• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

GPU Assisted Malware

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
This paper on GPU assisted malware (link) is a bit frightening to say the least. Thanks to [H] forum member Cerulean for the heads up!

The rapid evolution of general-purpose computing on graphics processors enables malware authors to take advantage of the GPU present in modern personal computers and increase the robustness of their code against existing defenses. The code armoring techniques presented in this paper—GPU-based unpacking and runtime polymorphism—not only demonstrate the feasibility of GPU-assisted malware, but also show the great potential that general-purpose computing on GPUs has in enhancing the evasiveness and functionality of malicious code.
Click to expand...
 
It was only a matter of time...

Runtime polymorphism is very bad joo joo as is a program that can make differently encoded copies of itself.

It makes it very hard to detect and thus can make it past most if not all scanners.

Even if a scanner does pick it up, it may have already made different/random variations of itself.
 
Certain limitations of current GPU hardware would not allow malware to run without an obvious signs. (Messing up/freezing your display.)

Unless you run SLI where the second card can be used to process malware while the other continues to display your screen properly. :D
 
martinmsj said:
Certain limitations of current GPU hardware would not allow malware to run without an obvious signs. (Messing up/freezing your display.)

Unless you run SLI where the second card can be used to process malware while the other continues to display your screen properly. :D
Click to expand...

Yes, but what percentage of general users actually play games a whole bunch?

Just about any computer that is not super low end will be subject to this kind of malware.

OpenCL or CUDA... either way you go you are hosed.

I can see a huge number of infected computers in a very short period of time.

And what are the anti-malware/anti-virus software people going to do? They will have to add a whole bunch more bloat. And until they figure out how to reliably detect it, I can see a multitude of games and programs that use the GPU have major issues with the GPU malware detecting apps.
 
cyclone3d said:
Yes, but what percentage of general users actually play games a whole bunch?

Just about any computer that is not super low end will be subject to this kind of malware.

OpenCL or CUDA... either way you go you are hosed.

I can see a huge number of infected computers in a very short period of time.

And what are the anti-malware/anti-virus software people going to do? They will have to add a whole bunch more bloat. And until they figure out how to reliably detect it, I can see a multitude of games and programs that use the GPU have major issues with the GPU malware detecting apps.
Click to expand...


There are a bunch of obstacles to overcome before it's a reality. And you don't have to be playing a game to have screen anomalies/artifacts show up. We're not hosed yet.

It's not all doom and gloom at this moment. As it stands now data has to be copied over to the the video cards memory by the CPU for starters.

There are two key factors, first they need full access to the frame buffer, and second, they need GPU's to progress to the point where they can switch contexts (multi-task.) Once they do that and the security companies don't catch up, then you're f**ked.

As of right now to debug CUDA code for example you need a second a GPU or a second machine with the same hardware (virtualized or not) to debug the CUDA code on the first GPU. (There is a new software suite/plugging from NVidia that helps with this but only for CUDA code. Still need two machines for debugging shaders.)
 
Quoting a slashdot poster:

"Modern GPUs include memory protection, so different processes can be prevented from reading each others' VRAM, just as they can be prevented from running each others' RAM. This is not always used by the drivers, which may just map the entire physical VRAM into the GPU's virtual address space. With properly written drivers, this is much harder.

The big malware potential comes from WebGL. This allows you to run arbitrary GLSL code in the browser's (GPU) address space. Although you probably can't take over the entire display, you can potentially take over the entire browser window without permission. Hopefully, the driver will give you entirely separate GPU address spaces per GL context, but given how incompetent AMD and nVidia's driver teams have demonstrated themselves to be, I doubt it."

http://it.slashdot.org/story/10/09/27/1422205/Malware-Running-On-Graphics-Cards
 
I thought this already existed in Windows 7. I think they called it Windows System Assessment Tool.

:rolleyes:
 
cyclone3d said:
It was only a matter of time...

Runtime polymorphism is very bad joo joo as is a program that can make differently encoded copies of itself.

It makes it very hard to detect and thus can make it past most if not all scanners.

Even if a scanner does pick it up, it may have already made different/random variations of itself.
Click to expand...
Oh goody gumdrops! My dad's PC (before it got hit by lightning) had a virus on there exactly like that. I forgot what the name of it was, but last I know there wasn't a known solution for getting rid of it except for doing a complete format+reinstall.

The virus replicated itself into random filenames across the system. Deleting one would be futile, because it would maintain its own homeostasis of presence on the system, and there'd be no way of knowing where it starts and originates from. Seems like each clone was "the origin" and worked in a P2P-styled function. :mad:
 
martinmsj said:
There are a bunch of obstacles to overcome before it's a reality. And you don't have to be playing a game to have screen anomalies/artifacts show up. We're not hosed yet.

It's not all doom and gloom at this moment. As it stands now data has to be copied over to the the video cards memory by the CPU for starters.

There are two key factors, first they need full access to the frame buffer, and second, they need GPU's to progress to the point where they can switch contexts (multi-task.) Once they do that and the security companies don't catch up, then you're f**ked.

As of right now to debug CUDA code for example you need a second a GPU or a second machine with the same hardware (virtualized or not) to debug the CUDA code on the first GPU. (There is a new software suite/plugging from NVidia that helps with this but only for CUDA code. Still need two machines for debugging shaders.)
Click to expand...

I didn't say we are hosed.... It was a "when it happens" statement.

That being said, if the code is written well, there won't be any graphical glitches, etc. And if the writer wanted to, they could easily set it to be low priority, so if you run a game, it pauses itself and lets the system use the video card to mask the fact that there is something else already running on the card.... much like how the F@H GPU client can do already.
 
You must log in or register to reply here.
Back
Top