8 ms·
> “You know how much effort it takes to land just one firmware for a hard drive? You need to know specifications, the CPU, the architecture of the firmware, how
by mmastrac 12y ago
> “You know how much effort it takes to land just one firmware for a hard drive? You need to know specifications, the CPU, the architecture of the firmware, how it works,” Raiu says. The Kaspersky researchers have called it “an astonishing technical accomplishment and is testament to the group’s abilities.”
I honestly don't think it's as difficult as they make it out to be. About ten years ago we were hacking Treo 650 firmware to read and write to flash without actually knowing how to do it at a low level. We just found the appropriate "read sector" and "write sector" commands and wrote a heuristic to search for them in whatever version was running. Later Android hacking attempts did exactly the same thing with HTC's HBOOT.
HDD, CD-ROM, DVD-ROM, BluRay -- firmware for all of those types of drives have been decompiled before. With the right JTAG hardware and/or creativity it just isn't that difficult for someone who knows that they are doing.
Now, if you can execute code on the HDD's CPU through whatever exploit you can find, you can search through RAM for whatever methods you need to write yourself to persistent storage. That persistent exploit can then use heuristics to hook the appropriate methods to intercept reads and writes as needed.
- voltagex_ 12y agoNot easy, but not impossible: http://spritesmods.com/?art=hddhack&page=2 http://spritesmods.com/?art=hddhack&page=2
- rasz_pl 12y agoand http://vimeo.com/channels/coastermelt/111417458 http://vimeo.com/channels/coastermelt/111417458
- chinpokomon 12y agoI'm a huge fan of Micah Scott. Inspiring work.
- XorNot 12y agoThis. It requires time and effort but not more then could be accomplished by a single motivated hacker without being paid.
- mmastrac 12y agoExactly. And this would be faster with a team. If anyone here has done reasonably well at https://microcorruption.com/ https://microcorruption.com/ and has experience with IDA, I'd say they were qualified to do something like this (experience with ARM and JTAG a bonus!).
- bigiain 12y agoAnd way _way_ faster if you've NSLed the US corporate officers of the drive manufacturers, or deeply rooted their internal networks Gemalco-style...
- anonbanker 12y agoWhy not do both?
- sliverstorm 12y agoHacking around with something in a lab is not quite the same as weaponizing an exploit. And, while your thresholds for technical accomplishment might be higher than Kaspersky's, regardless whether we knew this was "feasible" before, it's the first documented case of completely taking over the hard drive. That I know of.
- mmastrac 12y agoYou are correct that it does require more effort to make things production-ready. From my experience doing similar things -- not weaponizing exploits, but turning them into polished tools as part of [1] and [2] which I'd consider roughly equivalent -- I would estimate that productionizing an exploit takes about 3-5 times longer than the time required to find the exploits themselves. Note that there have been proofs-of-concept of this for some time [3], as linked elsewhere in this thread. While it is still impressive that they could link it into their exploit framework, I honestly believe that you could "weaponize" something like the previously linked exploit without a massive effort. Also note that this is not a "complete takeover" of an HDD, but rather an exploit that allows it to interpose between the platter data and the computer. [1] grack.com/romtool [2] unrevoked.com [3] http://spritesmods.com/?art=hddhack&page=1 http://spritesmods.com/?art=hddhack&page=1
- sliverstorm 12y agoYes, it's not something totally unprecedented that we hadn't even imagined possible before. You are correct there. How is it not a complete takeover? I realize news articles are not the best technical sources as they get terms & concepts wrong, but I am reading that the firmware is completely reflashed, which means the HDD CPU has been utterly "pwned", for lack of a better term.
- qb45 12y agoTechnically it's pwned, but you are still limited by the amount of time you have for reverse engineering, implementation and validation. For example, it seems that they obtain storage area by calling some kind of drive's own reserved space allocator, without hacking it to hide this usage from host queries. That's clearly a "limited hack" with potential for improvement.
- drzaiusapelord 12y agoIts obvious to me that Kaspersky has to follow the pro-Moscow line of, "But the Americans are so much more powerful and sophisticated than us," which gives them excuses for things like "buffer countries" and other questionable geopolitical moves. Kasperky's connection to the FSB, Putin, and Russian military is well documented. I also find the timing interesting here. Suddenly Kaspersky has what could be nation state cyberwar tools, while coincidentally in a propaganda war with the West? http://www.wired.com/2012/07/ff_kaspersky/ http://www.wired.com/2012/07/ff_kaspersky/
- at-fates-hands 12y agoI've repeatedly said its interesting he keeps finding and reverse engineering all these US state nation exploits and malware, but can never seem to help with some of these major Russian hacking exploits doing major damage to the US and its Allies. Russian hackers’ ‘Trojan Horse’ malware inside U.S. critical infrastructure since 2011 http://www.washingtontimes.com/news/2014/nov/6/russian-hackers-trojan-horse-malware-inside-us-cri/ http://www.washingtontimes.com/news/2014/nov/6/russian-hacke... Sneaky Russian hackers slurped $15 MILLION from banks http://www.theregister.co.uk/2014/12/22/russian_cyber_heist_gang_rakes_in_15m/ http://www.theregister.co.uk/2014/12/22/russian_cyber_heist_... Russian Hackers Attack NATO, Lithuania Girds for Unconventional War http://www.tol.org/client/article/24515-russian-hackers-attack-nato-lithuania-girds-for-unconventional-war.html http://www.tol.org/client/article/24515-russian-hackers-atta...