You’ve probably heard the old joke: “Humor in public service? It’s not funny!”
But the thing about sweeping, sweeping judgments of this kind is that it only takes a single counter-example to disprove them.
Something cannot be universally true if it is ever false, even for a single moment.
So wouldn’t it be nice if the public service could be upbeat every now and then…
…as upbeat, in fact, as Janet Jackson’s catchy dance number Rhythm Nationreleased in 1989 (yes, it was really that long ago)?
This was the era of shoulder pads, MTV, big-budget dance videos, and the kind of in-your-ears, in-your-face lyrical musicality that even YouTube’s modern automatic transcription system sometimes simply translates as:
Bass, bass, bass, bass ♪ (Upbeat R&B Music) ♪ Dance beat, dance beat
Well, as Microsoft superblogger Raymond Chen pointed out last week, this very song was apparently implicated in a surprising system crash vulnerability in the early 2000s.
According to Chen, a major laptop manufacturer at the time (he didn’t say which one) complained that Windows was prone to crashing when certain music was played through the laptop’s speaker.
The crashes, it seems, were not limited to the laptop playing the song, but could also be provoked on nearby laptops that were exposed to the “vulnerable” music, even on laptops from other vendors.
Resonance is considered harmful
Apparently, the final conclusion was that Rhythm Nation It just happened to involve right-field hits, repeated at the right rate, that provoked a phenomenon known as resonance on laptop drives of the day.
Simply put, this resonance caused the natural vibrations in hard drive devices (which did indeed contain hard drives at the time, made of steel or glass and spinning at 5400 rpm) to be amplified and exaggerated to the point that point to crash, crashing Windows. XP along with them.
Resonance, as you may know, is the name of the phenomenon by which singers can break wine glasses by producing the right note long enough to shake the glass to pieces.
Once they have locked the frequency of the note they are singing to the natural frequency at which the glass likes to vibrate, their singing continually increases the amplitude of the vibration until it is too much for the glass to take.
It’s also what allows you to quickly build height and momentum in a swing.
If you randomly time your kicks or thrusts, sometimes they increase your movement by acting in harmony with the swing, but other times they work against the swing and slow you down instead, leaving you to run unsatisfactorily.
But if you time your energy input so that it always exactly matches the frequency of the oscillation, you continually increase the amount of energy in the system, and so your oscillations increase in amplitude and you gain height rapidly.
A skilled swinger (on a properly designed, well-assembled, “strong-arm” swing where the seat is not attached to the pivot by flexible ropes or chains – don’t try this in the park!) can send a swing. right over the top in a 360 degree arc with just a few pumps…
…and by deliberately timing their pumps out of sequence in order to counter swing motion, they can stop it again just as quickly.
Proof of concept
We’re guessing there were probably plenty of other popular songs that could have provoked this hard drive resonance to the point of failure, but Rhythm Nation was the proof of concept that showed this vulnerability could be actively exploited.
Chen reports that the laptop vendor added a frequency filter to the laptop’s audio system to remove the frequency bands that tended to cause the problem, leaving the sound unchanged but acoustically harmless.
By filtering frequencies all the time, rather than trying to specifically recognize Janet Jackson’s song, this electronic countermeasure became a generic, proactive cybersecurity fix, not just a tune-specific fix.
Well, back to the issue of public service humor…
…it turns out that someone at MITER in the US, where the CVE bug numbers are coordinated, has assigned this problem an official bug number, as follows:
CVE-2022-38392: Denial of service (device malfunction and system crash):
An OEM 5400 RPM hard drive shipped with laptop computers circa 2005 allows physically nearby attackers to cause a denial of service (device malfunction and system crash) via a resonant frequency attack on the audio signal from the music video Rhythm Nation.
Even in a world where solid state drives (SSDs, often still referred to as discs(although they don’t have circular parts, let alone rotating ones) are common, you can still buy old discs with moving parts, usually running at 5400 rpm, 7200 rpm and even 10,000 rpm.
Older hard drives generally offer much higher capacity for a much lower price than SSDs, but they’re rarely found in business-class laptops these days because they’re slower, generally require more power, and are not as shock-proof as their transist cousins.
What should be done?
We cannot say whether SSDs are, on the other hand, vulnerable to music that focuses on other frequency ranges or amplitudes.
While R&B may have been the Achilles’ heel of rotary media storage in the early 2000s, perhaps the louder, but less tuned, cluttered, old school “encoding music” of the it may ultimately prove overkill for all-digital solid-state laptop storage. ?
We don’t expect fans of bands like the Melvins, Sleep, Monolord and the like to take unnecessary experimental risks with their laptops.
But if anyone knows of any heavy riffs that could be turned into exploits…
…they might be eligible for CVE numbers, although we have no idea where vulnerabilities of this type would fit in MITER ATT&CK Tools, Tips and Procedures frame.
Suggestions in the comments, please!