3 ms·

Flash drives are way worse. They are overprovisioned to allow for wear leveling, which means they already contain a ton of extra shadow storage that the control

Flash drives are way worse. They are overprovisioned to allow for wear leveling, which means they already contain a ton of extra shadow storage that the controller is already programmed to make invisible. At least with a regular HDD, the owner could notice that some space is missing.

hga 12y ago
Unless this malware wants to hide a lot of data on the drive this way, the same problem applies. For a long time hard disks have had spare blocks for invisible replacement it that's possible. Not to mention addressing yield in magnetic platters, you can save a lot of money by having the drive map and not use just plain bad sectors (in the bad old days they came with a printout of the bad sectors). And of course once you compromise the boot process, it's game over. Even for someone like me who uses drives as "small" as 146 "GB" for one of my system, a lot more than a few megabytes, probably more than a GiB would have to be stolen before I'd notice (well, those disks are underprovisened with LVM, but, really, can you even buy a drive with less than 100 GiB today? Not as of a few years ago, as I recall).
AlyssaRowan 12y ago
Wrong: actually, hard disks also have some unallocated sectors on the platters for both bad-sector replacement and firmware storage, and this is also completely masked out from the (S)ATA interface. Bearing in mind I don't have a proper sample - IRATEMONK does not seem to be engineered to try to persist through a hard drive firmware flash, via software or via serial/JTAG. So, if you really are actually affected by this - please save your drive for analysis! Presumably such events are very rare - seriously, when did you last update your hard drive's firmware? Except for SSDs, did you even know that you could? I wonder if the SSD version - I know one exists, I've seen the intern project to port it to the Indilinx Barefoot - tries? I'm guessing - speculation - probably not, that's the kind of thing they'd probably want to handle manually - they've definitely got the budget to keep them updated across revisions, and maybe losing persistence is probably preferable to accidental bricking exposing their RAT, although that doesn't account for the occasional fuckup - and well, thinking about it, people kind of expect hard drives to die on them on occasion, don't they? Still, a pattern of failures of a model would stick out.
- lawnchair_larry 12y ago
  By seen the SSD intern project, do you mean the der speigel document?

hga 12y ago

Unless this malware wants to hide a lot of data on the drive this way, the same problem applies. For a long time hard disks have had spare blocks for invisible replacement it that's possible. Not to mention addressing yield in magnetic platters, you can save a lot of money by having the drive map and not use just plain bad sectors (in the bad old days they came with a printout of the bad sectors). And of course once you compromise the boot process, it's game over. Even for someone like me who uses drives as "small" as 146 "GB" for one of my system, a lot more than a few megabytes, probably more than a GiB would have to be stolen before I'd notice (well, those disks are underprovisened with LVM, but, really, can you even buy a drive with less than 100 GiB today? Not as of a few years ago, as I recall).

AlyssaRowan 12y ago

Wrong: actually, hard disks also have some unallocated sectors on the platters for both bad-sector replacement and firmware storage, and this is also completely masked out from the (S)ATA interface. Bearing in mind I don't have a proper sample - IRATEMONK does not seem to be engineered to try to persist through a hard drive firmware flash, via software or via serial/JTAG. So, if you really are actually affected by this - please save your drive for analysis! Presumably such events are very rare - seriously, when did you last update your hard drive's firmware? Except for SSDs, did you even know that you could? I wonder if the SSD version - I know one exists, I've seen the intern project to port it to the Indilinx Barefoot - tries? I'm guessing - speculation - probably not, that's the kind of thing they'd probably want to handle manually - they've definitely got the budget to keep them updated across revisions, and maybe losing persistence is probably preferable to accidental bricking exposing their RAT, although that doesn't account for the occasional fuckup - and well, thinking about it, people kind of expect hard drives to die on them on occasion, don't they? Still, a pattern of failures of a model would stick out.

lawnchair_larry 12y ago
By seen the SSD intern project, do you mean the der speigel document?