Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hard drive hack provides root access, even after reinstall

spritesmods.com

Post reply on HN
Print view View original

81–90 of 96 posts

Re: Hard drive hack provides root access, even after reinstall

#81

Post by burgreblast »

AsymetricCom wrote: post #77
lsc wrote: post #69

Earlier quoted context omitted.

I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. They're also working with information you won't have.

Everything worth doing isn't already done yet. I'd rather encourage others to try novel ideas and approaches. Most won't work, but a working model in this space could become a great company. (Because the potential market for smarter disk interaction is huge.)

Re: Hard drive hack provides root access, even after reinstall

#82

Post by icebraining »

sspiff wrote: post #24
achille2 wrote: post #19

Earlier quoted context omitted.

The knee jerk reaction to secure boot-anything from the technical community has been generally "No!", "It's a trap" etc.

For PC's and smartphones, which can have higher level security structures, the community is violently against secure boot. For firmware based embedded components, most people aren't so strongly opposed to it.

Not that their opinion is the community's, but the FSF is not against secure boot even for PCs and smartphones, only against "restricted boot" - that is, secure boot without giving the keys to the user.

Re: Hard drive hack provides root access, even after reinstall

#83

Post by mcpherrinm »

lsc wrote: post #69
magila wrote: post #66

Earlier quoted context omitted.

Shingled writes require a special asymmetrical write head, you can't do it with current drives. Actual shingled write drives are not yet shipping AFAIK.

I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

Ignoring the doubters, there are plenty of cases where custom drive firmware might be useful.

I read online (probably on HN or similar) that Amazon Glacier is using drives with custom firmware that keeps them spun down to 300rpm so that more drives can fit in a rack without power and cooling concerns.

That's certainly an interesting case that certainly wasn't possible without drive manufacturers stepping up to Amazon's wishes. Being able to do custom mods like this to your own disks is pretty excellent as well.

Re: Hard drive hack provides root access, even after reinstall

#85

Post by logicallee »

aray wrote: post #65
stephengillie wrote: post #60

Earlier quoted context omitted.

I especially like the idea of cannibalizing old HDDs (with bad spindles but good controllers) to become microcontrollers in new projects.

Not a bad idea, but also nearly everything we interact with, technology-wise, has microcontrollers of some form or another. The AVRs so adored by the arduino community actually exist in large volumes in automobiles, and even crappy USB keyboards and mice which we might throw out have microcontrollers in them. So I'm all for scavenging compute bits for future projects, but it is by no means unique to HDDs.

also the things cost pennies! For example the ATMEGA328 will run you a grand total of $2.88 in a quantity of 1.

Re: Hard drive hack provides root access, even after reinstall

#86

Post by nicolast »

0x0 wrote: post #53
MBCook wrote: post #45

Earlier quoted context omitted.

The DMA mentioned in the article was internal to the drive, between the hardware interfaces and it's internal cache. The drive did not have DMA access to system memory.

Even though it wasn't discussed in the article, I think firewire and thunderbolt external drives DO have direct DMA access to system memory. Google for SBP-2 and DMA, and a bunch of articles about protecting against firewire attacks against full-disk-encryption (among other things) appear.

Hence http://www.breaknenter.org/projects/inception/ and similar attacks.

Re: Hard drive hack provides root access, even after reinstall

#87

Post by mjg59 »

mrb wrote: post #37
mjg59 wrote: post #30

Earlier quoted context omitted.

In Secure Boot environments, this is all untrue - all option ROMs are signed, and the firmware should only accept signed updates. That pushes the problem out to ancillary devices that we've traditionally thought of as safe, but this demonstrates that they really need to reconsider.

I said "typical". Most desktop and server computers do not have or do not fully enable Secure Boot (or else you would not be able to plug in a random 5-year old NIC whose firmware is not signed).

Pretty much all desktop systems shipped in the past 8 months have fully enabled Secure Boot by default. Yes, this means that you can't plug in a random 5-year old NIC and PXE, just like it means you can't plug in an older graphics card and get any output before the OS starts.

Re: Hard drive hack provides root access, even after reinstall

#88

Post by baruch »

ChuckMcM wrote: post #54

This was a great read. One of the things we've done in the past is to modify the firmware of the drive to be able to give errors on command. The purpose was for testing RAID systems in real life scenarios. One can include a 'unit test' drive in a RAID array which will run through a series of known bad disk behaviours. From the simple like returning read failure, to the more complex like returning the wrong block or r…

The difference is that the enterprise storage space gets such firmware from the vendor rather than hacking it on its own. At least where I've been so far (NetApp is not included so far :-)

Before I got my hand on vendor provided error injection I would have thought this to be of great use but hacking in ARM assembly to get this would be quite a task.

Re: Hard drive hack provides root access, even after reinstall

#89

Post by baruch »

AsymetricCom wrote: post #77
lsc wrote: post #69

Earlier quoted context omitted.

I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. They're also working with information you won't have.

While this is true they are also optimizing for a wide range of operating environments. If you could reduce the size of the optimization space you could get a better result. There are many places where I could think of better behavior out of the disks, their current interface is somewhat limited and very much a black box. If you could open it up a little and maybe provide for some extra operations you could gain quite a bit.

For example, most RAID systems don't really care so much about the first error on the disk, if the disk fails to read we can save a lot of time by not retrying too much and just go to build from the RAID. If by any chance this is the second (RAID5) or third (RAID6) error than you want a much stronger retry logic. Current disk firmwares do not allow for such logic.

Re: Hard drive hack provides root access, even after reinstall

#90

Post by jrarredondo »

batiste wrote: post #17

The first hack read on hacker new I have seen for a long time.

After reading this, i know I am unworthy to comment.

However, I will be forwarding this to my wife who gives me a hard time when I, before getting rid of an old computer, remove the HD and give five or so well placed hits with a hammer on the whole HD assembly.

Post reply on HN