4

Right now I have a backup setup which involves a 3.5" external USB-HDD with a seperate power-supply (as is usual for such drives). This HDD is internally a standard SATA HDD with USB+Power wrappers.
This HDD is always connected via a data connection to my PC from which I do the backups, however the power is turned off at the drive using a mechanical switch. The power cord is supplied with power and is plugged in (so the drive is only a single switch flip away from operation).

Can malware disable the functionality of a typical implementation of such a hardware power switch while the HDD is connected to the PC?

Formulated differently: Can malware effectively make the HDD "always powered" even though I flipped the mechanical switch to "off"?

  • Probably not, but it may depend on the actual drive. What kind of data connection is it? IDE, SATA, USB…? – Ángel May 5 '16 at 19:04
  • @Ángel It's it's an USB 3.0 connection externally (+ extra power supply) and internally this is mapped onto a standard SATA drive. – SEJPM May 5 '16 at 19:07
  • Man, it's nice to see all three of us say the same thing XD I guess now you can be fairly confident about which case – Robert Mennell May 5 '16 at 19:20
  • @AndréBorie the HDD us internally a desktop grade HDD (have you ever seen a laptop grade 3.5" drive?) – SEJPM May 6 '16 at 7:07
5

No. The power switch is almost always a mechanical device which cuts off the incoming power from the logic board. When it is off the connection is physically broken - a complete airgap. Malware cannot subvert this.

The only case that malware might be able to bypass a "power off" state is when the state is soft, e.g. standby. The device would have to leave its processor (either microprocessor or microcontroller) running, potentially in a low-power sleep state, with the USB interface live. Depending on the implementation, malware could potentially trigger a wake event through the USB, though it'd be device-specific and highly targeted / unusual.

  • I hope to gosh it's not a powered disconnect switch(really though those are more used in industrial control systems, but I ran into a HDD enclosure that used one). Those toggle switches can be thrown to the other state based on power flow. Talk about confusing -.- – Robert Mennell May 5 '16 at 19:15
  • I suppose if it's it's a smart UPS (meaning there's some microcontroller inside of it, and the UPS is connect to the PC via USB for monitoring and such), then a developer could possibly find an exploit in that specific model, flash new firmware, and go about it that way. – user64273 May 5 '16 at 21:43
  • @Zymus Or just that there's a wake function, or even a power reset function accessible during sleep mode. Wouldn't be the first time I've found weird functionality exposed to users via driver IOCTLs. – Polynomial May 5 '16 at 21:47
2

Depends

Okay so how those switches work depends on the installation of decision of the external drive manufacturer, so we need too look at a few cases:

  1. Switch controls the connection of power to the device entirely and uses air gaps
  2. Switch controls a circuit that is overseen by the mobo/firmware and is just a serial connection. Wake from USB is possible with these HDDs

What gets worse is that there are HDDs out there that combine the two switch types. In that case as long as you know which one is the actual hard disconnect from power, you have a case 1.


Case 1:

No, firmware cannot do that because this is a circuit not overseen by the internal chips


Case 2:

Yes, firmware can do that because the chip really just checks that state of that switch, and it can be awoken remotely.

If it's case 2, it is entirely possible to get a firmware on it that just ignores that switch signal entirely, but that's an incredibly direct attack, and at this point you have more problems to worry about.


Testing which case

Can your HDD be woken up remotely by the computer when this switch is flipped?

  • Yes: Case 2
  • No: Case 1

Being certain

To be absolutely sure though, you can just unplug the USB when you're not using the drive to prevent that from happening in either case.

2

Maybe

If the only power to the external drive comes from the power cord, and it is physically isolated, then no. The malware wouldn't be able to switch it on.

However, it is also possible that the drive is able to receive power from the USB connector and, while this is not guaranteed to power it (and thus an external power supply was needed), under the right circumstances (powerful power supply at your computer, not too many peripherals connected, the external drive not needing much energy…) it might be.

Additionally, please note that you are assuming that any compromise of the backup pc would be detected intermediately (eg. the malware won't wait for you to connect the external drive for deleting/encrypting its files and also the rest of the computer). Try keeping a separate backup, too.

  • Well, this is my on-site backup and you'll have the same problem with literally any on-site backup solution. In the end every on-site solution can be broken be it an external drive or a NAS. But I also have an encrypted off-site backup at a popular cloud service provider. – SEJPM May 5 '16 at 19:24
  • @SEJPM Treat it as a warning for people that may think that it will solve all problems. If you already have an off-site backup, you're covered (as far as you don't forget the off-site password keys 😉). – Ángel May 5 '16 at 19:27
1

This is an excellent question. While the obvious answer would be no, there are caveats.


"Mechanical switch" is an ambiguous term. Let's assume for a moment that a mechanical switch is one that is actuated by a broad movement (as opposed to pressure).

Let's take a look at a typical PSU switch:

A psu-style switch

See those thick prongs? The electrical current that powers the device actually flows from those, and turning the switch off is very much equivalent to unplugging the cable from the wall power socket.

A pc case power button, on the other hand, looks very different internally:

A pc case button

Those thin wires? They don't actually carry any current (that powers the device). Your computer is, in fact, powered all the time, and the switch just tells it to "turn on". This is also known as "on standby" and "soft-off".

The fact that the power switch moves or stays in place is completely irrelevant. What matters is what the actual circuit connects to - and you can't see that without opening the device.

With that being said, switches like the first one are most commonly powering the devices themselves.


Now, if your hard drive switch uses a "standby" mode, and the controller of the chip has a chip that is writable and you can do it through the USB interface (as opposed to on-board headers, which would be most common) theoretically malware could overwrite the firmware with a special version that turns on/off at will.

To keep this interesting, let's for a moment ignore the fact that if the disk is ever turned on you'll be able to hear it spinning.

That malware would have to be developed specifically for your particular hard drive maker and model (and possibly factory series), so personally I don't think this is a realistic attack. It's much easier to get someone to break the window of the room the disk is in.


Of course, if your disk switch actually turns off the power, this is even more interesting. Malware certainly can't turn it back on, but it can:

  • Make your computer reboot and fake a operating system message telling you it needs to check the filesystem integrity in the external hard drive, and refusing to boot until you power it on

  • Access the files through the same mechanism your backup system is using to get them...

  • Just wait for it!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.