NSA Hiding Equation Spy Program On Hard Drives

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
This is some pretty scary stuff when you think about it. :eek:

The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.
Click to expand...
 
This story is not a surprise. And whether its a story depends on the the degree to which they spread this.
 
In before the people who believe this information shouldn't have been leaked and our benevolent government always knows best.
 
old-typewriter.jpg
 
*Wonder's when someone will modify this to steal people's personal info or turn into ransom-ware by encrypting their HDDs.....
 
Yeah I had the CIA after me once it was no big deal was questioned for 6 hours or so I told them I worked at Walmart stocking toilet paper and they let me go six months later.
 
Would writing zeroes multiple times to a fresh drive solve the issue ?
 
You will not find this on your hard drives - not because you can't see it, but because it isn't there.

The linked article buries it pretty well, while this article explains it better: these hacks were used only in a very targeted manner, such as by intercepting hardware or media being mailed to the intended targets. The NSA doesn't have the time to be interested in the likes of you.
 
Simmonz said:
Would writing zeroes multiple times to a fresh drive solve the issue ?
Click to expand...
No. The issue is with the firmware on the drive, not any data on the drive's platters or memory chips. Think bios, but for the hard drive.

Hearing this crap makes me sort of want to throw out all my electronics. Nothing is safe anymore because of these d-bags.
 
Not surprised at this. When STUXNET was revealed, I felt no computer was safe anymore because supposedly this virus had to travel through the Internet to get to Iran. If so, that means every computer has this virus and who knows what it's doing. If the Iran centrifuges couldn't be reached through the Internet, installed hardware was another avenue. Who is going to think of checking the firmware of computer hard drives for malware?
 
Gweenz said:
Probably already happening. This reminds me of Sony and their rootkits:

http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal
Click to expand...

Truth is, something like this would not remain very effective in the wild for long, that is why the spy agencies have been very selective in using it.

They figure out a way to get code to store in drive firmware. Their proprietary code uses 0-day vulnerabilities to infect the host, regardless of how many times it is wiped.

If this went wild and were used liberally, it would be detected quickly, and those 0-days it relies on to get from the firmware onto the rest of the machine wouldn't remain 0-days for very long.

This is a pretty cool attack vector for spy agencies, but I don't think it would be very effective on a mass-ransomware scale. At least not against people who patch their machines.

It would get a few people at first, and then the patches would go out once discovered.

For ransomware to be effective for a scammer, they need ti to remain effective for a long period of time, infecting millions, so that the certain small percentage that falls for it, and pays up amounts ot real money.
 
mynamehere said:
I wonder how many would even know what this is, let alone ever used one, not to mention actually owning one of these manually powered beauties.
Click to expand...

They are very difficult to use after getting used to a computer.

I constantly jam up the keys by typing too quickly, and make so many typos that I am used to just be able to fix that now require correction tape, or starting over.

Honestly, I think I'd rather just write by hand.
 
Zarathustra[H];1041432446 said:
They are very difficult to use after getting used to a computer.

I constantly jam up the keys by typing too quickly, and make so many typos that I am used to just be able to fix that now require correction tape, or starting over.

Honestly, I think I'd rather just write by hand.
Click to expand...

That, and I believe in the 60's or 70's Soviet spy agencies figured out that they could use listening devices placed inside typewriters to be able to reconstruct what was being typed by the subtle differences in sound between each key press, so you can still be spied on :p
 
Zarathustra[H];1041432457 said:
That, and I believe in the 60's or 70's Soviet spy agencies figured out that they could use listening devices placed inside typewriters to be able to reconstruct what was being typed by the subtle differences in sound between each key press, so you can still be spied on :p
Click to expand...

true story.
 
Zarathustra[H];1041432441 said:
Truth is, something like this would not remain very effective in the wild for long, that is why the spy agencies have been very selective in using it.

They figure out a way to get code to store in drive firmware. Their proprietary code uses 0-day vulnerabilities to infect the host, regardless of how many times it is wiped.

If this went wild and were used liberally, it would be detected quickly, and those 0-days it relies on to get from the firmware onto the rest of the machine wouldn't remain 0-days for very long.

This is a pretty cool attack vector for spy agencies, but I don't think it would be very effective on a mass-ransomware scale. At least not against people who patch their machines.

It would get a few people at first, and then the patches would go out once discovered.

For ransomware to be effective for a scammer, they need ti to remain effective for a long period of time, infecting millions, so that the certain small percentage that falls for it, and pays up amounts ot real money.
Click to expand...

You do realize the UEFI BIOS hack existed for years and is still not fixed on a number of legacy motherboards.

Don't even get me started on routers.
 
pgaster said:
No. The issue is with the firmware on the drive, not any data on the drive's platters or memory chips. Think bios, but for the hard drive.

Hearing this crap makes me sort of want to throw out all my electronics. Nothing is safe anymore because of these d-bags.
Click to expand...

Agreed.

mynamehere said:
I wonder how many would even know what this is, let alone ever used one, not to mention actually owning one of these manually powered beauties.
Click to expand...

Should have been a pre-QWERTY model. :p
 
heatlesssun said:
Wasn't the QWERTY arrangement created to intentionally slow typing speed because jamming was such a big problem with early typewriters?
Click to expand...

I've heard the same thing.

Which makes me wonder why we haven't ever changed it up sot hat we can type EVEN FASTER!!!
 
PHubb said:
Even if they can put stuff in the firmware of HDDs that tracks the bits on it, how would they get it out over to a network? It seems to me that they would have to install some kind of NIC in there too that could communicate to the outside? What's the technology that would allow HDD firmware to communicate directly with the outside world without being detected?
Click to expand...

The HDD firmware is used to infect whatever OS the user installs on the HDD. In each case, the malware is custom-written to suit whatever OS the target is using, be it Windows, Mac OS X, Linux, or whatever else.

You all do understand the total number of infections of this is somewhere in the tens of thousands over the course of 14 years, right?
 
Didn't one of the Edward Snowden leaks about a year ago mention how this was happening within the firmware of many computer components worldwide? I faintly remember hearing this and how its so deep within hard drives in the instance that even doing a secure wipe wouldn't delete data in a way that couldn't be reversed.

It sounded really silly at the time, but the only way you could make wiping a drive useless would be by messing with the software that makes the hard drive work in the first place. Pretty scary stuff.

1984 ain't got shit on today.
 
Zarathustra[H];1041432441 said:
Truth is, something like this would not remain very effective in the wild for long, that is why the spy agencies have been very selective in using it.

They figure out a way to get code to store in drive firmware. Their proprietary code uses 0-day vulnerabilities to infect the host, regardless of how many times it is wiped.

If this went wild and were used liberally, it would be detected quickly, and those 0-days it relies on to get from the firmware onto the rest of the machine wouldn't remain 0-days for very long.

This is a pretty cool attack vector for spy agencies, but I don't think it would be very effective on a mass-ransomware scale. At least not against people who patch their machines.

It would get a few people at first, and then the patches would go out once discovered.

For ransomware to be effective for a scammer, they need ti to remain effective for a long period of time, infecting millions, so that the certain small percentage that falls for it, and pays up amounts ot real money.
Click to expand...

10's, if not 100's of millions of computer users fail to update their operating system, what's the chance they will update their HDD's firmware?


heatlesssun said:
Wasn't the QWERTY arrangement created to intentionally slow typing speed because jamming was such a big problem with early typewriters?
Click to expand...

Yep.
 
Simmonz said:
Would writing zeroes multiple times to a fresh drive solve the issue ?
Click to expand...

Neither the fresh drive nor the drive you are using will have the infection at all, unless you are on the NSA's list of the 10,000 most interesting people to surveil.
 
chockomonkey said:
I've heard the same thing.

Which makes me wonder why we haven't ever changed it up sot hat we can type EVEN FASTER!!!
Click to expand...

I believe that was the intent of the DVORAK layout, but it turns out that the learning curve switching from QWERTY to DVORAK was steep enough, that only very few people adopted it.
 
evilsofa said:
You will not find this on your hard drives - not because you can't see it, but because it isn't there.

The linked article buries it pretty well, while this article explains it better: these hacks were used only in a very targeted manner, such as by intercepting hardware or media being mailed to the intended targets. The NSA doesn't have the time to be interested in the likes of you.
Click to expand...

lol
 
You must log in or register to reply here.
Back
Top