Malware, RAT's and backdoors

Question

Is there any kind of malware or RAT that cannot be gotten rid of by a thorough wipe with DBAN, flashing the BIOS and re-installing OS? More importantly, if you've been ratted and did all these things, is there still a possibility that the attacker created a backdoor into your system? An explanation of what backdoors usually entail and whether taking the above steps would get rid of them would be appreciated.

Answer 1

Sure it's possible. Look at the NSA ANT catalog. You'll find devices like COTTONMOUTH, which are implanted in USB connectors and allow for re-infection; DEITYBOUNCE which implants malware in a Dell server via BIOS and the RAID controller (flashing the BIOS should prevent this); GINSU which installs itself from a PCI bus device; IRATEMONK which is implanted in the firmware of certain hard drives; and IRONCHEF which replaces the BIOS (replacing the BIOS with a variant that reinfects a BIOS during the reflashing operation would be possible.) And many of their other devices, like HOWLERMONKEY, can intercept your information without infecting your system.

While it may be possible, a second question is "is it probable?" Is someone as sophisticated as the NSA digging into your computer? I don't know you, so I can't answer that. But since the NSA can do it, others have taken this on as a challenge. The NSA Playset is a collection of Open Source projects that attempt to replicate some of the NSA capabilities. SLOTSCREAMER is a PCI based attack device; ADAPTERNOODLE is a USB based attack device. They haven't replicated the hard drive firmware attacks yet, but it's on their list.