Hacker News Reader

Comment by guard-of-terra | Hacker News Reader

I'm not an expert but I imagine any bit of code you put into firmware will target very narrow configuration of other software on the PC, will be pretty fragile and susceptible to bit rot.

To be able to routinely steal something from the PC it will need to be tailored to specific configuration.

Am I wrong?

View on HN

The Kaspersky report[1] states that GRAYFISH (which contains the HDD firmware reprogramming code) works on Windows NT 4.0, 2k, XP, Vista, Windows 7 and Windows 8, in both 32-bit and 64-bit builds. One can't help but to be impressed.

[1] http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/f...

Targeting one firmware is very narrow. Targeting different firmwares from 12 different manufacturers has a pretty good chance of being successful on any give target, and that's what they are doing. They have to keep up as new hard drive models come out, but that's what they are being paid for.

Yes, completely. You can read the technical report here: https://securelist.com/files/2015/02/Equation_group_question...

The firmware malware is mainly to create hidden, unremovable, persistant space on the drive, and likely hijack the boot process. At that point it passes off to other malware.

I don't understand what do you mean by "bit rot". Bits don't rot like vegetables. They could last just fine for centuries, specially in protected, privilege parts of memory were firmware stays.

NVDIA driver is the same for all cards.

Tablets and smartphones are very homogeneous and the most widely used, Apple's totally closed source, including the hardware.

Most people use Intel processors.

Any of those vectors are very easy to target if you have the hardware and software source code.

It's in wikipedia under "software rot".

The problem is, firmware is pretty small. You can't fit much function there.

Or it was; I imagine modern hard drives might have many megabytes of firmware which allows for pretty sophisticated hacks.

Firmware also operates on an extremely basic level, it's not suffer the same usability/compatibility like normal end users software.

Once it needs to communicate via network, it needs a gateway into normal user software somehow.

Ditto for accessing the file system.

I think that is even possible to do at a low level, see how they embed encrypted packets within other packets to sneak out of a network undetected [1]. Even if this technology only lasted 10-15 years that is a LONG time to have the upper hand.

[1] http://www.jwz.org/blog/2015/02/ip-over-avian-carriers-nsa-e...

Sending/receiving an UDP packet is not difficult, even on low level. Knowing what filesystem lies above, implementing some crawler (aka search) is no rocket science too. Combine these two techniques, add some simple command protocol and you have access to any file on a targeted device.

Hard drives and SSDs have more storage capacity than is actually presented to the OS, mostly for remapping bad sectors, possibly for storing internal metadata for the disk's operation. A malicious firmware could use that unmapped storage capacity to store larger, more versatile payloads.

I fail to see how it's relevant here, but physical bits certainly do rot.

This is known as bit rot, data rot, data decay or data degradation.

See https://en.wikipedia.org/wiki/Data_degradation#Decay_of_stor...

This is not the sort of "bit rot" that the parent was referring to.

It will target as wide a group as possible. It`s just a small backdoor, that lets the agency that should not be named to install a full rootkit at will.

I imagine you can do that. Some 512-byte sequence that triggers boot sector overwriting with whatever comes next.

Reply on news.ycombinator.com