2 ms·

Hard drives have firmware and hidden partitions. An attacker with access to these could manipulate them to create a backdoor which allows remote control, data a

Hard drives have firmware and hidden partitions. An attacker with access to these could manipulate them to create a backdoor which allows remote control, data access, etc.

deleted 3y ago
[deleted]
FirmwareBurner 3y ago
>HDDs have firmware. That's ... what I just said. >An attacker with access to the firmware could manipulate it to create a backdoor. You can create backdoors for every device, not just HDDs, why should Toshiba be liable here? iPhones and Androids have tonnes of exploits written for them? Are we extorting them too for SW bugs that lead to vulnerabilities? >This might involve modifying the firmware to allow remote control, unauthorized data access, or other malicious actions Remote access how? Can I talk to the exploited firmware of your HDD via the internet while magically bypassing firewalls and the OS security? Is that a technically feasible thing or are you just speculating without background knowledge? Sounds like first you'd need to compromise the firewalls, OS, SATA controller and network layers to let outsiders talk to the compromised HDD firmware via the internet and if the attacker already has that kind of remote access to your system, then you're already screwed and compromised and the HDD firmware is the least of your worries. Even if remote HDD firmware vulnerabilities are not technically feasible and only work if you get your hands on the HDD, in cyber-secvurity world, if your HDD/laptop/PC is in the hands of the attacker, then you can consider it already compromised regardless of HDD firmware security. It all sounds like a nothing burgher or pure FUD.
- formerly_proven 3y ago
  Some SSDs understand partition tables and file systems to trim/discard their flash "automagically", so it would be possible for firmware to manipulate e.g. OS components stored on the disk to introduce a backdoor. The hard drive has plenty of storage space for that.
  - FirmwareBurner 3y ago
    1. We're talking about HDDs from 20 years ago, not SSDs. Different beasts entirely. 2. That still means you need physical acces to the victim's system to exploit, nothing that can be exploited remotely.
- charcircuit 3y ago
  >why should Toshiba be liable here? If Toshiba created a malicous firmware with a backdoor they would be liable for the backdoor.
  - FirmwareBurner 3y ago
    >If Toshiba created a malicous firmware with a backdoor they would be liable for the backdoor. That's a big IF. Where's the proof for that though? Or is it like the imaginary WMDs in Irak? Backdoors are usually cleverly disguised software bugs specifically to give you deniability if you ever get caught. It's not like the Jupânese agencies would put their names and signatures in the backdoor's firmare image.

Hard drives have firmware and hidden partitions. An attacker with access to these could manipulate them to create a backdoor which allows remote control, data access, etc.

deleted 3y ago

[deleted]

FirmwareBurner 3y ago

>HDDs have firmware. That's ... what I just said. >An attacker with access to the firmware could manipulate it to create a backdoor. You can create backdoors for every device, not just HDDs, why should Toshiba be liable here? iPhones and Androids have tonnes of exploits written for them? Are we extorting them too for SW bugs that lead to vulnerabilities? >This might involve modifying the firmware to allow remote control, unauthorized data access, or other malicious actions Remote access how? Can I talk to the exploited firmware of your HDD via the internet while magically bypassing firewalls and the OS security? Is that a technically feasible thing or are you just speculating without background knowledge? Sounds like first you'd need to compromise the firewalls, OS, SATA controller and network layers to let outsiders talk to the compromised HDD firmware via the internet and if the attacker already has that kind of remote access to your system, then you're already screwed and compromised and the HDD firmware is the least of your worries. Even if remote HDD firmware vulnerabilities are not technically feasible and only work if you get your hands on the HDD, in cyber-secvurity world, if your HDD/laptop/PC is in the hands of the attacker, then you can consider it already compromised regardless of HDD firmware security. It all sounds like a nothing burgher or pure FUD.

formerly_proven 3y ago
Some SSDs understand partition tables and file systems to trim/discard their flash "automagically", so it would be possible for firmware to manipulate e.g. OS components stored on the disk to introduce a backdoor. The hard drive has plenty of storage space for that.
- FirmwareBurner 3y ago
  1. We're talking about HDDs from 20 years ago, not SSDs. Different beasts entirely. 2. That still means you need physical acces to the victim's system to exploit, nothing that can be exploited remotely.
charcircuit 3y ago
>why should Toshiba be liable here? If Toshiba created a malicous firmware with a backdoor they would be liable for the backdoor.
- FirmwareBurner 3y ago
  >If Toshiba created a malicous firmware with a backdoor they would be liable for the backdoor. That's a big IF. Where's the proof for that though? Or is it like the imaginary WMDs in Irak? Backdoors are usually cleverly disguised software bugs specifically to give you deniability if you ever get caught. It's not like the Jupânese agencies would put their names and signatures in the backdoor's firmare image.