1

I heard that researchers found some external hard drive with embedded backdoor (into the firmware).

I don't know if an external hard drive backdoor can be executed only by using a generic driver.

My main thought is that if the OS wants to read a file from the hard drive, the firmware will respond with the embedded backdoor code.

Is this possible?

  • The most famous example is NSA disk firmware hack. The attack is however more tricky for an external hard disk though as the user must run a file from the disk with high-enough privileges. – billc.cn Aug 12 '16 at 13:16
1

Possible: Technically yes.

Let me state it this way: I got some hardware and I can do with it whatever I want. I them give or sell it to you with it configured to perfectly act like an external hard drive.

Would you be surprised if it had an undocumented command which would give me access to the data?

I am guessing we both agree that the answer is: No. Ofcourse we could not be surprised.

That leaves generic drivers. I also see not problem there. The generic driver will support all the normal commands, and we could for a combination of them and trigger on that. E.g. if someone reads sector 3, 14, 15, 92, 65 and 35 and thus this 42 times with a delay of at least 5 seconds between sector reads. (or make up your own unlikely access pattern, maybe using a special value when setting a system protected area or anything else a normal user would be unlikely to do).

That means we have extra capabilities ont he drive and a way to trigger them, causing the drive to do whatever we want. Which could include returning the entryption password of the drive, or the raw data written to a sector.

Thuis the answet to the question: Is this possible? is a big yes.
Which is not the same as is this likely. But technically: sure, it is possible.

  • Such a scenario requires a malware for example to initiate the access pattern. I mean, I don't see any risk if you buy an external hard drive with embedded backdoor. If you are careful and you are able to not download any malware, nothing will trigger such pattern. Can you confirm that? Do you know another scenario which do not require a second action? – Duke Nukem Aug 12 '16 at 15:13
  • The malware could have a build in clock and trigger on a certain date. E.g. from changing from USB mass-storage to USB-hub with attached USB keyboard and USB pen drive. There are already devices out there which can do that. But once again: nice theoretical setup, but nothing I expect to see life. – Hennes Aug 12 '16 at 19:46
  • Thanks for your answer. If I can conclude, may I say that there is no risk if I buy some devices with embedded backdoor that use generic driver ? The only risk may be that a further malware download (not present in the device by itself but from another source) will trigger a specific action. – Duke Nukem Aug 13 '16 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.