0

It's possible the external hard drives have been compromised in the company I work for. It would be a huge waste of money to replace them all without detection and if the current ones are compromised, the new hard drives could be compromised again.

The hard drives have already been scanned with Anti Virus / Anti Malware software. Those softwares would not detect firmware / hardware hacks.

Could you suggest how to detect if the hardware / firmware of the hard drives have been compromised?

Improve this question
2
  • Without knowing the specific malware, and if you're certain that there's a firmware-based malware that can't be detected by AVs... sledge hammers work wonders. Put on eye protection, go out where you can easily clean up the mess, and give each suspect hard drive at least 20 good solid whacks. If they stay in one piece, they're most definitely infected and should be disposed of properly. If you do know the malware, please edit your post to indicate what it is.
    – Ghedipunk
    Oct 11, 2019 at 20:01
  • 3
    Your question is very broad. What makes you think the hard drives are compromised? Firmware malware is relatively unusual, and detecting it is a bit of a special case. There's really no answer to this question without a lot more specifics.
    – Steve Sether
    Oct 11, 2019 at 20:04

1 Answer 1

Reset to default
1

External hard drives have a memory chip with the firmware. Firmware malware can store data and hide it on your drives. They would need physical access to your drives to access the hidden data, without physical access, if programmed they can send it over the internet.

Note that firmware update has a small chance of removing the malware but even if the firmware is updated, firmware malware may still persist.

My recommendation is to purchase the exact same hard drive model, dump the firmware of the new hard drive and the firmware of your current hard drives and compare the two.

If the two firmware dumps are the same, the hard drives are not compromised.

Improve this answer
3
  • Why stop at this level of paranoia? With physical access you could simply replace the hardware with identical looking copies that appear to flash a new version, but don't. The problem with this line of thinking is that it has no end. You can't "prove" that the hardware isn't compromised. You must start with the other end.. showing evidence that it is, and how.
    – Steve Sether
    Oct 11, 2019 at 21:26
  • If you extract firmware through the JTAG interface and compare the dumps, to my knowledge there is no way for a hardware replacement to get the firmware dump to appear differently.
    – H_H
    Oct 11, 2019 at 21:54
  • So create a fake jtag interface. These are paranoid ideas, but the point is you can pretty much always go further in your paranoia.
    – Steve Sether
    Oct 12, 2019 at 4:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .