5 ms·

I'm not an expert but I imagine any bit of code you put into firmware will target very narrow configuration of other software on the PC, will be pretty fragile

I'm not an expert but I imagine any bit of code you put into firmware will target very narrow configuration of other software on the PC, will be pretty fragile and susceptible to bit rot. To be able to routinely steal something from the PC it will need to be tailored to specific configuration. Am I wrong?

final 12y ago
It will target as wide a group as possible. It`s just a small backdoor, that lets the agency that should not be named to install a full rootkit at will.
- guard-of-terra 12y ago
  I imagine you can do that. Some 512-byte sequence that triggers boot sector overwriting with whatever comes next.
Htsthbjig 12y ago
I don't understand what do you mean by "bit rot". Bits don't rot like vegetables. They could last just fine for centuries, specially in protected, privilege parts of memory were firmware stays. NVDIA driver is the same for all cards. Tablets and smartphones are very homogeneous and the most widely used, Apple's totally closed source, including the hardware. Most people use Intel processors. Any of those vectors are very easy to target if you have the hardware and software source code.
- guard-of-terra 12y ago
  It's in wikipedia under "software rot". The problem is, firmware is pretty small. You can't fit much function there. Or it was; I imagine modern hard drives might have many megabytes of firmware which allows for pretty sophisticated hacks.
  - ProAm 12y ago
    Firmware also operates on an extremely basic level, it's not suffer the same usability/compatibility like normal end users software.
    - guard-of-terra 12y ago
      Once it needs to communicate via network, it needs a gateway into normal user software somehow. Ditto for accessing the file system.
      - ProAm 12y ago
        I think that is even possible to do at a low level, see how they embed encrypted packets within other packets to sneak out of a network undetected [1]. Even if this technology only lasted 10-15 years that is a LONG time to have the upper hand. [1] http://www.jwz.org/blog/2015/02/ip-over-avian-carriers-nsa-edition/ http://www.jwz.org/blog/2015/02/ip-over-avian-carriers-nsa-e...
      - kbart 12y ago
        Sending/receiving an UDP packet is not difficult, even on low level. Knowing what filesystem lies above, implementing some crawler (aka search) is no rocket science too. Combine these two techniques, add some simple command protocol and you have access to any file on a targeted device.
  - nitrogen 12y ago
    Hard drives and SSDs have more storage capacity than is actually presented to the OS, mostly for remapping bad sectors, possibly for storing internal metadata for the disk's operation. A malicious firmware could use that unmapped storage capacity to store larger, more versatile payloads.
- MacsHeadroom 12y ago
  I fail to see how it's relevant here, but physical bits certainly do rot. This is known as bit rot, data rot, data decay or data degradation. See https://en.wikipedia.org/wiki/Data_degradation#Decay_of_storage_media https://en.wikipedia.org/wiki/Data_degradation#Decay_of_stor...
  - EpicEng 12y ago
    This is not the sort of "bit rot" that the parent was referring to.
wongarsu 12y ago
Targeting one firmware is very narrow. Targeting different firmwares from 12 different manufacturers has a pretty good chance of being successful on any give target, and that's what they are doing. They have to keep up as new hard drive models come out, but that's what they are being paid for.
thefreeman 12y ago
Yes, completely. You can read the technical report here: https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question... The firmware malware is mainly to create hidden, unremovable, persistant space on the drive, and likely hijack the boot process. At that point it passes off to other malware.
jacobwcarlson 12y ago
The Kaspersky report[1] states that GRAYFISH (which contains the HDD firmware reprogramming code) works on Windows NT 4.0, 2k, XP, Vista, Windows 7 and Windows 8, in both 32-bit and 64-bit builds. One can't help but to be impressed. [1] http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2015/02/Equation_group_questions_and_answers.pdf http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/f...

final 12y ago

It will target as wide a group as possible. It`s just a small backdoor, that lets the agency that should not be named to install a full rootkit at will.

guard-of-terra 12y ago
I imagine you can do that. Some 512-byte sequence that triggers boot sector overwriting with whatever comes next.

Htsthbjig 12y ago

I don't understand what do you mean by "bit rot". Bits don't rot like vegetables. They could last just fine for centuries, specially in protected, privilege parts of memory were firmware stays. NVDIA driver is the same for all cards. Tablets and smartphones are very homogeneous and the most widely used, Apple's totally closed source, including the hardware. Most people use Intel processors. Any of those vectors are very easy to target if you have the hardware and software source code.

guard-of-terra 12y ago
It's in wikipedia under "software rot". The problem is, firmware is pretty small. You can't fit much function there. Or it was; I imagine modern hard drives might have many megabytes of firmware which allows for pretty sophisticated hacks.
- ProAm 12y ago
  Firmware also operates on an extremely basic level, it's not suffer the same usability/compatibility like normal end users software.
  - guard-of-terra 12y ago
    Once it needs to communicate via network, it needs a gateway into normal user software somehow. Ditto for accessing the file system.
    - ProAm 12y ago
      I think that is even possible to do at a low level, see how they embed encrypted packets within other packets to sneak out of a network undetected [1]. Even if this technology only lasted 10-15 years that is a LONG time to have the upper hand. [1] http://www.jwz.org/blog/2015/02/ip-over-avian-carriers-nsa-edition/ http://www.jwz.org/blog/2015/02/ip-over-avian-carriers-nsa-e...
    - kbart 12y ago
      Sending/receiving an UDP packet is not difficult, even on low level. Knowing what filesystem lies above, implementing some crawler (aka search) is no rocket science too. Combine these two techniques, add some simple command protocol and you have access to any file on a targeted device.
- nitrogen 12y ago
  Hard drives and SSDs have more storage capacity than is actually presented to the OS, mostly for remapping bad sectors, possibly for storing internal metadata for the disk's operation. A malicious firmware could use that unmapped storage capacity to store larger, more versatile payloads.
MacsHeadroom 12y ago
I fail to see how it's relevant here, but physical bits certainly do rot. This is known as bit rot, data rot, data decay or data degradation. See https://en.wikipedia.org/wiki/Data_degradation#Decay_of_storage_media https://en.wikipedia.org/wiki/Data_degradation#Decay_of_stor...
- EpicEng 12y ago
  This is not the sort of "bit rot" that the parent was referring to.

wongarsu 12y ago

Targeting one firmware is very narrow. Targeting different firmwares from 12 different manufacturers has a pretty good chance of being successful on any give target, and that's what they are doing. They have to keep up as new hard drive models come out, but that's what they are being paid for.

thefreeman 12y ago

Yes, completely. You can read the technical report here: https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question... The firmware malware is mainly to create hidden, unremovable, persistant space on the drive, and likely hijack the boot process. At that point it passes off to other malware.

jacobwcarlson 12y ago

The Kaspersky report[1] states that GRAYFISH (which contains the HDD firmware reprogramming code) works on Windows NT 4.0, 2k, XP, Vista, Windows 7 and Windows 8, in both 32-bit and 64-bit builds. One can't help but to be impressed. [1] http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2015/02/Equation_group_questions_and_answers.pdf http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/f...