3 ms·

Destroying your hard drive is the only way to stop this super-advanced malware

13 points by Varcht 12y ago

ocdtrekkie 12y ago
The government used to accept overwriting a hard drive several times with random bits as an acceptable wipe. Then they changed to insisting destroying a hard drive was the only solution. Now we know why. ;)
- lawnchair_larry 12y ago
  Suddenly, the order for the Guardian to destroy everything with a microcontroller makes sense. It's funny because to mere mortals, that is a ridiculous thing to do, but to people in the spying world, it's routine.
  - AlyssaRowan 12y ago
    Not just that - they have some kind of attempt at an implant against all of those, with varying success. (In a way, it actually leaked their capabilities!)
hga 12y ago
Heh. Or just use SAS (Serial Attached SCSI) disk drives. Heck, my boot drives are hidden behind an el-cheapo LSI board that mirrors them, even experts find it very difficult to talk directly to those drives (a perhaps unique case for this 200x board/chipset family). On the other hand, my next system will almost certainly include flash drives, and I gather the inefficiencies and imperfections of ATA don't matter so much with them, and staying in that ecosystem is of course cheaper. But maybe like their true enterprise magnetic disks, SAS flash drives are better. It's quite interesting to witness such a dramatic and quick change in how we build systems, but I'm glad circumstances forced me to build my current systems before using flash drives was safe enough (for me).
- lawnchair_larry 12y ago
  Flash drives are way worse. They are overprovisioned to allow for wear leveling, which means they already contain a ton of extra shadow storage that the controller is already programmed to make invisible. At least with a regular HDD, the owner could notice that some space is missing.
  - hga 12y ago
    Unless this malware wants to hide a lot of data on the drive this way, the same problem applies. For a long time hard disks have had spare blocks for invisible replacement it that's possible. Not to mention addressing yield in magnetic platters, you can save a lot of money by having the drive map and not use just plain bad sectors (in the bad old days they came with a printout of the bad sectors). And of course once you compromise the boot process, it's game over. Even for someone like me who uses drives as "small" as 146 "GB" for one of my system, a lot more than a few megabytes, probably more than a GiB would have to be stolen before I'd notice (well, those disks are underprovisened with LVM, but, really, can you even buy a drive with less than 100 GiB today? Not as of a few years ago, as I recall).
  - AlyssaRowan 12y ago
    Wrong: actually, hard disks also have some unallocated sectors on the platters for both bad-sector replacement and firmware storage, and this is also completely masked out from the (S)ATA interface. Bearing in mind I don't have a proper sample - IRATEMONK does not seem to be engineered to try to persist through a hard drive firmware flash, via software or via serial/JTAG. So, if you really are actually affected by this - please save your drive for analysis! Presumably such events are very rare - seriously, when did you last update your hard drive's firmware? Except for SSDs, did you even know that you could? I wonder if the SSD version - I know one exists, I've seen the intern project to port it to the Indilinx Barefoot - tries? I'm guessing - speculation - probably not, that's the kind of thing they'd probably want to handle manually - they've definitely got the budget to keep them updated across revisions, and maybe losing persistence is probably preferable to accidental bricking exposing their RAT, although that doesn't account for the occasional fuckup - and well, thinking about it, people kind of expect hard drives to die on them on occasion, don't they? Still, a pattern of failures of a model would stick out.

13 points by Varcht 12y ago

The government used to accept overwriting a hard drive several times with random bits as an acceptable wipe. Then they changed to insisting destroying a hard drive was the only solution. Now we know why. ;)

lawnchair_larry 12y ago
Suddenly, the order for the Guardian to destroy everything with a microcontroller makes sense. It's funny because to mere mortals, that is a ridiculous thing to do, but to people in the spying world, it's routine.
- AlyssaRowan 12y ago
  Not just that - they have some kind of attempt at an implant against all of those, with varying success. (In a way, it actually leaked their capabilities!)

hga 12y ago

Heh. Or just use SAS (Serial Attached SCSI) disk drives. Heck, my boot drives are hidden behind an el-cheapo LSI board that mirrors them, even experts find it very difficult to talk directly to those drives (a perhaps unique case for this 200x board/chipset family). On the other hand, my next system will almost certainly include flash drives, and I gather the inefficiencies and imperfections of ATA don't matter so much with them, and staying in that ecosystem is of course cheaper. But maybe like their true enterprise magnetic disks, SAS flash drives are better. It's quite interesting to witness such a dramatic and quick change in how we build systems, but I'm glad circumstances forced me to build my current systems before using flash drives was safe enough (for me).

lawnchair_larry 12y ago
Flash drives are way worse. They are overprovisioned to allow for wear leveling, which means they already contain a ton of extra shadow storage that the controller is already programmed to make invisible. At least with a regular HDD, the owner could notice that some space is missing.
- hga 12y ago
  Unless this malware wants to hide a lot of data on the drive this way, the same problem applies. For a long time hard disks have had spare blocks for invisible replacement it that's possible. Not to mention addressing yield in magnetic platters, you can save a lot of money by having the drive map and not use just plain bad sectors (in the bad old days they came with a printout of the bad sectors). And of course once you compromise the boot process, it's game over. Even for someone like me who uses drives as "small" as 146 "GB" for one of my system, a lot more than a few megabytes, probably more than a GiB would have to be stolen before I'd notice (well, those disks are underprovisened with LVM, but, really, can you even buy a drive with less than 100 GiB today? Not as of a few years ago, as I recall).
- AlyssaRowan 12y ago
  Wrong: actually, hard disks also have some unallocated sectors on the platters for both bad-sector replacement and firmware storage, and this is also completely masked out from the (S)ATA interface. Bearing in mind I don't have a proper sample - IRATEMONK does not seem to be engineered to try to persist through a hard drive firmware flash, via software or via serial/JTAG. So, if you really are actually affected by this - please save your drive for analysis! Presumably such events are very rare - seriously, when did you last update your hard drive's firmware? Except for SSDs, did you even know that you could? I wonder if the SSD version - I know one exists, I've seen the intern project to port it to the Indilinx Barefoot - tries? I'm guessing - speculation - probably not, that's the kind of thing they'd probably want to handle manually - they've definitely got the budget to keep them updated across revisions, and maybe losing persistence is probably preferable to accidental bricking exposing their RAT, although that doesn't account for the occasional fuckup - and well, thinking about it, people kind of expect hard drives to die on them on occasion, don't they? Still, a pattern of failures of a model would stick out.