Not Only the NSA Knows How to Make Unerasable Malware
Hacking tools that burrow inside hard disk drives could also be made by nongovernment hackers.
Over the weekend Russian security company Kaspersky described a suite of extremely sophisticated hacking tools that since 2008 have been used to infiltrate government, military, and corporate computers in 30 countries around the world. Reuters reports that it was the work of the U.S. National Security Agency.
Kaspersky’s most striking finding was that the toolkit of what it calls the Equation Group could inject malware into the software embedded inside hard disk drives. Not only is that “firmware” invisible to conventional security software, but malicious code hidden inside it can emerge to take over a computer even after its hard disk has been carefully erased. Costin Raiu, a researcher with Kaspersky, told the New York Times that the technique rendered investigators like him “practically blind.”
That impressive trick sets a new bar for the sophistication in malware caught in the wild. And it has led to speculation that the NSA had assistance from hard drive manufacturers, for example by getting access to details on how their firmware worked.
This story is only available to subscribers.
Don’t settle for half the story.
Get paywall-free access to technology news for the here and now.
Subscribe now
Already a subscriber?
Sign in
You’ve read all your free stories.
MIT Technology Review provides an
intelligent and independent filter for the
flood of information about technology.
Subscribe now
Already a subscriber?
Sign in
But despite suggestions it would be “just about impossible” for even the NSA to reverse-engineer hard drive firmware without such help, it appears to be well within its reach—and that of many others, too. In recent years hackers and researchers with budgets far smaller than the NSA’s have reverse-engineered the firmware of hard drives and other devices and demonstrated their own “invisible” malware.
That raises the prospect that multiple national intelligence agencies—and perhaps even groups without government backing—could be using the technique. Few, if any, security researchers are on the lookout for such attacks because they are essentially invisible.
Anyone looking to get started hacking hard drive firmware would be well advised to start with this page on the subject from prolific hacker Jereom Domburg. In 2013 he gave several talks on his research and showed how it enabled him to remotely take over a server with a hard disk made by Western Digital, a leading manufacturer whose drives were also targeted by Equation Group.
Also in 2013, academic researchers independently went even further and developed several proof-of-concept attacks against a hard disk from a different manufacturer. They showed how a disk’s firmware could be infected remotely, and made a system to communicate over the Internet with the unerasable malware to send commands and copy data such as encryption keys. This line from the academic paper’s summary has gained new plausibility after what we learned over the weekend:
“The difficulty of implementing such an attack is not limited to the area of government cyber-warfare; rather, it is well within the reach of moderately funded criminals, botnet herders and academic researchers.”
At the Black Hat security conference last summer, two researchers described how they had reverse engineered the firmware of USB sticks to hide code inside that can silently take over a computer.
A year earlier at the same event, another researcher showed off proof-of-concept malware that could hide inside a computer’s BIOS chip, which springs into action to get the operating stem ready when you press the power button. That malware could even back itself up inside the firmware of a computer’s other components, such as the network card, so as to restore itself to the BIOS chip if its firmware was for some reason cleaned up (see “A Computer Infection That Can Never Be Cured”).
None of these researchers’ attacks were easy to develop, or even proved in real-world attacks. And the skills needed to create such things aren’t as widespread as those needed to, say, hack a computer using an e-mail attachment. But they surely exist in places beyond the U.S. government.
Kaspersky’s report has likely inspired all kinds of people to think about hacking the firmware of hard disks and other computer components. Hopefully some of them will work to develop fixes and defenses.
