8

I recently responded to an incident of supposed malware infection. The symptoms were simply, "My computer freezes at random times." The response ended with replacement of the physical hard drive and re-imaging the machine.

Later, I forensically imaged the 'broken' hard drive and have ran several malware detection scans with no hits (just two simple tracking cookies). I'm not much of a hardware guy but it does seem the physical HDD was just worn out (it is over 6 years old).

This experience leads me to the question of whether a virus or other malware can physically damage a hard drive. I know of Stuxnet but am unaware of - shall we say - consumer grade malware. Can anyone point me to resources that explain the feasibility and challenges involved with physically damaging a hard drive from malware?

Improve this question
3
  • 1
    Highly unlikely; the reimaging is probably what fixed the system, not the replacement of the physical hard drive (although the newer hard drive being faster probably didn't hurt). Stuxnet operated on (essentially) hardware with programmable firmware; hard drives are not as flexible and therefore are harder to abuse. I don't have resources to back that up which is why this is a comment rather than an answer :)
    – gowenfawr
    Commented May 13, 2014 at 13:40
  • At first, I did reimage the machine (after a virus scan) and it still 'froze'. However, in my opinion, it is still possible that malware 'broke' the HDD -not probable, but possible. (also, the new HDD speed and capacity made the client happy;)
    – Matthew Peters
    Commented May 13, 2014 at 13:44
  • Personally I think this looks in an unproductive direction. All devices have a failure point and are acknowledged to have a "mean time before failure". I'm not surprised that a 6 year old drive failed. There are physical parts in there that move a lot and just wear out.
    – baldPrussian
    Commented Nov 17, 2017 at 16:01

3 Answers 3

Reset to default
5

You can definitely brick a HDD or SSD by flashing it with incorrect or corrupt firmware. Most drives will accept firmware updates while in use.

Of course a sufficiently determined person can probably repair the damage, but in most cases this would be written off as a drive failure and the drive replaced.

Improve this answer
5
  • 1
    Is there malware that does this?
    – Matthew Peters
    Commented May 13, 2014 at 14:09
  • 6
    @MatthewPeters I've never heard of them before but it's really easy to do, just copy hdparm's source code (which has support for updating firmwares) and that's it. But malware are usually done for a financial profit (adwares, spambots, stealing bank data) or stealing personal information (session cookies, passwords, etc) and need to be undetected for as long as possible. I don't see the point to just damage the HDD of a compromised system when you have root access and can do much more (since updating the fw requires root).
    – user42178
    Commented May 13, 2014 at 16:42
  • There could be many reasons for doing it albeit not really that common. I wonder if there are hacks/exploits to update/corrupt firmware without root access (or while booting)?
    – Matthew Peters
    Commented May 13, 2014 at 16:53
  • @MatthewPeters you'd need to be able to "talk" on the SATA port and send raw commands there, so it depends on the host OS and its SATA drivers.
    – user42178
    Commented May 14, 2014 at 10:07
  • Is there Malware that does this? Malware now is most often generated by organized crime with the goal of making a profit. The only people that this really would benefit would be hard drive manufacturers, and then only if they wreck other manufacturer's hard drives. If someone has skill to make hardware calls, they'd make more money by selling that skill than writing malware to just act maliciously. Answer is: it's technically possible but I really doubt that such a thing exists for the reasons above,
    – baldPrussian
    Commented Nov 17, 2017 at 15:58
2

I don't know about firmware updates that brick a drive. Maybe for SSD? Damaging a disk by excessive reading and writing should result in damaged sectors, which the OS should be able to detect.

Malware could result in overheating, but I think a harddrive won't suffer the most. And you should notice the noise.

As the others suggested, the drive is probably finished. It could be a cable or connector, but more likely the drive is EOL.

Improve this answer
2
  • Assuming the computer is in use, a performance change of the magnitude required to overheat or 'over spin' should be noticed and reported before permanent damage is done. Is there any malware that targets an HDD specifically -or is this even possible/feasible?
    – Matthew Peters
    Commented May 13, 2014 at 15:14
  • I have no idea if this is possible. Again, it easier to overheat the CPU or GPU while slowing down the ventilator, or similar stuff. If you want to destroy a harddisk, it's much easier to delete essential files, or encrypt pictures and documents. Maybe your question is just curiosity, but your problem is 99.99% failing hardware, and not because of malware.
    – SPRBRN
    Commented May 14, 2014 at 7:27
1

As you've already suggested the likelihood is that it's an end of life HDD failure. That said there are a few reasons why malware can cause excessive read / writes which could lead to a HD failure. Cyptolocker for instance could lead to excessive disk IO which could result in failure (it can sometimes be diagnosed by strange read/write activity!) and even some anti-virus programs could do the same trying to clean up a persistent threat. Outside of malware, indexing can also be an issue (http://www.sevenforums.com/performance-maintenance/94862-constant-100-hdd-activity-light.html).

I would strongly suggest, however, that this is probably just the device reaching end of life. I've had the same problem on multiple occasions and if you can't find anything with commercial AV tools then it's much more likely to be a faulty hard drive than advanced malware! (unless someone with a very large intelligence budget is interested in your data!)

Improve this answer
2
  • Is there a specific type of malware that attempts to essentially over work the hdd? I would think this would have to make an irreversible effect quickly else, people will get it fixed long before severe damage occurs. I'm not a hardware guy, but is there an exploit to perhaps 'overclock an hdd'?
    – Matthew Peters
    Commented May 13, 2014 at 13:55
  • While this is theoretically possible, I haven't seen anything in the wild which uses this specific vector. As Colin mentioned it's more likely that malware would just corrupt the data itself or flash the firmware itself to make the drive unreadable. I think drawing too many parallels between over working an HDD and overspinning centrifuges (a la Stuxnet) is probably unlikely.
    – user46501
    Commented May 13, 2014 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .