1

For example could it "trick" most partitioning/disk utility tools that it was successfully wiped, but with the malware still existing? Kinda similar to what would happen if you attempted to "clean" flash an infected BIOS, where it would inform you that you flashed it, but in fact nothing happened and it's still compromised.

2

Malware could survive without being in the firmware by hooking OS disk access calls and preventing anything from wiping it within the compromised OS.

If you were to live boot to a known clean OS or wipe the hard drive by removing it from the existing system (and you knew the malware was not residing in firmware), you could probably successfully wipe it, but there are caveats:

Do you know the hard drive itself isn't compromised?

The hard drive could theoretically be engineered with another chip that stores a copy of the malware and rewrites it after a successful wipe. Yet another concern would be malware hiding in a different piece of hardware within the system (either via firmware infection, or hardware implant), thus effectively evading any attempts to clear it by wiping or replacing a hard drive.

The above mentioned process of using a live CD is also potentially fraught with potential peril. Do you trust the BIOS? What about the boot-up chain? Modern OSes often use a boot system called UEFI which is at least partially controlled by data that resides on the drive. Though there are controls in place to try to prevent unauthorized tampering with the boot process, it may be possible for malware to inject itself into that boot chain. Even more low-tech, is malware running on a USB device or in a place to emulate a USB device, if the boot priority allows booting from USB devices before the hard drive. Once again, the malware could load, and inject itself into any later boot processes, even transparently handing off booting to the "normal" OS after hooking it. If you've ever broken a Linux grub install, you may have experience booting to the grub shell via a live CD or USB, then manually typing code to hand-off execution to the Linux installation on the hard drive, which is similar to the process malware might employ.

  • 1
    I was thinking more about the possible entities of the hard drive where the virus could persist but other than that yes, it would survive reformating if it was a UEFI or SMM malware and an HDD compromise wouldn't be necessary. – ffdd992 Dec 19 '18 at 0:39
0

If your reformatting software was itself infected, then that would be one way. If the reformatting software is correct and has no backdoors and is ran from an external media and your BIOS is clean, then I think there aren't really any other places for the malware to trick you outside of the firmware itself, which you ruled out. The one exception would be if your hardware has the backdoor built into it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.