0

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the computer/hardware/operation system that it's connected to? My worry is that the malware may prevent me from making an image of the hard disk drive because it can interupt me from doing this in some way. I saw a video with an HWB where the guy could still write to the HDD but only temporarly, so I guess it was only a RAM/cache on the HDD, after a restart it was gone. He could ofc make copies from HDD through HWB to PC HDD/USB stick etc. My worries is that the malware that is on HDD (read only because of HWB) can do that too.

What is the first step that the malware has to do?

abort from Zero-Day-Exploit and more, the question is more focused on the part of what the malware has to do, and if it is possible

2

There are a lot of concepts and assumptions mixed into this question.

First off although people commonly refer to "Hardware Write Blockers", there really is no such thing with modern disk drives. Many years ago, a hardware write blocker operated at a very low level by cutting the "write-line", making writing impossible. Disk drives haven't worked like that for decades. Current write blockers have firmware that is programmed to refuse to pass on commands known to cause writes. Out of date firmware and/or newer devices may in fact have commands that write but are not blocked. Generally this doesn't happen if they are kept updated, but this is why they are inline write blockers but not technically hardware blockers.

A device that is "write blocked" is still readable. The point is to protect and prevent modification of the device, it does not inhibit copying content (including malware) from the device to your machine to which it is connected. So yes, malware on the blocked device can be written to your other hard drives or USB sticks.

While often compared to biological analogues, computer viruses and malware are not independently dangerous like a biological. Computer malware is malicious software. It has to be invoked and run before it can do anything. Simply copying a piece of malware will not activate it. You can safely copy or image as much malware as you like. Copying does not invoke/execute the malware, it's just a file. The danger is in accidentally executing the malware. This could be as simple as double-clicking the file accidentally, or more indirectly by a system process trying to read and interpret the file in a manner that causes an error (such as a buffer overflow) resulting in code on the file being invoked. A preview mode for example may end up invoking the file without you intending to do so.

To recap: Write blockers protect the blocked device from modification, nothing else!

  • Thank You, very helpul text, expecially the old hwb with cutting the "write line"! I am not sure but it sound for me you mean that I can copy data from an hard disk that is connected to write blocker but my questions is more about if the malware on hard disk itself can copy to everything that is physically connected to? I mean when a write blocker prevent the disk from write actions, then the malware can't execute the code, which is the very first thing that must happend so the malware gives the OS the command to copy from A to B. Is that right? – karts Sep 17 '18 at 21:35
  • 1
    Write blockers block write commands to the disk. If there is a file on the blocked disk called "bad_mojo.exe" and you double-click it, it will load (read) into your memory and be capable of writing everywhere except the blocked disk. The rest of your machine becomes toast! – user10216038 Sep 17 '18 at 21:44
  • So you mean when i don't read a file on the hdd that is write blocked, the file cannot copy/spread to physically connected devices? Do you mean the cache/ram memory from the hard disk? Is this possibility then somehow be possible to prevent, are there already solutions for this/these scenario? How forensic experts deal with this? Would be nice if you can give me some basic little info. – karts Sep 17 '18 at 21:59
  • " So you mean when i don't read a file on the hdd that is write blocked, the file cannot copy/spread to physically connected devices? " I think there is some confusion. Files on a disk just sit there, they have no capability to spread or do anything else, they just occupy drive space. It takes the processor executing them before they can perform an action. Files are a pile of bricks, you can move them or launch one at a target but by themselves they just sit there. – user10216038 Sep 17 '18 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.