Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hard drive hack provides root access, even after reinstall

spritesmods.com

Post reply on HN
Print view View original

61–70 of 96 posts

Re: Hard drive hack provides root access, even after reinstall

#61

Post by yew »

AnthonyMouse wrote: post #58
munin wrote: post #41

Earlier quoted context omitted.

yes there is, you encrypt the OS that is stored on the hard drive edit: sorry, chain looks like this: BIOS reads boot block from hard drive, checks digital signature, signature invalid, boot fails. BIOS check for signature works in concert with TPM to do key storage, so you're fine. albeit, sleeping with 'evil' technology like UEFI and TPM.

You're still going to have the "who can you trust" problem. If you're worried about a compromised disk controller then you ought to be worried about a compromised BIOS or TPM too.

Ought you? Those are all different bits of hardware. One being subverted doesn't mean the others are - if nothing else, the attacker isn't likely to have a vulnerability for every combination of firmware and chip.

This sort of attack is usually going to be more trouble than it's worth to execute, but that doesn't mean it's out of reach for a motivated, educated individual.

Re: Hard drive hack provides root access, even after reinstall

#62

Post by switch007 »

DHowett wrote: post #31
wereHamster wrote: post #9

> Because Linux caches the shadow file (like all files recently accessed), I have to generate a lot of disk activity for the file to be 'pushed out' of the cache http://linux-mm.org/Drop_Caches $ echo 3 > /proc/sys/vm/drop_caches or as non-root $ echo 3 | sudo tee /proc/sys/vm/drop_caches

I do not believe that using sudo exactly counts as "non-root".

They meant "when not root".

Re: Hard drive hack provides root access, even after reinstall

#63

Post by Hellenion »

Florin_Andrei wrote: post #57
WestCoastJustin wrote: post #43

If you liked this, then you might like Travis Goodspeed's really cool talk about "Writing a Thumbdrive from Scratch" (for antiforensics) [1] at the 29th Chaos Communication Congress [29c3]. [1] http://www.youtube.com/watch?v=D8Im0_KUEf8

At some point, computer systems will be more like biologic systems - they will just carry a more or less permanent "flora" of parasites, that will have to be tolerated unless they become explicitly hostile. Any sufficiently complex system will exhibit this trait sooner or later.

That's an interesting way of looking at "parasitic" programs. Maybe we could even get those parasites to work for us, like trapping them as the house pen-tester. You could employ the constant barrage of attempted ssh logins as remote connectivity check or something.

Re: Hard drive hack provides root access, even after reinstall

#64

Post by lsc »

The thing that interests me, though, is the idea of modifying your hard drive firmware for better performance.

My understanding is that the effective width of the write head is 10x the width of the read head... E.g. with the right firmware, it should be possible, if you are okay with a write-once medium, to write the outermost track, move the write head in 1/10th what you'd normally move it, then write the next track, etc... and get 10x the space out of the drive you normally would. In theory, the read head wouldn't have trouble. (of course, this would be write once storage, as the effective width of your write head is still pretty huge; but for a bunch of things? I can totally work with that... if more than X% of a drive was garbage data, I copy the good data to a new drive and reformat the old one. Done.)

I hear rumors that both the major drive manufacturers are actually shipping drives with this technology, but are only selling those drives to really big players, for some reason.

Here's a reasonable reference to the 'shingle' technology, and he roadmap for the rest of us:

http://www.theregister.co.uk/2013/06/25/wd_shingles_hamr_roa...

but that's the thing, with the datasheets (and, well, a lot more skill than I personally have) we should be able to setup something like shingling on the cheap disks we have today.

Of course, from reading the article, I'm not sure I'm any closer to that particular dream.

Re: Hard drive hack provides root access, even after reinstall

#65

Post by aray »

stephengillie wrote: post #60
ChuckMcM wrote: post #54

This was a great read. One of the things we've done in the past is to modify the firmware of the drive to be able to give errors on command. The purpose was for testing RAID systems in real life scenarios. One can include a 'unit test' drive in a RAID array which will run through a series of known bad disk behaviours. From the simple like returning read failure, to the more complex like returning the wrong block or r…

I especially like the idea of cannibalizing old HDDs (with bad spindles but good controllers) to become microcontrollers in new projects.

Not a bad idea, but also nearly everything we interact with, technology-wise, has microcontrollers of some form or another. The AVRs so adored by the arduino community actually exist in large volumes in automobiles, and even crappy USB keyboards and mice which we might throw out have microcontrollers in them.

So I'm all for scavenging compute bits for future projects, but it is by no means unique to HDDs.

Re: Hard drive hack provides root access, even after reinstall

#66

Post by magila »

lsc wrote: post #64

The thing that interests me, though, is the idea of modifying your hard drive firmware for better performance. My understanding is that the effective width of the write head is 10x the width of the read head... E.g. with the right firmware, it should be possible, if you are okay with a write-once medium, to write the outermost track, move the write head in 1/10th what you'd normally move it, then write the next track…

Shingled writes require a special asymmetrical write head, you can't do it with current drives. Actual shingled write drives are not yet shipping AFAIK.

Re: Hard drive hack provides root access, even after reinstall

#67

Post by fragmede »

MBCook wrote: post #59
0x0 wrote: post #53

Earlier quoted context omitted.

Even though it wasn't discussed in the article, I think firewire and thunderbolt external drives DO have direct DMA access to system memory. Google for SBP-2 and DMA, and a bunch of articles about protecting against firewire attacks against full-disk-encryption (among other things) appear.

I know you're right on FW. I believe DMA was designed in because they recognized that the CPUs of the time weren't powerful enough to move uncompressed full-resolution video from around. I don't know about Thunderbolt, but I'd expect you're right.

Thunderbolt is just pci-express in new clothes, so yes, it does.

Re: Hard drive hack provides root access, even after reinstall

#68

Post by munin »

AnthonyMouse wrote: post #58
munin wrote: post #41

Earlier quoted context omitted.

yes there is, you encrypt the OS that is stored on the hard drive edit: sorry, chain looks like this: BIOS reads boot block from hard drive, checks digital signature, signature invalid, boot fails. BIOS check for signature works in concert with TPM to do key storage, so you're fine. albeit, sleeping with 'evil' technology like UEFI and TPM.

You're still going to have the "who can you trust" problem. If you're worried about a compromised disk controller then you ought to be worried about a compromised BIOS or TPM too.

except the TPM is explicitly designed to resist this kind of attack and be tamper-evident / tamper-proof, it's security hardware. so if someone can successfully attack the TPM, you are having a very big problem and will not go to security today.

Re: Hard drive hack provides root access, even after reinstall

#69

Post by lsc »

magila wrote: post #66
lsc wrote: post #64

The thing that interests me, though, is the idea of modifying your hard drive firmware for better performance. My understanding is that the effective width of the write head is 10x the width of the read head... E.g. with the right firmware, it should be possible, if you are okay with a write-once medium, to write the outermost track, move the write head in 1/10th what you'd normally move it, then write the next track…

Shingled writes require a special asymmetrical write head, you can't do it with current drives. Actual shingled write drives are not yet shipping AFAIK.

I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

Re: Hard drive hack provides root access, even after reinstall

#70

Post by mariusz79 »

b0rsuk wrote: post #56

That's a whole world of spying opportunities. A government could make secret deals with hard drive manufacturers. Perhaps not US government, but Taiwan government, if it makes you happier... (I'm from neither country)

Could? How do you know they didn't do it already?
Post reply on HN