4 ms·

Wikipedia link for the lazy folks like me that didn't know the Equation Group: https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equati

Wikipedia link for the lazy folks like me that didn't know the Equation Group: https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group

tedmiston 10y ago
> The malware used in their operations, dubbed EquationDrug and GrayFish, is found to be capable of reprogramming hard disk drive firmware. Wow. We really are f----d all the way down the stack.
- boobsbr 10y ago
  http://spritesmods.com/?art=hddhack http://spritesmods.com/?art=hddhack
- Bartweiss 10y ago
  The row hammer attack convinced me of that. It feels like nothing is hardened at the very low levels that get hit by truly dedicated attacks. (https://en.wikipedia.org/wiki/Row_hammer#Implications https://en.wikipedia.org/wiki/Row_hammer#Implications)
  - sbarre 10y ago
    Geez, I'd never heard of this.. I just spent an hour reading up on it.. There's even a Javascript implementation (because of course there is)...
    - Bartweiss 10y ago
      It blew my mind when I first encountered it. The basic idea - flip bits a lot until things crash - wasn't totally shocking. But learning that Project Zero had put up working privilege escalation attacks off something so bizarre? That's just too far. At least Van Eck phreaking is still hard to use in practice...
- djsumdog 10y ago
  SD Cards have a full 32-bit processor on them. You can find videos on hacking them. In theory, you can re-label a 32GB card as 16GB, create a 16GB journey and write two copies of everything stored to it. Then you just steal the card back and get all the data off it.
  - tetrep 10y ago
    > Then you just steal the card back and get all the data off it. If you're stealing hardware, the only thing you're not capable of already is (necessarily) being able to decrypt it. So this would apply to any unencrypted SD card. Not terribly effective use of the hack. A better one would be to do so with one of those WiFi SD cards[0] and transmit the data over the network. You could just read it directly from the card and place deleted files into your buffer when you overwrite them, and hope they don't delete more than your buffer's size of data before you can upload it. [0]:https://en.wikipedia.org/wiki/Secure_Digital#Vendor_enhancements https://en.wikipedia.org/wiki/Secure_Digital#Vendor_enhancem...

Wikipedia link for the lazy folks like me that didn't know the Equation Group: https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group

tedmiston 10y ago

> The malware used in their operations, dubbed EquationDrug and GrayFish, is found to be capable of reprogramming hard disk drive firmware. Wow. We really are f----d all the way down the stack.

boobsbr 10y ago
http://spritesmods.com/?art=hddhack http://spritesmods.com/?art=hddhack
Bartweiss 10y ago
The row hammer attack convinced me of that. It feels like nothing is hardened at the very low levels that get hit by truly dedicated attacks. (https://en.wikipedia.org/wiki/Row_hammer#Implications https://en.wikipedia.org/wiki/Row_hammer#Implications)
- sbarre 10y ago
  Geez, I'd never heard of this.. I just spent an hour reading up on it.. There's even a Javascript implementation (because of course there is)...
  - Bartweiss 10y ago
    It blew my mind when I first encountered it. The basic idea - flip bits a lot until things crash - wasn't totally shocking. But learning that Project Zero had put up working privilege escalation attacks off something so bizarre? That's just too far. At least Van Eck phreaking is still hard to use in practice...
djsumdog 10y ago
SD Cards have a full 32-bit processor on them. You can find videos on hacking them. In theory, you can re-label a 32GB card as 16GB, create a 16GB journey and write two copies of everything stored to it. Then you just steal the card back and get all the data off it.
- tetrep 10y ago
  > Then you just steal the card back and get all the data off it. If you're stealing hardware, the only thing you're not capable of already is (necessarily) being able to decrypt it. So this would apply to any unencrypted SD card. Not terribly effective use of the hack. A better one would be to do so with one of those WiFi SD cards[0] and transmit the data over the network. You could just read it directly from the card and place deleted files into your buffer when you overwrite them, and hope they don't delete more than your buffer's size of data before you can upload it. [0]:https://en.wikipedia.org/wiki/Secure_Digital#Vendor_enhancements https://en.wikipedia.org/wiki/Secure_Digital#Vendor_enhancem...