4

I've just bought a new (unused) external HDD. Should I format it or is it save to use it directly?

Did it already happen that a device was infected before the first customer use?

Will formatting delete every possible malware? If not, what else should I do?

(In case it matters: I have a Ubuntu Linux system)

4

According to Kaspersky, even if you format your hard drive, an infection could be persistent if it lies in the firmware.

If you expect to be targeted by those with access to firmware-based malware, it may be far safer to flash the firmware yourself with a trusted copy of your hard drive's firmware, and then format it.

UPDATE: Regarding the USB drive being scanned and formatted, that doesn't matter if there's an issue with the USB stick's firmware. Bad USB comes to mind. Your anti-virus suite is not likely to be able to scan the firmware. If I'm wrong, I'd love to know.

UPDATE 2:

I'd like to answer some of your questions here.

Did it already happen that a device was infected before the first customer use?

Yes, it's being referred to as Supply-Chain Interdiction. What this means is that when you buy computers, or computer hardware online, and you're targeted, it may likely come pre-installed with malware.

(In case it matters: I have a Ubuntu Linux system)

That doesn't matter much. "Hacking Team," a company that develops malware for use by anyone who can pay, states that they have support for the top-5 distros on DistroWatch. If you visit distrowatch, you can see that the top 5 are as follows:

  1. Mint
  2. Debian
  3. Ubuntu
  4. openSUSE
  5. Fedora

Which could easily mean that anything based on those distros are likely affected as well.

Finally, as I've said before -- if you're really worried about being targeted -- I suggest acquiring a copy of your hard drive firmware and flashing it, then formatting it.

  • 3
    This is pretty overkill, but sweet. – Gene Dela Rosa Oct 14 '15 at 14:17
  • So, formatting helps in some cases but definitely not in all. Is that what you're saying? What if I don't expect to be targeted? – Martin Thoma Oct 14 '15 at 22:34
  • 2
    If you're posting on this site, you're probably already targeted. – Mark Buffalo Oct 14 '15 at 22:46
  • Formatting helps in cases where the malware is not persistent. When you have malware that is persistent, you'll need to do some flashing. But even that may not help, as you may also have a persistent BIOS infection that reinfects you. – Mark Buffalo Oct 15 '15 at 12:59
0

In my company every new USB Flash Drive is scanned on a special computer before it is used. It could be possible that someone opened the package and copied malware on the Flash Drive.

Formatting will delete everything on the disk. But when you connect the HDD or the USB Flash Drive to your computer the malware can already be executed.

  • That does not have to be successful actually. I assume you scan and wipe only the disk space. However, there is space on the disk which the control might keep in reserve and thus will also not scan for you there, after all that space is supposed to be empty. Even worse, disk controllers can be manipulated directly and/or malware side-loaded on the controller storage. You are certainly not scanning that. – Zonk Oct 14 '15 at 14:57
0

Theoretically (and practically) speaking, almost everything new you buy for your machine -even when you buy a mouse it can be infected (Netragard’s Hacker Interface Device (HID))- can be a vector of infection.

As when it comes to HDDs, the answer is the same. And yes, it already happened; you may read this report of Kaspersky dated February 2015 EQUATION GROUP: QUESTIONS AND ANSWERS (it is not about a simple virus but a fully fledged spyware, which can be worse)

I do not know if you ask this question because your machine is already infected, but you have to think abouth the persistent BIOS infection before buying a new HDD.

It is not common that a HDD is pre-infected when bought new, but if it happens, as in the report I mentioned, there wouldn't be much you can do about it (Government Destroys $170k of Hardware in Absurd Effort to Stop Malware)

0

if you want to clean your hdd completely, you should verify the presence of the DCA and HPO areas on your disk.

http://www.forensicswiki.org/wiki/DCO_and_HPA

HPA and DCO areas are hidden areas from users, OS or BIOS. They are used, for example, by manufacturers to store some analyse tools like saves of the boot sectors or tools for re-installing the OS. Moreover, the DCO can be used to set arbitrarily the size of their HDD by defining the number of sectors. But you can use these areas to hide datas.

However, as these areas ar not seen by the OS or the BIOS, when you want to analyse or format your HDD, you won't access to these areas. It's a problem when you do forensics operations, because when you will do an image of an HDD you will not copy them. So, before making a copy or a format of your disk, you should verify the presence of these zones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.