Are there viruses that have managed to hide themselves somewhere other than on the hard drive? Like CPU cache or on the motherboard?
Is it even possible? Say I get a virus, so I get rid of the HDD and install a new one. Could the virus still be on my PC?
Plenty of places:
Modern hardware has a wide range of persistent data stores, usually used for firmware. It's far too expensive to ship a complex device like a GPU or network card and put the firmware on a mask ROM where it can't be updated, then have a fault cause mass recalls. As such you need two things: a writeable location for that firmware, and a way to put the new firmware in place. This means the operating system software must be able to write to where the firmware is stored in the hardware (usually EEPROMs).
A good example of this is the state of modern BIOS/UEFI update utilities. You can take a UEFI image and an executable running on your OS (e.g. Windows), click a button, and your UEFI updates. Simple! If you reverse engineer how these work (which I have done a few times) it's mostly a case of a kernel-mode driver being loaded which takes page data from the given UEFI image and talks directly to the UEFI chip using the out instruction, sending the correct commands to unlock the flash and start the update process.
There are some protections, of course. Most BIOS / UEFI images won't load unless they're signed by the vendor. Of course, an advanced enough attacker might just steal the signing key from the vendor, but that's going into conspiracy theories and godlike threat actors, which just aren't realistic to fight in almost any scenario. Management engines like IME are meant to have certain protections which prevent their memory sections from being accessed even by ring0 code, but research has shown that there are many mistakes out there, and lots of weaknesses.
So, everything is screwed, right? Well, yes and no. It's possible to put rootkits in hardware, but it's also incredibly difficult. Each individual computer has such a variance in hardware and firmware versions that it's impossible to build a generic rootkit for most things. You can't just get a generic Asus BIOS and flash it to any board; you'll kill it. You'd need to create a rootkit for each separate board type, sometimes down to the correct revision range. It's also an area of security that involves a huge amount of cross-domain knowledge, way down deep to the hardware and low-level operational aspects of modern computing platforms, alongside strong security and cryptographic knowledge, so not many people are capable.
Are you likely to be targeted? No.
Are you likely to get infected with a BIOS/UEFI/SMM/GPU/NIC-resident rootkit? No.
The complexities and variances involved are just too great for the average user to ever realistically have to worry about it. Even from an economic perspective, these things take an inordinate amount of skill and effort and money to build, so burning them on consumer malware is idiotic. These kinds of threats are so targeted that they only ever really belong in the nation-state threat model.
The short answer to your question is yes.
Here are some places where a virus could hide:
A virus could potentially target anything where there is writable data that gets treated as executable code. On a computer, that is basically anywhere. For it to survive a restart, though, it would have to be some kind of persistent storage. So the CPU cache might not be the best place to hide.
Most viruses don't do this, though, and just live on the HDD. This is because virus writers are (rationally) lazy. Why go for the complicated options when there is plenty of low hanging fruit?
dd) send totally different patterns making it easy to spot when a disk is being forensically analysed. The disk then wipes itself with a repeated pattern of the lyrics to Rick Astley's Never Gonna Give You Up.
Commented
Apr 21, 2016 at 13:28
One of most common but unchecked places is... a peripherial with "embedded driver disk", like lots of 3G/4G USB sticks. They have — technically — a hub inside, and a Generic Storage + the device itself on it. Upgrading its firmware usually upgrades a disk image mounted to the generic storage part. It's read-only from PC in regular use, but it's easily remapped as a CD-ROM with autoplay. The one I've experienced myself in 2006-2008 was a 4G stick for a local cell provider. It contained CD-ROM like storage out-of-the-box from local sale point, autoplay and torjan included =) Next firmware patch — and a storage is remapped back to HDD and no virus on board.
The main problem for any kind of storage is that the system must be willing to execute the malware. During the boot of the operating system this means it has to be somewhere as an executable, DLL, driver or similar on the hard disk. It does not need to be fully there, i.e. it can be a small loadable stuff and the rest might reside somewhere else (even in the network).
But malware can also be loaded before the OS executes. The loading of the OS is controlled by the BIOS or UEFI so if the malware is already contained in this stage it is outside the control of the OS. For one example see Hacking Team's malware uses a UEFI rootkit to survive operating system reinstalls.
Apart from that you have firmware on the network card, the graphic card, the hard disk etc and these often can be replaced. Thus some malware might hide there too and change the behavior of the system, see How the NSA’s Firmware Hacking Works and Why It’s So Unsettling.
There were a few things that came to mind when I read the question that extend beyond the scope of the example given. There are other places that a virus can be stored besides on a hard drive or even on a computer. A couple of those places would be bacteria (specifically E. coli) and your DNA.
According to some research performed cerca 2010 that proved that E. coli could not only store data (or a virus) but also offer bioencryption.
More recently, scientists have discovered that they can store up to 700TB of data in 1 gram of your DNA. The advantage would be that it's a long term storage if properly stored.
So, as the tech industry moves closer to integrating technology and our biology, they may have to look further than just our hard drive, BIOS, memory, GPU, etc.
In addition to an excellent Polynomial's answer, there are some more options:
Not sure whether any other part of computer was used by virus,but long back came across BADBIOS
What does bad bios do?
Radio (SDR) program code, even with all wireless hardware removed.
It is said to infect the firmware on USB sticks.
It is said to use TTF (font) files, apparently in large numbers, as a vector when spreading.
Apart from the above its not only virus which attacks a machine there were many types of rootkits available like PCI rootkit
In Summary the virus can be resided at bios or at any source but it requires some point of execution which lacks at hardware.
Edit after question :
As per question ,yes there were chances of virus which could transfer to ur new hdd,for instance consider rootkits like jellyfish ,but notably this cases were rare for normal end users
The answer is YES, they can hide in many other places, not only into your HDD, but also into other storage devices you have connected to your PC.
In early days, I use to have lot of issue with CD/DVD "Autorun" option in my Microsoft Windows. Virus were so capable to automatically create "Autorun.inf" into burning media and use to run and infect automatically into fresh PC when I insert affected ROM into reader.
Virus use to infect USB flash drive automatically, and spread by themselves if the flash drive is inserted into uninfected system.
These are two major areas, where your primary focus have to be.
If you have managed to remove Virus from your HDD, don't forget to check Windows Registry at these locations: (believe me I have disabled many Virus files being executed, by removing unknown entries from below locations);
Run "regedit" to open Windows Registry Editor, and navigate to check below two locations for suspicious registry entries !!
HKEY_CURRENT_USER : Software : Microsoft : Windows : CurrentVersion : Run
HKEY_LOCAL_MACHINE : SOFTWARE : Microsoft : Windows : CurrentVersion : Run
In case you are using a custom CPU working as an harvard architecture based design, a virus can inject the ROM that the instruction codes are stored in but it is a very very hard process to change a ROM value that way . Still it is an injection
On a piece of paper, which is then typed in at the keyboard (or OCRed?).
The most obvious is the EICAR test virus signature:
"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR"
"-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"
If you join the two strings together and save it as an executable file (a ".com" file on MSDOS or 32-bit Windows platforms) then any self-respecting anti-virus program is supposed to treat it in the same manner as if it were a virus. Note that this is specifically enter-able with characters that can be generated from a plain vanilla "keyboard".
