107 ms·
Interesting that such a seemingly well-designed piece of malware would have such an obvious tell (refusing to boot from any other hard disk). Although I suppos
by 3JPLW 13y ago
Interesting that such a seemingly well-designed piece of malware would have such an obvious tell (refusing to boot from any other hard disk). Although I suppose that it is a rare thing to do. (Now's the time to check…)
Also fascinating that his infection is at least three years old. Was Dragos targeted? Or perhaps someone within the pwn2own contest was?
Such persistent malware that targets air gapped machines reminds me of other malware created by nation-states.
- Tloewald 13y agoAlso, if you've compromised BIOS what do you care if the user boots from CD?
- dublinben 13y agoBooting from a CD would [let you replace the infected BIOS](http://www.flashrom.org/Live_CD http://www.flashrom.org/Live_CD). Restricting the boot devices presumably helps preserve the BIOS infection.
- Tloewald 13y agoFair enough, presumably it's easier to simply prevent booting from CD than subvert every tool for flashing BIOSes. In the end, it seems to me that blocking boot from CD is a net loss, since it alerts the user (who can undertake drastic measures including hooking up a different hard drive), whereas allowing boot from CD but reinstalling the BIOS malware from the (presumably thoroughly infected) hard disk would not.
- dublinben 13y agoWho knows. There's a lot of inconsistencies in this story.