Hard drive hack provides root access, even after reinstall • Hacker News Board

Re: Hard drive hack provides root access, even after reinstall

#91

Post by kabdib » Sat, Aug 03, 2013, 6:09 PM UTC

0x0 wrote: post #52

Nrsolis wrote: post #36

Earlier quoted context omitted.

There is another thing to consider: Adding security to a system imposes costs on the use, maintenance, and support of those systems. Can you imagine the scale issues associated with maintaining PKI over the millions of devices deployed? How about hundreds of millions? TPM is present in many, many laptops yet most IT departments leave it un-configured. Why? Because when you replace the hard drive and it changes the bo…

Come to think of it, isn't this how Xbox (360?) piracy protections were breached for a long while? People were flashing hacked DVD-ROM firmwares to make burned discs appear like legit ones.

You had to duplicate some key material, IIRC. Also, not as trivial as you might think.

This lets you play "backups" of games, enabling piracy. It doesn't let you run unsigned code (those required other cracks) or sign anything (such as save files).

Re: Hard drive hack provides root access, even after reinstall

#92

Post by x0054 » Sun, Aug 04, 2013, 5:36 AM UTC

This is some hard core hacking! Love it! First, as others mentioned, this is why you should always encrypt your os drives. Second, it also got me thinking, how many other devices are open to this kind of attack. Like a network switch, perhaps? Say you buy 100 network switches, alter the firmware to call home and maybe even load a Linux instance, and then resell them on amazon, eBay, or even better, give a "good" cash deal to some local IT company. Then you just seat back and wait for your 100 bots to call home for their new business class Internet homes.

Re: Hard drive hack provides root access, even after reinstall

#93

Post by graue » Sun, Aug 04, 2013, 5:59 AM UTC

wereHamster wrote: post #9

> Because Linux caches the shadow file (like all files recently accessed), I have to generate a lot of disk activity for the file to be 'pushed out' of the cache http://linux-mm.org/Drop_Caches $ echo 3 > /proc/sys/vm/drop_caches or as non-root $ echo 3 | sudo tee /proc/sys/vm/drop_caches

In the attack scenario here, the author doesn't (yet) have root access.

Re: Hard drive hack provides root access, even after reinstall

#94

Post by fiskfiskfisk » Sun, Aug 04, 2013, 10:41 AM UTC

MBCook wrote: post #59

0x0 wrote: post #53

Earlier quoted context omitted.

Even though it wasn't discussed in the article, I think firewire and thunderbolt external drives DO have direct DMA access to system memory. Google for SBP-2 and DMA, and a bunch of articles about protecting against firewire attacks against full-disk-encryption (among other things) appear.

I know you're right on FW. I believe DMA was designed in because they recognized that the CPUs of the time weren't powerful enough to move uncompressed full-resolution video from around. I don't know about Thunderbolt, but I'd expect you're right.

IIRC DMA was designed to allow peripherals (floppy drives, parallell ports, etc.) to move data from their input lines to regular memory without having to bother the CPU. Uncompressed, full resolution video wasn't too much of a real concern back in the days of the 80286 :-)

Re: Hard drive hack provides root access, even after reinstall

#95

Post by lsc » Sun, Aug 04, 2013, 10:01 PM UTC

AsymetricCom wrote: post #77

lsc wrote: post #69

Earlier quoted context omitted.

I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. They're also working with information you won't have.

>I'm sure the people who make the drives are trying to get as much performance as possible from the firmware.

Huh. I think it's fairly common that companies engage in price discrimination by producing a lot of the same hardware, then crippling the hardware sold to the lower-end. Note, my example of hard drive manufactures doing this has to do with the next bit of your quote:

>They're also working with information you won't have.

So the 'crippling' I whine the most about is the difference between 'consumer' and 'enterprise' hard drives.

If you aren't running a hard drive in a raid, if it's just one drive in a desktop, generally speaking, if there's a problem? you want the thing to keep retrying, if there is any chance at all that it might be able to resolve the problem.

If it's just one drive in a desktop, it's almost always best to do something that will make the drive go slower than to cause the drive to fail.

My situation? where drives are sitting in a RAID? almost the exact opposite.

So yeah; me? I spend twice as much money to get "enterprise" drives that are almost identical, mechanically, but come with slightly better firmware. Firmware that just fails, rather than waking me up in the middle of the night.

(A friend of mine has been telling me: "Luke, a hung drive is just a special case of a slow drive; You need to monitor read/write latency and proactively fail slowish drives. check out blocktrace" - and he's probably right.)

Note, WD has TLER, which they say you can change with WDTLER.exe. In my experience? works on about half the drives you try, and even then those drives are far more likely to get slow (but not completely hang) than an 'enterprise' drive.

Now... let's talk about bad sectors. Filesystems have been handling bad sectors, well, for most of my life now. they can do it fairly well.

The problem with letting the firmware handle bad sectors is that the OS doing read/write reordering assumes that if you write sector 559 560 561, those are physically sequential. Once the hardware firmware remaps sector 560 off into the fucking boonies, my nice sequential read is now completely fucking random... and way slower. My point is that something like ZFS can handle bad sectors way better than the drive firmware, because it's got a lot more information. A lot more information in the case of read errors... all the firmware can do is hang you up retrying; the RAID layer could actively grab that block from another drive.

So yeah, they have information I don't have... and my computer would go dramatically faster if I could have that information. My pager

Re: Hard drive hack provides root access, even after reinstall

#96

Post by baruch » Wed, Aug 07, 2013, 2:22 PM UTC

lsc wrote: post #95

AsymetricCom wrote: post #77

Earlier quoted context omitted.

I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. They're also working with information you won't have.

>I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. Huh. I think it's fairly common that companies engage in price discrimination by producing a lot of the same hardware, then crippling the hardware sold to the lower-end. Note, my example of hard drive manufactures doing this has to do with the next bit of your quote: >They're also working with information you…

From what I know when a drive "reallocates a sector" it actually reallocates a track or something very close to that. So that at least for the rotational sequencing the performance will not change that much. Ofcourse, the track that used to be just one track seek away now became further off.

There are also several places along the way where reallocations go to and the drive tries to find the closest one to the reallocated tracks to avoid too large seeks.