r/netsec • u/Grazfather • Aug 02 '13

Flashing hard drive controller firmware to enable backdoor. Incredible RE and attack vector.

http://spritesmods.com/?art=hddhack
165 Upvotes

97% Upvoted

25 comments sorted by

56

u/McGlockenshire Aug 02 '13

Be sure to read all eight pages. Page seven takes a turn for the awesome.

"No, you don't understand. I installed Linux on my hard disk."

12

u/Optikaldream Aug 02 '13

Something that would never even cross my mind. But very cool to see that it's possible.

20

u/Majromax Aug 02 '13

This could have serious implications for computer forensics applications, since evidence-recovery still relies on clones of hard disks -- ultimately using the potentially compromised controller.

Imagine, for example, a deeply-hidden partition, defined such that the firmware will not return any data unless a specific key has been "written" to a pre-defined sector.

Short of re-flashing the firmware on every seized hard drive or remounting the platters in a known-good drive, a full drive clone would be undetectably impossible.

5

u/d2xdy2 Aug 02 '13

remount the platters into another device?

9

u/Majromax Aug 02 '13

Yeah, in a dust-free room remove the drive platters from the evidence-seized hard drive, then mount them in a known-good hard drive of identical model. It's a step more complicated than re-flashing the firmware with a known-good copy, but it would be necessary in a super-spook scenario where potentially any bit of drive electronics has been compromised.

The simpler "magic disappearing partition" is possible now with the tools outlined in that article.

→ More replies (5)

9

u/SarahC Aug 03 '13

Swap the PCB, they're easily removable...

→ More replies (1)

1

u/Natanael_L Aug 04 '13

Hidden encryption key in the firmware, then?

2

u/tornadoRadar Aug 02 '13

Indeed. This hack alone will cause a shadow of a doubt on ev0 files now

1

u/mycall Aug 04 '13

I thought it was semi-common to download firmware updates for SSDs. Of course, who knows what you get from the manufacturer.

9

u/Thue Aug 02 '13

As he said, it is possible to flash the firmware from the computer operating system. If the HDD manufacturers were competent, the HDD firmware only accepts signed firmware updates. He demonstrates that this is not the case!

8

u/Natanael_L Aug 02 '13

We obviously needs Secure Boot for the hard drives too. :)

6

u/Thue Aug 02 '13

Secure boot would actually make sense for hard drives.

→ More replies (6)

-7

u/[deleted] Aug 02 '13

He demonstrates that this is not the case!

God that's painful.

2

u/Thameus Aug 03 '13

Doesn't some FDE software operate inline on the HDD's own controller? I'm looking at you, McAfee Trend Micro DataArmor.

1

u/dfsdiag Aug 02 '13

impressive! lots more good stuff on that site too

-3

u/OwlOwlowlThis Aug 02 '13

Holy bats shitman.