Not Only the NSA Knows How to Make Unerasable Malware

Hacking tools linked to U.S. intelligence that burrow inside hard disk drives could also be made by nongovernment hackers.

Over the weekend Russian security company Kaspersky described a suite of extremely sophisticated hacking tools that since 2008 have been used to infiltrate government, military, and corporate computers in 30 countries around the world. Reuters reports that it was the work of the U.S. National Security Agency.

Kasperskys most striking finding was that the toolkit of what it calls the Equation Group could inject malware into the software embedded inside hard disk drives. Not only is that firmware invisible to conventional security software, but malicious code hidden inside it can emerge to take over a computer even after its hard disk has been carefully erased. Costin Raiu, a researcher with Kaspersky, told the New York Times that the technique rendered investigators like him practically blind.

That impressive trick sets a new bar for the sophistication in malware caught in the wild. And it has led to speculation that the NSA had assistance from hard drive manufacturers, for example by getting access to details on how their firmware worked.

But despite suggestions it would be just about impossible for even the NSA to reverse-engineer hard drive firmware without such help, it appears to be well within its reachand that of many others, too. In recent years hackers and researchers with budgets far smaller than the NSAs have reverse-engineered the firmware of hard drives and other devices and demonstrated their own invisible malware.

That raises the prospect that multiple national intelligence agenciesand perhaps even groups without government backingcould be using the technique. Few, if any, security researchers are on the lookout for such attacks because they are essentially invisible.

Anyone looking to get started hacking hard drive firmware would be well advised to start with this page on the subject from prolific hacker Jereom Domburg. In 2013 he gave several talks on his research and showed how it enabled him to remotely take over a server with a hard disk made by Western Digital, a leading manufacturer whose drives were also targeted by Equation Group.

Also in 2013, academic researchers independently went even further and developed several proof-of-concept attacks against a hard disk from a different manufacturer. They showed how a disks firmware could be infected remotely, and made a system to communicate over the Internet with the unerasable malware to send commands and copy data such as encryption keys. This line from the academic papers summary has gained new plausibility after what we learned over the weekend:

The difficulty of implementing such an attack is not limited to the area of government cyber-warfare; rather, it is well within the reach of moderately funded criminals, botnet herders and academic researchers.

At the Black Hat security conference last summer, two researchers described how they had reverse engineered the firmware of USB sticks to hide code inside that can silently take over a computer.

Read the original here:
Not Only the NSA Knows How to Make Unerasable Malware