9 ms·

Song from 1989 declared a cybersecurity vulnerability for crashing hard drives

123 points by quyleanh 4y ago

zwieback 4y ago
I was setting up a trade show in Zurich when Janet Jackson was soundchecking Rhythm Nation in the next building. None of our hard drives crashed but that was in 88 or 89 so I guess maybe the vulnerability showed up much much later.
- anyfoo 4y ago
  The live version may not have that exact frequency. Or the acoustics of the hall and the audio system may have acted as a filter at that frequency. But it might be more likely that the hard disks just weren't vulnerable, yeah. (5400rpm in '89, was that common?) Otherwise, if they did play the original song, then the loudness could have made the effect even worse.
  - zwieback 4y ago
    All true. What I remember was just how damn loud it was. We were quite a bit away and you could feel it in your bones.
lowbloodsugar 4y ago
FTA, originally from https://www.theregister.com/2022/08/18/janet_jackson_video_crashes_laptops/ https://www.theregister.com/2022/08/18/janet_jackson_video_c...
- anyfoo 4y ago
  Yeah, link should probably be changed to that. I initially wondered why this is not just pointing to Raymond Chen's excellent blog (https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=10... ), which is also linked by both The Register and Techspot, but the The Register article adds that it's not officially a CVE.
ashton314 4y ago
The vulnerability and the fix remind me of a chapter in Gödel, Escher Bach where Achilles gives the tortoise (or maybe the other way around) a record that, when played, destroys his record player. So fun to see that IRL.
- SilasX 4y ago
  That actually illustrates why it’s a bad analogy for communicating the concept: it’s not intuitive at all why record player could be destroyed by playing the right record — most have volume limits that make this very difficult in practice, and most people never see one even getting close enough to see the dynamics that would cause it to happen. And so it definitely doesn’t help communicate the broader idea that all formal systems (meeting some minimal criteria) should have a corresponding flaw. (I would have gone with a helicopter as the system but that would require domain familiarity.)
  - bch 4y ago
    > I would have gone with a helicopter as the system but that would require domain familiarity Would you give it a try?
    - SilasX 4y ago
      Well, there isn’t much to add beyond the fact them being more prone to acoustic breakage. Helicopters are a nightmare for vibrations because you have to spin the rotor really fast and forcibly, risking over-stressing critical structural components if you excite them at their resonant frequency. They’re designed to operate at only one rotor speed because that’s enough of a headache in terms of preventing it from hitting resonant modes that the structure can’t handle. So for helicopters it’s much easier to imagine a pattern of rotor movement that will break the system — though again, getting the intuition down would require having modeled vibratory systems to see when they go out of control. But at least it’s more intuitive than record players, which work with much smaller vibrations and generally operate in moderate volume limits.
      - 4y ago
neogodless 4y ago
Quite a few submissions on this recently. "Janet Jackson had the power to crash laptop computers" https://news.ycombinator.com/item?id=32483211 https://news.ycombinator.com/item?id=32483211 (This is based on the original Raymond Chen blog post.)
excalibur 4y ago
So if you stand in Times Square with a boombox and play this song at full volume, does that constitute a cyber attack?
- scohesc 4y ago
  I'd consider it social engineering in this day and age. Who _wouldn't_ want to tell you all their encryption keys and passwords after listening to Janet Jackson? ;-)
- SketchySeaBeast 4y ago
  I suppose in the same way throwing a USB stick full of malware at someone would be, yeah.
  - Bud 4y ago
    Disagree, I guess. Throwing a USB stick of malware at someone doesn't realistically serve the purpose of infecting their stuff with that malware. But playing this song in Times Square very much does have a realistic chance of breaking their hard drives, if said drives are old enough, etc.
    - SketchySeaBeast 4y ago
      I think it's actually more likely that someone will pick up a USB stick and infect themselves than they will be using a '88 5400 RPM hard drive in the vicinity close enough to be affected by the resonance.
praptak 4y ago
There's a story (not confirmed) about a Black Team member using resonance to crash (physically) a tape cabinet: http://www.penzba.co.uk/GreybeardStories/TheBlackTeam.html http://www.penzba.co.uk/GreybeardStories/TheBlackTeam.html
jmbwell 4y ago
Of course, I'm reminded of Brendan Gregg shouting at hard drives: https://www.youtube.com/watch?v=tDacjrSCeq4 https://www.youtube.com/watch?v=tDacjrSCeq4 Hard disk drives are not dissimilar from other high-precision acoustic systems. The actuator is even called a "voice coil." That we are able to transmit a range of frequencies with sufficient accuracy and precision to induce a magnet to move a near-microscopic coil of wire at the end of armature flying microns above the surface of a platter spinning at a rotational velocity of thousands of RPMs and a linear velocity of inches per millisecond, land at exact locations, and detect the polarity of a magnetic field… I can't even. I don't even know what to compare it to.
- OedipusRex 4y ago
  Last time someone posted this he showed up in the comments lol
  - mmastrac 4y ago
    https://news.ycombinator.com/item?id=32513240 https://news.ycombinator.com/item?id=32513240
- samstave 4y ago
  We have a word for that. >MAGICK
- sbierwagen 4y ago
  A lot of signal processing/information theory stuff crosses over pretty seamlessly between hard drives and radio transmission, too: https://www.schrankmonster.de/wp-content/uploads/2019/12/Screenshot-at-2019-12-07-12-53-39.png https://www.schrankmonster.de/wp-content/uploads/2019/12/Scr... The presentation that (deleted) tweet screenshots: https://www.iaria.org/conferences2015/filesAICT15/AnIntroductionToHDDModellingDetectionAndDecoding.pdf https://www.iaria.org/conferences2015/filesAICT15/AnIntroduc...
- ideamotor 4y ago
  Compare it to … Havana syndrome?
StingyJelly 4y ago
Has someone demonstrated this? It was immediately my favorite CVE but without poc and based on a single story I'm quite skeptical.
- shakna 4y ago
  Whilst not precisely the same, you do have the famous "Screaming in the Data Centre" [0] from over a decade ago. [0] https://youtube.com/watch?v=tDacjrSCeq4 https://youtube.com/watch?v=tDacjrSCeq4
gennarro 4y ago
Previously shared here, via the cve, which is a less interesting read of course. Link: https://exploit.report/cve/cve-2022-38392/ https://exploit.report/cve/cve-2022-38392/
z9znz 4y ago
> special malware that is able to encode the data to be transmitted through direct manipulation of the fan speed So in addition to being more pleasant to use, fanless laptops (computers) are also more secure!
- userbinator 4y ago
  Not more pleasant --- to be honest, it's unsettling how little feedback there is from systems these days. Back then, it was natural to feel how the system was doing from the sounds of hard drives, the fans, etc., and malware trying to do something in the background would often result in a very noticeable change.
kuon 4y ago
I had the "vibration" problem a few times in me IT career, train, construction work and once elevators. It is the kind of issue that are really hard to diagnose the first time but after the first time it's part of the standard "diagnose suite". I love to show this video about the effect of noise on HDD (be sure to put the volume down) https://www.youtube.com/watch?v=tDacjrSCeq4 https://www.youtube.com/watch?v=tDacjrSCeq4
elwell 4y ago
Ah yes, Janet Jackson's infamous 'hard drive malfunction'.
causality0 4y ago
I've been so disappointed in the reaction of tech sites to this story. It's a third-hand anecdote about an unspecified model of hard drive from fifteen years ago which might be complete bullshit but I'm seeing links to articles about it one or times a day for a straight week.
- dang 4y ago
  I ran across it randomly the other day (or so I thought) and invited the submitter to repost it. If I'd known it was a repetitive thing I might have hesitated. Not their fault of course. Edit: looks like it had at least 2 recent threads: A laptop hard drive model could crash when exposed to a certain audio frequency - https://news.ycombinator.com/item?id=32507147 https://news.ycombinator.com/item?id=32507147 - Aug 2022 (65 comments) Janet Jackson had the power to crash laptop computers - https://news.ycombinator.com/item?id=32483211 https://news.ycombinator.com/item?id=32483211 - Aug 2022 (9 comments)
  - causality0 4y ago
    Yeah, and that's just HN. Google News, suggested stories, my Firefox startup suggestions, Youtube suggestions, I cannot get away from this nothingburger.
    - dang 4y ago
      Definitely sorry for inviting the nothingburger.
prvc 4y ago
There is a repeated note (or sound effect) in the song which has a pitch which sweeps through 7200 Hz. In fact, it is reminiscent of a kind of sound that can occasionally emanate from a failing drive which spins at that rate. I wonder if they got the "5400 RPM" detail wrong?
- userbinator 4y ago
  I don't think the rotational speed of the drive is that relevant; the resonance that was being excited is certainly different as otherwise the drive would've excited it via its own rotation.
  - prvc 4y ago
    We don't actually know that this phenomenon is due to resonance.
aaron695 4y ago
userbinator 4y ago
This reminds me of a similar experience I have from a time when I was briefly working in the field on machinery containing huge (multiple megawatts) industrial motors. We had finished doing some work on the control electronics, and the plant operator warned us to turn off our laptops before he started up the main motor because he had previously noticed they would always BSoD and occasionally completely fail to boot afterwards due to disk corruption. This was in a room far from the motor, and it was not very loud even without hearing protection, but the vibration was still enough to hit a resonance in the HDD. Of course, that was so long ago that this "CVE-chaser" culture of paranoia had not yet appeared.

123 points by quyleanh 4y ago

I was setting up a trade show in Zurich when Janet Jackson was soundchecking Rhythm Nation in the next building. None of our hard drives crashed but that was in 88 or 89 so I guess maybe the vulnerability showed up much much later.

anyfoo 4y ago
The live version may not have that exact frequency. Or the acoustics of the hall and the audio system may have acted as a filter at that frequency. But it might be more likely that the hard disks just weren't vulnerable, yeah. (5400rpm in '89, was that common?) Otherwise, if they did play the original song, then the loudness could have made the effect even worse.
- zwieback 4y ago
  All true. What I remember was just how damn loud it was. We were quite a bit away and you could feel it in your bones.

lowbloodsugar 4y ago

FTA, originally from https://www.theregister.com/2022/08/18/janet_jackson_video_crashes_laptops/ https://www.theregister.com/2022/08/18/janet_jackson_video_c...

anyfoo 4y ago
Yeah, link should probably be changed to that. I initially wondered why this is not just pointing to Raymond Chen's excellent blog (https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=10... ), which is also linked by both The Register and Techspot, but the The Register article adds that it's not officially a CVE.

ashton314 4y ago

The vulnerability and the fix remind me of a chapter in Gödel, Escher Bach where Achilles gives the tortoise (or maybe the other way around) a record that, when played, destroys his record player. So fun to see that IRL.

SilasX 4y ago
That actually illustrates why it’s a bad analogy for communicating the concept: it’s not intuitive at all why record player could be destroyed by playing the right record — most have volume limits that make this very difficult in practice, and most people never see one even getting close enough to see the dynamics that would cause it to happen. And so it definitely doesn’t help communicate the broader idea that all formal systems (meeting some minimal criteria) should have a corresponding flaw. (I would have gone with a helicopter as the system but that would require domain familiarity.)
- bch 4y ago
  > I would have gone with a helicopter as the system but that would require domain familiarity Would you give it a try?
  - SilasX 4y ago
    Well, there isn’t much to add beyond the fact them being more prone to acoustic breakage. Helicopters are a nightmare for vibrations because you have to spin the rotor really fast and forcibly, risking over-stressing critical structural components if you excite them at their resonant frequency. They’re designed to operate at only one rotor speed because that’s enough of a headache in terms of preventing it from hitting resonant modes that the structure can’t handle. So for helicopters it’s much easier to imagine a pattern of rotor movement that will break the system — though again, getting the intuition down would require having modeled vibratory systems to see when they go out of control. But at least it’s more intuitive than record players, which work with much smaller vibrations and generally operate in moderate volume limits.
    - 4y ago

neogodless 4y ago

Quite a few submissions on this recently. "Janet Jackson had the power to crash laptop computers" https://news.ycombinator.com/item?id=32483211 https://news.ycombinator.com/item?id=32483211 (This is based on the original Raymond Chen blog post.)

excalibur 4y ago

So if you stand in Times Square with a boombox and play this song at full volume, does that constitute a cyber attack?

scohesc 4y ago
I'd consider it social engineering in this day and age. Who _wouldn't_ want to tell you all their encryption keys and passwords after listening to Janet Jackson? ;-)
SketchySeaBeast 4y ago
I suppose in the same way throwing a USB stick full of malware at someone would be, yeah.
- Bud 4y ago
  Disagree, I guess. Throwing a USB stick of malware at someone doesn't realistically serve the purpose of infecting their stuff with that malware. But playing this song in Times Square very much does have a realistic chance of breaking their hard drives, if said drives are old enough, etc.
  - SketchySeaBeast 4y ago
    I think it's actually more likely that someone will pick up a USB stick and infect themselves than they will be using a '88 5400 RPM hard drive in the vicinity close enough to be affected by the resonance.

praptak 4y ago

There's a story (not confirmed) about a Black Team member using resonance to crash (physically) a tape cabinet: http://www.penzba.co.uk/GreybeardStories/TheBlackTeam.html http://www.penzba.co.uk/GreybeardStories/TheBlackTeam.html

jmbwell 4y ago

Of course, I'm reminded of Brendan Gregg shouting at hard drives: https://www.youtube.com/watch?v=tDacjrSCeq4 https://www.youtube.com/watch?v=tDacjrSCeq4 Hard disk drives are not dissimilar from other high-precision acoustic systems. The actuator is even called a "voice coil." That we are able to transmit a range of frequencies with sufficient accuracy and precision to induce a magnet to move a near-microscopic coil of wire at the end of armature flying microns above the surface of a platter spinning at a rotational velocity of thousands of RPMs and a linear velocity of inches per millisecond, land at exact locations, and detect the polarity of a magnetic field… I can't even. I don't even know what to compare it to.

OedipusRex 4y ago
Last time someone posted this he showed up in the comments lol
- mmastrac 4y ago
  https://news.ycombinator.com/item?id=32513240 https://news.ycombinator.com/item?id=32513240
samstave 4y ago
We have a word for that. >MAGICK
sbierwagen 4y ago
A lot of signal processing/information theory stuff crosses over pretty seamlessly between hard drives and radio transmission, too: https://www.schrankmonster.de/wp-content/uploads/2019/12/Screenshot-at-2019-12-07-12-53-39.png https://www.schrankmonster.de/wp-content/uploads/2019/12/Scr... The presentation that (deleted) tweet screenshots: https://www.iaria.org/conferences2015/filesAICT15/AnIntroductionToHDDModellingDetectionAndDecoding.pdf https://www.iaria.org/conferences2015/filesAICT15/AnIntroduc...
ideamotor 4y ago
Compare it to … Havana syndrome?

StingyJelly 4y ago

Has someone demonstrated this? It was immediately my favorite CVE but without poc and based on a single story I'm quite skeptical.

shakna 4y ago
Whilst not precisely the same, you do have the famous "Screaming in the Data Centre" [0] from over a decade ago. [0] https://youtube.com/watch?v=tDacjrSCeq4 https://youtube.com/watch?v=tDacjrSCeq4

gennarro 4y ago

Previously shared here, via the cve, which is a less interesting read of course. Link: https://exploit.report/cve/cve-2022-38392/ https://exploit.report/cve/cve-2022-38392/

z9znz 4y ago

> special malware that is able to encode the data to be transmitted through direct manipulation of the fan speed So in addition to being more pleasant to use, fanless laptops (computers) are also more secure!

userbinator 4y ago
Not more pleasant --- to be honest, it's unsettling how little feedback there is from systems these days. Back then, it was natural to feel how the system was doing from the sounds of hard drives, the fans, etc., and malware trying to do something in the background would often result in a very noticeable change.

kuon 4y ago

I had the "vibration" problem a few times in me IT career, train, construction work and once elevators. It is the kind of issue that are really hard to diagnose the first time but after the first time it's part of the standard "diagnose suite". I love to show this video about the effect of noise on HDD (be sure to put the volume down) https://www.youtube.com/watch?v=tDacjrSCeq4 https://www.youtube.com/watch?v=tDacjrSCeq4

elwell 4y ago

Ah yes, Janet Jackson's infamous 'hard drive malfunction'.

causality0 4y ago

I've been so disappointed in the reaction of tech sites to this story. It's a third-hand anecdote about an unspecified model of hard drive from fifteen years ago which might be complete bullshit but I'm seeing links to articles about it one or times a day for a straight week.

dang 4y ago
I ran across it randomly the other day (or so I thought) and invited the submitter to repost it. If I'd known it was a repetitive thing I might have hesitated. Not their fault of course. Edit: looks like it had at least 2 recent threads: A laptop hard drive model could crash when exposed to a certain audio frequency - https://news.ycombinator.com/item?id=32507147 https://news.ycombinator.com/item?id=32507147 - Aug 2022 (65 comments) Janet Jackson had the power to crash laptop computers - https://news.ycombinator.com/item?id=32483211 https://news.ycombinator.com/item?id=32483211 - Aug 2022 (9 comments)
- causality0 4y ago
  Yeah, and that's just HN. Google News, suggested stories, my Firefox startup suggestions, Youtube suggestions, I cannot get away from this nothingburger.
  - dang 4y ago
    Definitely sorry for inviting the nothingburger.

prvc 4y ago

There is a repeated note (or sound effect) in the song which has a pitch which sweeps through 7200 Hz. In fact, it is reminiscent of a kind of sound that can occasionally emanate from a failing drive which spins at that rate. I wonder if they got the "5400 RPM" detail wrong?

userbinator 4y ago
I don't think the rotational speed of the drive is that relevant; the resonance that was being excited is certainly different as otherwise the drive would've excited it via its own rotation.
- prvc 4y ago
  We don't actually know that this phenomenon is due to resonance.

aaron695 4y ago

userbinator 4y ago

This reminds me of a similar experience I have from a time when I was briefly working in the field on machinery containing huge (multiple megawatts) industrial motors. We had finished doing some work on the control electronics, and the plant operator warned us to turn off our laptops before he started up the main motor because he had previously noticed they would always BSoD and occasionally completely fail to boot afterwards due to disk corruption. This was in a room far from the motor, and it was not very loud even without hearing protection, but the vibration was still enough to hit a resonance in the HDD. Of course, that was so long ago that this "CVE-chaser" culture of paranoia had not yet appeared.