0

I am asking this because based on Snowden's relevations, bad actors "interdict" (intercept) shipments of routers, HDDs, SSDs, servers, etc., install malicious rootkits and spyware in the firmware and then send the infected hardware to their intended targets.

1

Yes it is possible, as long as the firmware on your device is updatable. That depends on the vendor, but most do have updatable firmware. If the bad actor had enough resources he could reverse engineer the update utility and firmware itself to insert anything they wanted there, as long as it was small enough to fit on the tiny flash memory in the SSD/HDD.

If you're interested in hardware hacks, there has been one that (supposedly) compromised the supply chain of Supermicro motherboards recently: here

  • Thanks for your reply and the reference to write-up by Bloomberg. It's very strange that up till now, nobody has produced physical evidence of the tiny chip. All that we have read in the media so far is based on "he says, they say, we say". – ssdhddinfected Oct 29 '18 at 13:11
  • 2
    "If you're interested in hardware hacks, there has been one that compromised the supply chain of Supermicro motherboards recently" That's not entirely accurate. There have been unfounded claims from Bloomberg which say that. There's plenty of reason to be skeptical, for example: security.stackexchange.com/questions/195741/… – JMac Oct 29 '18 at 14:51
  • OP is asking about attacks over the internet. Hard drive firmware cannot be updated directly over the internet, only locally via ATA commands. – forest Oct 29 '18 at 21:24
  • @forest if you get a piece of malware on your computer it will have local access to the drive to update the firmware, that's how I understood the question. Also technically you could just inject the update code and package to any suitable vulnerability – Genesis Oct 29 '18 at 21:25
  • @JMac I've now included the uncertainty of this hack! Thanks for pointing this out :) – Genesis Oct 29 '18 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.