Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hard drive hack provides root access, even after reinstall

spritesmods.com

Post reply on HN
Print view View original

41–50 of 96 posts

Re: Hard drive hack provides root access, even after reinstall

#41

Post by munin »

[deleted] wrote: post #38
munin wrote: post #28

something I hadn't really considered about hard disk encryption, before reading this, is how it could protect against compromised disk controllers. if the OS encrypts the data stored on the disk, it would be a lot harder (perhaps, with the right composition, impossible) for a malicious disk controller to insert/change/modify important data (like code, or password files) stored on the computer. we think of the system…

[deleted]

yes there is, you encrypt the OS that is stored on the hard drive

edit: sorry, chain looks like this: BIOS reads boot block from hard drive, checks digital signature, signature invalid, boot fails. BIOS check for signature works in concert with TPM to do key storage, so you're fine. albeit, sleeping with 'evil' technology like UEFI and TPM.

Re: Hard drive hack provides root access, even after reinstall

#45

Post by MBCook »

im3w1l wrote: post #32
munin wrote: post #28

something I hadn't really considered about hard disk encryption, before reading this, is how it could protect against compromised disk controllers. if the OS encrypts the data stored on the disk, it would be a lot harder (perhaps, with the right composition, impossible) for a malicious disk controller to insert/change/modify important data (like code, or password files) stored on the computer. we think of the system…

Maybe I misunderstood, but didn't the harddrive have direct memory access (DMA)?

The DMA mentioned in the article was internal to the drive, between the hardware interfaces and it's internal cache. The drive did not have DMA access to system memory.

Re: Hard drive hack provides root access, even after reinstall

#46

Post by testbro »

gabriel34 wrote: post #27

Could this attack compromisse dedicated/rent servers? If so, the attacker could rent, install the exploit on the hardware and terminate the contract. What about cloud servers? Sure there are virtualization layers, but can't those be breached? If so that would pose imense danger given the distributed nature the hardware exploit could render the entire farm vulnerable

The attack could compromise other servers yes. I think the scenario you describe is a possibility, although there are some technical feats that would make wide-scale exploitation difficult - you need to know what you want to modify ahead of time which would be difficult.

Virtualised environments that don't pass the vendor specific commands should be immune to the attack though. As others have said, encryption would probably allow tampered pages to be detected. I'd be interested to see if the modified firmware could ignore new firmware...

Re: Hard drive hack provides root access, even after reinstall

#47

Post by mindslight »

AsymetricCom wrote: post #44
batiste wrote: post #17

The first hack read on hacker new I have seen for a long time.

What? You don't consider "growth hacking" real hacking?

That depends if you're just buying the pills from the spams or going to the hardware store and building your own pumps etc.

Re: Hard drive hack provides root access, even after reinstall

#48

Post by maqr »

WestCoastJustin wrote: post #43

If you liked this, then you might like Travis Goodspeed's really cool talk about "Writing a Thumbdrive from Scratch" (for antiforensics) [1] at the 29th Chaos Communication Congress [29c3]. [1] http://www.youtube.com/watch?v=D8Im0_KUEf8

Travis Goodspeed is one of my favorite bloggers. Definitely worth checking out if you like this kind of stuff: http://travisgoodspeed.blogspot.com/

Re: Hard drive hack provides root access, even after reinstall

#49

Post by kabdib »

fragmede wrote: post #22
kabdib wrote: post #13

My knee-jerk reaction was, why didn't WD sign the code and use on-chip fuses and a secure boot path to verify the code before transferring control to anything outside their boot ROM? (Many ARM-based systems-on-a-chip are capable of doing this). Adds cost, for one thing. But you can arrange for the unit to never run a byte of code (even one loaded from the platter) that didn't come from WD.

Good question; how well's that working out on the iPhone?

The iPhone is a /lot/ more complex than a disk drive, with a bunch more ways to talk to the world. (Also, I don't know if the iPhone has a secure boot ROM. It might, whereupon Apple blew it somewhere else).

This stuff /is/ hard. I sat next to a bunch of folks doing this on a console platform and the techniques and exploits were, in a word, breathtaking. But if you know what you're doing and your scope is limited -- to a smallish device, for instance -- you can make it very hard for someone to crack.

Re: Hard drive hack provides root access, even after reinstall

#50

Post by magila »

kabdib wrote: post #13

My knee-jerk reaction was, why didn't WD sign the code and use on-chip fuses and a secure boot path to verify the code before transferring control to anything outside their boot ROM? (Many ARM-based systems-on-a-chip are capable of doing this). Adds cost, for one thing. But you can arrange for the unit to never run a byte of code (even one loaded from the platter) that didn't come from WD.

The latest generation of SAS enterprise drives do exactly this. All firmware is signed and there is extra hardware to ensure unsigned code is never run. They also disable the JTAG port before the drives leave the factory so there's no opportunity for shenanigans.

These features are required by enterprise customers to prevent just this sort of tampering.

Post reply on HN