3 ms·
The switch would need to be connected directly to the hardware that allows writing. Unfortunately I think disk drives keep their firmware on the media itself, s
by mark-r 11y ago
The switch would need to be connected directly to the hardware that allows writing. Unfortunately I think disk drives keep their firmware on the media itself, so any attack that allows you to write on the hidden area of the disk will be bypassing the switch automatically.
- marssaxman 11y agoThat would surprise me. I have no experience with storage devices, but I used to write firmware for other embedded devices, and in my experience firmware was always stored on the NAND flash integrated into the microcontroller. Most microcontrollers either can't run code from external storage, or can't do so with any efficiency, and most microcontrollers don't have anything like enough RAM to store the whole program text. It wouldn't surprise me to see a mechanism allowing a drive controller to reflash itself from its own storage media, but I would expect the actual stored code to live in the controller chip. Even if the storage device is an SSD, the NAND-flash chips used for storage won't be visible in the controller's address space the same way its own flash is.
- mrb 11y agoRead the slides. There is a "service area" on the drive that contains additional firmware modules loaded and executed by the microcontroller: http://malwaretech.net/MTSBK.pdf http://malwaretech.net/MTSBK.pdf