Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hard drive hack provides root access, even after reinstall

spritesmods.com

Post reply on HN
Print view View original

71–80 of 96 posts

Re: Hard drive hack provides root access, even after reinstall

#71

Post by kabdib »

Nrsolis wrote: post #36
mrb wrote: post #23

Earlier quoted context omitted.

Your typical motherboard's BIOS code is not signed. Your video card's BIOS is not signed. Your network's card firmware is not signed. Your optical disc drive's firmware is not signed. Etc. This threat vector exists with each of these devices. As always security is a trade-off. The threat vector of flashing a backdoored BIOS/firmware is irrelevant for 99% of the market: most people will never be targets of such highly…

There is another thing to consider: Adding security to a system imposes costs on the use, maintenance, and support of those systems. Can you imagine the scale issues associated with maintaining PKI over the millions of devices deployed? How about hundreds of millions? TPM is present in many, many laptops yet most IT departments leave it un-configured. Why? Because when you replace the hard drive and it changes the bo…

There's not much maintenance involved in the security of an embedded system. Once you do it, assuming you do it right, you're done.

Now, security is a process. You can expect breaches of high value hardware, and need to react to them.

The security model for consoles STARTS with the assumption that the attacker has physical possession of the hardware. This makes things interesting; it's certainly a big differentiator for PCs versus tablets, and one of the reasons why the Windows group at Microsoft has had a lot of trouble making their stuff secure on non-PCs.

But for a hard drive, things should be pretty contained. I estimated it would have taken a couple of weeks to secure one major embedded system I worked on; assuming the interfaces are limited, it's not a huge deal.

Re: Hard drive hack provides root access, even after reinstall

#72

Post by MBCook »

fragmede wrote: post #67
MBCook wrote: post #59

Earlier quoted context omitted.

I know you're right on FW. I believe DMA was designed in because they recognized that the CPUs of the time weren't powerful enough to move uncompressed full-resolution video from around. I don't know about Thunderbolt, but I'd expect you're right.

Thunderbolt is just pci-express in new clothes, so yes, it does.

Good point.

Re: Hard drive hack provides root access, even after reinstall

#73

Post by ChuckMcM »

aray wrote: post #65
stephengillie wrote: post #60

Earlier quoted context omitted.

I especially like the idea of cannibalizing old HDDs (with bad spindles but good controllers) to become microcontrollers in new projects.

Not a bad idea, but also nearly everything we interact with, technology-wise, has microcontrollers of some form or another. The AVRs so adored by the arduino community actually exist in large volumes in automobiles, and even crappy USB keyboards and mice which we might throw out have microcontrollers in them. So I'm all for scavenging compute bits for future projects, but it is by no means unique to HDDs.

The key is tools, and OpenOCD is one of them, which let you "talk" to these systems. I picked up a Black Magic probe [1] and am building cables for it to talk to one of my ARM boards. That kind of stuff makes the spelunking possible.

[1] http://www.blacksphere.co.nz/main/blackmagic

Re: Hard drive hack provides root access, even after reinstall

#74

Post by brudgers »

Great article. But what I came away from it thinking was about how much money is spent by state security institutions to prevent this sort of thing, and yet secrecy breeches at scale are the Walkers, Mannings, and Snowdens using USB sticks and DVD's and copiers.

Re: Hard drive hack provides root access, even after reinstall

#76

Post by jasomill »

0x0 wrote: post #21
yuhong wrote: post #18

Earlier quoted context omitted.

http://www.msfn.org/board/topic/128807-the-solution-for-seag... http://elabz.com/forums/electronics-repairs/list-of-seagate-...

Thanks for the links :)

While I haven't written it up anywhere, it's also fun to point out that I've had success talking to a Seagate drive by wiring the debug port directly to the TTL serial pins on the debug header of a Linksys WRT54G router.

Re: Hard drive hack provides root access, even after reinstall

#77

Post by AsymetricCom »

lsc wrote: post #69
magila wrote: post #66

Earlier quoted context omitted.

Shingled writes require a special asymmetrical write head, you can't do it with current drives. Actual shingled write drives are not yet shipping AFAIK.

I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. They're also working with information you won't have.

Re: Hard drive hack provides root access, even after reinstall

#78

Post by AnthonyMouse »

yew wrote: post #61
AnthonyMouse wrote: post #58

Earlier quoted context omitted.

You're still going to have the "who can you trust" problem. If you're worried about a compromised disk controller then you ought to be worried about a compromised BIOS or TPM too.

Ought you? Those are all different bits of hardware. One being subverted doesn't mean the others are - if nothing else, the attacker isn't likely to have a vulnerability for every combination of firmware and chip. This sort of attack is usually going to be more trouble than it's worth to execute, but that doesn't mean it's out of reach for a motivated, educated individual.

You don't need a combination, just compromising the BIOS gets you root. You don't need to separately compromise the disk firmware, it's either or.

The point is that it's the same kind of attack. Relying on the BIOS may save you from an attack on the disk firmware but that doesn't much help if the same class of attack is still effective against the BIOS.

Re: Hard drive hack provides root access, even after reinstall

#79

Post by AnthonyMouse »

munin wrote: post #68
AnthonyMouse wrote: post #58

Earlier quoted context omitted.

You're still going to have the "who can you trust" problem. If you're worried about a compromised disk controller then you ought to be worried about a compromised BIOS or TPM too.

except the TPM is explicitly designed to resist this kind of attack and be tamper-evident / tamper-proof, it's security hardware. so if someone can successfully attack the TPM, you are having a very big problem and will not go to security today.

>so if someone can successfully attack the TPM, you are having a very big problem and will not go to security today.

"That isn't supposed to happen" doesn't mean it won't happen. The Titanic wasn't supposed to sink.

The point is, you want to be able to recover from attacks. It isn't about security today. The premise here is that you've already been compromised to the point that the attacker may have been able to screw with the firmware on your hardware. What you need then is not an assurance that the thing that already happened not be very easy, what you need is a way to hard reset the hardware to a known-good (i.e. factory) state given the assumption that every piece of EEPROM in the machine has been replaced with malicious code. Having something like a jumper on the logic board that will do that in hardware would be a welcome security feature.

Re: Hard drive hack provides root access, even after reinstall

#80

Post by yew »

AnthonyMouse wrote: post #78
yew wrote: post #61

Earlier quoted context omitted.

Ought you? Those are all different bits of hardware. One being subverted doesn't mean the others are - if nothing else, the attacker isn't likely to have a vulnerability for every combination of firmware and chip. This sort of attack is usually going to be more trouble than it's worth to execute, but that doesn't mean it's out of reach for a motivated, educated individual.

You don't need a combination, just compromising the BIOS gets you root. You don't need to separately compromise the disk firmware, it's either or. The point is that it's the same kind of attack. Relying on the BIOS may save you from an attack on the disk firmware but that doesn't much help if the same class of attack is still effective against the BIOS.

Sure. My point is there's no guarantee the attacker will be able to compromise the TPM or BIOS just because they can compromise the disk controller.

I'd bet most systems see different disk controllers more often than they see different BIOS chips. I'd bet (though not at so high odds) that reasonably secure TPM chips are relatively easier to find outside of the high-end server niche. I'd bet that most non-state actors executing this sort of attack wouldn't have equivalent exploits ready for many different types of hardware.

All of those factors shift risk around (again, what little risk there is from this sort of vulnerability). Forgetting about patching a hole here because of an equal-sized hole over there is silly.

Post reply on HN