3

Assumimg that...

  • the target is some server (> 2010) that could be running any OS
  • the attacker has gained access to everything remotely, (with maybe some physical access as well)

Is it possible for an attacker, through only software means, to leave an irreversible software artifact on the target? If so, what is the nature of the target and the greatest extent of the damage?

Examples of an irreversible software artifact: something that can't be removed with system restore or formatting hard drive (e.g. maybe a BIOS change?)

5

If we are talking about any theoretical possibilities (outside of basic, that would be purged during BIOS and OS wipe): - Attacker can change firmware of the hardware. Most lucrative would be network adapter and storage device, but others might be targeted as well.

Cannot think of anything else, if we are restricting ourselves to software artifacts only. If we extend this to hardware (we assume attacker got physical access to the device, right?), possibilities are limitless. It all just depends on our paranoia (i.e. is it government/military?).

  • Thanks for your response. Would it be possible for an attacker to change the firmware purely remotely? Is this something that would need to be done at the physical target? (I know I said that he could have access to the physical device, but I think I'm most interested in what can be done as remote as possible) – souldzin Oct 6 '16 at 23:55
  • 2
    @souldzin - the entire process is interesting, but yes, if you get root. – Clockwork-Muse Oct 7 '16 at 0:37
  • Yes, it is possible. It depends on the hardware vendor, of course. See this link for a simple example of such update of the NIC firmware: cryptome.org/2014/02/nic-ssh-rootkit.htm – Iaroslav Oct 7 '16 at 0:39
  • @Clockwork-Muse and laroslav, very interesting finds. Thanks for the links! – souldzin Oct 7 '16 at 1:01
1

There was a paper at the CCC conference a few years ago discussing modifying hard disk controller firmware to allow the disk controller to silently replace bits of data between the platter and the main machine.

Conclusion was that some of the things have multi core ARMs and do not fully use them, so actually the attack is feasible.

The insidious thing here is that even formatting or partitioning the disk will not remove the patched disk controller firmware.

You would probably need root to be able to sent the new firmware to the disk controller, and it will be inherently model specific, but possible if the payoff was great enough.

1

If the attacker has physical access to the machine, he could hypothetically install a hardware backdoor, through the BIOS chip (already been done), or the RAM and the CPU. There are some conversations about those last two, but we don't have any serioues evidence yet. Another thing that has been done by some manufacturers is planting some extra chips with some sort os virus directly on the motherboard, but that's difficult to be done if the attacker doesn't change motherboards on the server mentioned...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.