Hacker News Reader

Comment by TeMPOraL | Hacker News Reader

Old storage media (floppies, CDs) have a big advantage over new ones (SD cards, USB sticks, hard drives) - they don't have firmware. Most people didn't notice how over the last decade or so we've moved from having a computer read out data directly from a removable medium to having two computers talking together over a low-level, high-privilege protocol. While there are many benefits to this evolution, it also opens up many serious attack vectors.

View on HN

Along the same lines, you can visually inspect them. Now, perhaps there's a way to hide some sort of wafer-thin wireless reader and transmitter in a floppy disk that can somehow harvest enough electrical energy to be useful, but that's a long shot.

As for SD cards, ones that are more than just storage (e.g. with wireless technology embedded) already exist.

Even if you could hide a wireless reader and transmitter in a floppy disk, you would still be able to pick it up on X-ray. It would be very difficult to differentiate an SD card with a malicious payload even if one X-rayed it.

Would X-rays corrupt the data on the floppy disk? Honest question, I have no idea.

I think the answer is no. You have to have a magnetic field to induce changes on a floppy (don't get them near a magnet). An x-ray would require a curved flow to generate a magnetic field (think electromagnet) so the generally direct x-ray flux should be harmless. Of course the equipment and power requirements may make it difficult to avoid magnetic fields. Not an x-ray expert.

My father worked for a very long time on traffic signal systems, and a lot of their old technology was a simple EEPROM chip which they wrote a program for the signals, burned to a chip that costed a pittance, and that was it. I remember him telling me when they changed to a new system based on (i think) PCMCIA interfaces and the complexity of deployment and cost were magnitudes greater for no real benefit.

If its an embedded system and the cost and work of supporting it is less than the cost and deployment of a new system, whats the point in updating it?

>If its an embedded system and the cost and work of supporting it is less than the cost and deployment of a new system, whats the point in updating it?

The problem is support and maintenance. Things wear out eventually, and if you can't get the parts to fix them any more, then your whole system fails.

This really shouldn't be a problem with EEPROMs, however; I'm pretty sure you can still buy those, and the programmers for them too. But 8" floppy disks, and the drives to read them, are another matter.

That's true but not why they use them. You can easily restrict the interfaces of many forms of media where firmware is hardcoded in ASIC as a state machine or restricted at interface points. The military also has systems available to do exactly that from Rockwell-Collins, General Dynamics, etc.

Nah, this is a scary example of critical capabilities depending on legacy hardware people might not dven make that they're afraid to replace. Sandia at least modernized some of our nuclear system. They need to deal with this, too.

Reply on news.ycombinator.com