security leak in working with hardware write blockers?

Question

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the computer/hardware/operation system that it's connected to? My worry is that the malware may prevent me from making an image of the hard disk drive because it can interupt me from doing this in some way. I saw a video with an HWB where the guy could still write to the HDD but only temporarly, so I guess it was only a RAM/cache on the HDD, after a restart it was gone. He could ofc make copies from HDD through HWB to PC HDD/USB stick etc. My worries is that the malware that is on HDD (read only because of HWB) can do that too.

What is the first step that the malware has to do?

abort from Zero-Day-Exploit and more, the question is more focused on the part of what the malware has to do, and if it is possible

Answer 1

There are a lot of concepts and assumptions mixed into this question.

First off although people commonly refer to "Hardware Write Blockers", there really is no such thing with modern disk drives. Many years ago, a hardware write blocker operated at a very low level by cutting the "write-line", making writing impossible. Disk drives haven't worked like that for decades. Current write blockers have firmware that is programmed to refuse to pass on commands known to cause writes. Out of date firmware and/or newer devices may in fact have commands that write but are not blocked. Generally this doesn't happen if they are kept updated, but this is why they are inline write blockers but not technically hardware blockers.

A device that is "write blocked" is still readable. The point is to protect and prevent modification of the device, it does not inhibit copying content (including malware) from the device to your machine to which it is connected. So yes, malware on the blocked device can be written to your other hard drives or USB sticks.

While often compared to biological analogues, computer viruses and malware are not independently dangerous like a biological. Computer malware is malicious software. It has to be invoked and run before it can do anything. Simply copying a piece of malware will not activate it. You can safely copy or image as much malware as you like. Copying does not invoke/execute the malware, it's just a file. The danger is in accidentally executing the malware. This could be as simple as double-clicking the file accidentally, or more indirectly by a system process trying to read and interpret the file in a manner that causes an error (such as a buffer overflow) resulting in code on the file being invoked. A preview mode for example may end up invoking the file without you intending to do so.

To recap: Write blockers protect the blocked device from modification, nothing else!