This is very cool. I have a pile of dead and old hard drives. I should see if my local hackerspace has something that can connect to JTAG, and if so, see what secrets the old drives contain.
Hard drive hack provides root access, even after reinstall
11–20 of 96 posts
Re: Hard drive hack provides root access, even after reinstall
#12> Because Linux caches the shadow file (like all files recently accessed), I have to generate a lot of disk activity for the file to be 'pushed out' of the cache http://linux-mm.org/Drop_Caches $ echo 3 > /proc/sys/vm/drop_caches or as non-root $ echo 3 | sudo tee /proc/sys/vm/drop_caches
I think the idea is you force a disk read or write operation by interacting with the system remotely (for example uploading a file or sending a particular HTTP GET request that ends up in the log), without having shell access or write access to /proc :)
Re: Hard drive hack provides root access, even after reinstall
#13My knee-jerk reaction was, why didn't WD sign the code and use on-chip fuses and a secure boot path to verify the code before transferring control to anything outside their boot ROM? (Many ARM-based systems-on-a-chip are capable of doing this).
Adds cost, for one thing. But you can arrange for the unit to never run a byte of code (even one loaded from the platter) that didn't come from WD.
Re: Hard drive hack provides root access, even after reinstall
#14A fascinating read, and an excellent piece of work.
It reminds me of a similar proof-of-concept hack on a common network card firmware: http://esec-lab.sogeti.com/post/2010/11/21/Presentation-at-H... (the slides linked from that page have a good more technical overview that the blog post).
Re: Hard drive hack provides root access, even after reinstall
#15I think some hard drives like some Seagates has a serial console in the firmware that provides low level access that data recovery companies for example use.
I'd love to read more info about this!
Re: Hard drive hack provides root access, even after reinstall
#16Earlier quoted context omitted.
Well, to be fair, it's a bit of a pain with UEFI. But this is really amazing. I'd love to see how it could be extended to other OSes, if possible?
I'm not sure about the other controllers, but if this one has a Cortex M3, then anything that runs on an M3 could hypothetically be ported. One of the SE sites assembled a list. Shockingly, the question isn't closed yet! http://electronics.stackexchange.com/questions/27594/what-op...
The Feroceon CPUs are pretty hefty too. They're powering the Marvell Kirkwood platform which is used in things like the Sheevaplug and some of the QNAP TS-* NAS devices. Debian runs great on those. (2.0ghz CPU, 512mb ram). Probably the biggest trouble here is the lack of an MMU (?) .
Re: Hard drive hack provides root access, even after reinstall
#17The first hack read on hacker new I have seen for a long time.
Re: Hard drive hack provides root access, even after reinstall
#18I think some hard drives like some Seagates has a serial console in the firmware that provides low level access that data recovery companies for example use.
I'd love to read more info about this!
Re: Hard drive hack provides root access, even after reinstall
#19My knee-jerk reaction was, why didn't WD sign the code and use on-chip fuses and a secure boot path to verify the code before transferring control to anything outside their boot ROM? (Many ARM-based systems-on-a-chip are capable of doing this). Adds cost, for one thing. But you can arrange for the unit to never run a byte of code (even one loaded from the platter) that didn't come from WD.
The knee jerk reaction to secure boot-anything from the technical community has been generally "No!", "It's a trap" etc.
Re: Hard drive hack provides root access, even after reinstall
#20[deleted]