.linuxforums.org/forum/sec...tml#post950611
I could not find a list of preinstalled packages in Fedora 20 filesystem nor on Fedora's wiki. Could someone refer where to find it?
Is Privatix and Fedora injecting BadBIOS as microcode into the video card? Is Privatix and Fedora 20 PXE booting using squashfs, busybox and dracut? Are they keylogging keystrokes using AmigaOS and Atari keymaps to stream data via hamradio and GNUradio using the dialup modem's piezo electric two way transducer? I had removed the wifi card, conductive speakers and internal hard drive. Hard drives have a piezo transducer.
I will ship the Fedora 20 DVD to anyone interested in conducting forensics. Please PM me.
Fedora's clock is four hours behind using both computers.
Microcode can be a malicious firmware rootkit. Microcode injection in Tails a backdoor? : onions
Both Privatix and Fedora 20 are injecting microcode into the videocard of my HP Compaq Presario V2000. DMESG in terminal:
[ 3.192977] [drm] radeon: irq initialized. [ 3.192997] [drm] Loading R300 Microcode [ 3.193823] [drm] radeon: ring at 0x0000000060001000 [ 3.193847] [drm] ring test succeeded in 1 usecs [ 3.194191] [drm] ib test succeeded in 0 usecs [ 3.194723] [drm] Panel ID String: QDS [ 3.194726] [drm] Panel Size 1280x768
[ 52.754086] microcode: AMD CPU family 0xf not supported
Fortunately, this AMD processor does not support microcode.
The R300 radeon microcode injection by Privatix was fake microcode. I suspect the R300 radeon microcode in Fedora is also fake. The fake microcode is some type of firmware rootkit, possibly BadBIOS. Microcode injection in Tails a backdoor? : onions
Last week, I discarded my BadBIOS infected HP Compaq Presario V2000 and continued conducting forensics on the Fedora 20 DVD using a Dell Vostro 200.
Fedora 20 injected microcode into Dell Vostro 200 CPU:
[ 38.492840] microcode: CPU1 sig=0x6fd, pf=0x1, revision=0xa1 [ 38.493074] microcode: CPU1 updated to revision 0xa4, date = 2010-10-02 [ 38.493169] microcode: Microcode Update Driver: v2.00 tigran@aivazian.fsnet.co.uk, Peter Oruba
Fedora 20 file manager does not ask guest if want to open removable media. Guests has to click on activities > file manager > removable media.
Fedora 20 Disk Utility is tampered. Option to rename partition is missing.
Fedora 20 has no boot splash unless booting freezes in which case an error message is displayed. Boot splash can detect tampering that /var/logs do not. Boot splash should be the default setting for all linux distros.
/var/log is missing dmesg.log, kernel.log, messages.log, sys.log, etc. Of the logs that are in /var/log, the majority guests do not have the file permissions to read.
There is another /var/log at /run/media/_Fedora_Live_Desvar/log and /run/media/_Fedora_live_Des1/var/log
/var/boot.log: "Starting dracut mount hook... [[32m OK [0m] Started dracut mount hook. [[32m OK [0m] Reached target Initrd Default Target.
Welcome to [0;34mFedora 20 (Heisenbug)[0m!
[[32m OK [0m] Stopped Switch Root. [[32m OK [0m] Stopped target Switch Root. [[32m OK [0m] Stopped target Initrd File Systems. [[32m OK [0m] Stopped target Initrd Root File System. Starting Collect Read-Ahead Data... [[32m OK [0m] Reached target Login Prompts. [[32m OK [0m] Reached target Remote File Systems."
A search forbusybox in filesystem found: 05busybox folder located: /usr/lib/Dracut/modules.d
Both Fedora 20 and Privatix have many unknown file types in their filesystems. For example, var/log.boot.log: Starting Load/Save Random Seed... I searched 'seed' in filesystem: seed type: unknown location: /usr/lib/seed-gtk3
Search for 'initrd' in filesystem found:
initrd-plymouth.img type: unknown location: /boot initrd0.img type: unknown location: run/initramfs/live/isolinux
Search for 'squashfs' found: squashfs.img type: unknown location: /run/initramfs/live/LiveOS
Search for 'pxe' in filesystem found:
pxeboot.img type unknown location: /usr/lib/grub/i386-pc pxe.pyc type:unknown location: /usr/lib/python2.7/site-packaes/sos/plugins
Dragos Ruiu, discoverer of BadBIOS, noted an increase in 8 bit fonts. Fedora 20 and Privatix have preinstalled hamradio and 8 bit packages: Amiga, MacIntosh, MacOS, lilypond (sheet music for MacOS), atari and TOS (Atari's operating system). German Tor CD has PXE server streaming Amiga Soundtracker audio, multiple squashfs, multiple busybox, preseeds & initrd.imgs : onions
Fedora 20's atari files at:
atari type: folder location: /usr/lib/kbd/keymaps/legacy ataritt type: text location: /usr/share/X11/xkb/geometry attaritt type: text location: /usr/share/X11/xkb/keycodes attaritt type: text location: /usr/share/X11/xkb/symbols/xfree68_vndr
atari-de-map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari
atari-se.map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari
atari-us.map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari atari-uk-falcon.map.gz type: archive location: /usr/lib/kbd/keymaps/legacy/atari
A search for TOS (Atari's operating system)found:
fonttosfnt type: executable location: /usr/bin libxt_
tos.so type: shared library location: /usr/lib/xtables libgtossaudio.so type: shared library location: /usr/lib/gstreamer-0.10
libgtossaudio.so type: shared library location: /usr/lib/gstreamer-1.0
Nintendo files at:
x-nintendo-ds-rom.xml type: markup location: /usr/share/mime/application
vnd.nintendo.snes.rom.xml type: markup location: /usr/share/mime/application
All the amiga files have the word 'amiga' in them:
part_amiga.mod type: amiga soundtracker audio (audio/x-mod) location: /usr/lib/grub/i386-efi
part_amiga.mod type: Amiga SoundTracker audio (audio/x-mod) location: /usr/lib/grub/i386-pc part_amiga.module type: object code location: /usr/lib/grub/i386-efi
part_amiga.module type: object code location: /usr/lib/grub/i386-pc
amiga type: folder location: /usr/lib/kbd/keymaps/legacy amiga-de.map.gz type: archive Location: usr/lib/kbd/keymaps/legacy/
amiga-us-map.gz type: archive Location: usr/lib/kbd/keymaps/legacy
Are AmigaOS and Atari keylogging keystrokes to stream data using audio and hamradio or GNURadio?
A search for 'MacIntosh' files found:
MACINTOSH.so type: unknown location: /usr/lib/gconv MACINTOSH.gz type: archive location: /usr/share/i18n/charmaps
MACINTOSH.so type: unknown location: /run/media/liveuser/_Fedora-Live-Des1/usr/lib/gconv
MACINTOSH.so type: unknown location: /run/media/liveuser/_Fedora-Live-Des/usr/lib/gconv
MACINTOSH.gz type: archive location: run/media/liveuser/_Fedora-Live-Des1/usr/share/i18n/charmaps
MACINTOSH.gz type: archive location: run/media/liveuser/_Fedora-Live-Des/usr/share/i18n/charmaps
macintosh_vndr type: folder location: /run/media/liveuser/_Fedora-Live-Des1/usr/share/X11/xkb/symbols
A search for MacOS found:
20macosx type program location: /usr/libexec/os-probes/mounted
macosx.html type: text location: /usr/share/doc/cyrus-sals-lib
macosxSupport.pyc type: unknown usr/lib/python2.7/idlelib macosxSupport.pyo type: unknown /usr/lib/python2.7/idlelib macos.xml type: markup /usr/share/libosinfo/db/oses macosxSupport.cpython-33 type: unknown /usr/lib/python3.3/idlelib/pycache
macosxSupport.cpython-33 type: unknown usr/lib/python3.3/idlelib/pycache
A search for lilypond (sheet music for MacOS) found:
lilypond.lang type: text location: /usr/share/highlight/langDefs x-lilypond.xml type: markup location: /usr/share/mime/text
A search for 'hamradio' in filesystem found:
hamradio type: folder location: /usr/lib/modules/3.11.10-301.fc20.i686/extra/drivers/net
hamradio type: folder location: /usr/lib/modules/3.11.10-301.fc20.i686/extra/drivers/net
Is BadBIOS using 8 byte operating systems such as MacIntosh, MacOS, lilpond via hamradio?
Gedit text editor tampering:
Gedit is missing 'Preferences' in the 'Edit' tab. Gedit is mising 'Help' tab in the menu. Therefore, no 'Contents' and 'About' tabs.
After guest edits a text file on removable media, a hidden backup file is created and permanently saved on removable media. Fedora does not detect the permanent backup file as a backup file. Type: unknown
Timestamps of the backup files go backwards in history. First backup file has today's date, June 5, 2014. The others created on same date are dated March 12, 2014, February 7, 2013 and November 14, 2012.
Both Fedora 20 and Privatix copies entire photographs from guests' removable media. German live Tor distro has xulrunner, webinspector, eMusic & duplicates personal files : onions. After guest opens a folder on removable media containing photographs and opens one of the photographs, Fedora 20 takes a screenshot of all the photographs in the folder. The 43 hidden thumbnails is at home/liveuser/.cache/thumbnails/large.
In home/liveuser/.cache/thumbnails/fail/gnome-thumbnail-factory are 60 hidden pngs. They are solid black. Possibly failed attempts to take webcam screenshots. HP Compaq Presario V2000 does not have a external webcam. I removed the conductive speakers. Yet, Privatix's boot splash detected:
input: PC Speaker as /devices/platform/pcspkr/input/input5 Linux video capture interface: v2.00 uvcvideo: Found UVC 1.00 device USB2.0 UVC VGA WebCam (13d3:5702) input: USB2.0 UVC VGA WebCam as /deices/pci0000:00/0000:00:1d.7/usb1/1/-6/1-6:1/0/input/input6 usbcore: registred new interface driver uvcvideo USB Video Class driver (v.0.1.0) (drm) Initializing drm 1.1.0
I wish Fedora's default boot would display boot splash.
home/liveuser/.local/share/gvfs-metadata. Contains root log, three uuid logs, etc. Clicking on the logs does not bring up gedit.
systemctl detected three virtual blocks k-dm/x2d0 - x2d2 and four virtual blocks loop0 - loop4
Disk Usage Analyzer detected:
Other devices:
4.3 GB Block Device /dev/mapper/live-rw volume: _Fedora-Live-Des mounted at Filesystem Root
4.3 GB Block Device /dev/mapper/live-base mounted at /run/media/Liveuser/_F
4.3 GB Block Device /dev/mapper/lilve-osming-min
8.2 KB Loop Device /osmin.img(deleted) Volumes: squashfs Location: /run/media/liveuser/disk1
1.3 MB Loop Device /osmin volumes: DM-snapshot-cow device: /dev/loop1
930 MB Loop Device /run/initramfs/live/Live volumes: squashfs Mounted: /run/media/liveuser/disk Cannot scan: "permission denied"
Continue reading...
