A CPU from 1984
Twelve distinct ELF architectures were dropped on one honeypot in two weeks, from Motorola 68020 and Renesas SH to ARM, MIPS in both byte orders, and RISC-V. Nobody profiles a target this carefully. They compile for everything because they have no idea what they are landing on.
They shipped the payload for a processor released in nineteen eighty-four.
Unusual hardware feels safe. A router, a camera, an old board — surely nobody bothers compiling malware for that.
Twelve different architectures landed here in two weeks. The ordinary ones are there: x86, ARM, MIPS in both byte orders.
Then it gets strange. Renesas SH. Synopsys ARCompact. Motorola sixty-eight thousand twenty, a chip from nineteen eighty-four.
And in the same set, RISC-V, which is about as new as CPUs get.
They are not choosing. They compile once for everything and push whichever one runs.
Obscurity is not a control here. The cost of adding one more architecture to a build is almost nothing, so they added all of them.
Obscure hardware is not protection. Somebody already built for it.
#linux#security#malware#infosec#sysadmin
❯ Obscure hardware is not protection. Somebody already built for it.