1

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry specially the ones intended for desktop use mostly just update their firmware while the OS is running.

Now, I am wondering, the job of a firmware, very broadly speaking, is that it gets requests from the OS and according to how it introduces itself to the kernel, like as a DVD drive, gets some commands from the OS and executes them, and probably returns some data back to the OS, or performs an operation like ejecting the DVD tray. Now if this firmware is somehow hacked or infected and if you take it to another PC, is it possible for this firmware to infect other hardware on this new PC? What if this new PC has UEFI+TPM? Can TPM+UEFI combination at all prevent firmware alteration?

Also regarding 2021 standards how much is such an attack scenario possible?

I don't know something inside me tells me this is perhaps the most stupid question and simplistic view on how kernel interacts with firmware, but I didn't know where else to ask this question. I would be thankful if you could at least give me a few links so that I can understand this form of hardware/kernel security.

1

Now if this firmware is somehow hacked or infected and if you take it to another PC, is it possible for this firmware to infect other hardware on this new PC?

Yes, certainly. This could be done by supplying a custom boot sequence, or supplying altered information to the boot process (the malware does not need to integrate in the boot process: it can boot itself, do its thing, then reboot and allow the process to repeat, this time undisturbed.

The greatest hurdle in this would be the great variety of available hardware and firmware programming interfaces. The malware would need to run a very detailed diagnostic, and chances are that it couldn't, or it would be detected - come on, a system cold boot taking five full minutes?!?

The malware might, however, be able to detect special circumstances (i.e. a true firmware or software update), and hijack those. I.e., nothing happens normally; then you receive an authentic firmware or BIOS or OS update; you are used to those taking time and rebooting multiple times and so on. So you start the update, see the real message "OS update may take some time", then the PC remains blank and whirring for five minutes, then the BIOS update starts and finishes successfully. In those circumstances you might maybe worry that the BIOS update isn't working, but you would probably try and wait and see, as I myself did any number of times.

Then, the disk malware would need to detect when the system requires loading a specific executable, one that perhaps is executed every so often (it can do so by recognizing it is an executable from its header, and timing its activation). When it happens, it will reply with a different binary, executable on the appropriate platform. To the user, the binary (e.g. a cron job or scheduled task) will appear to have not been executed that one time. That binary would be the second stage, designed to propagate some other way (infecting USB or through the network).

8
  • 1
    Thank you. I very much appreciated your answer, just as much as I enjoyed reading it. Very educational for me. So from what you said I understood that there are two scenarios one is that a hardware malware waits around for a reboot and on the next boot does its attack, which takes time and noticeable. or waits for user to do a casual firmware update and infect those update files. Now is it possible to prevent them using TPM? I mean is UEFI+TPM good at any level? – JackBixuis Jan 4 at 15:58
  • I... am not sure. TPM does allow hardware certification, but when verifying a mass storage device, as far as I can understand from the specifications, TPM assumes that the device content does not change between reads. But with a hacked firmware, this is exactly what would happen. So we would need a way of "passively" inspecting a storage device firmware without giving it control, and (a) there is no standard provision to do so, and (b) the method would have to be implemented with a different firmware. I'll look into it but it seems to me that this defeats TPM completely. – LSerni Jan 4 at 17:05
  • Thank you for being so understanding and helping me understand things and letting me know that this in effect does actually defeat the purpose of a TPM+UEFI setup.I wanted to actually goahead and purchase a new laptop with TPM+UEFI feature and keep very close physical security on it but now I think this maybe pointless since you agree with the way I think,that if a firmware is hit during casual update,because of a hacked OS or undisclosed zeroday then I have just wasted my money.I am sure you can imagine how thankful I would be if you shared the results of your findings about this. Tnx – JackBixuis Jan 4 at 18:09
  • The danger is mostly theoretical according to Kaspersky, unless maybe you work in the Iranian nuclear industry and your exact make and model of system is targeted. Possibly the firmware could be checked through the JTAG interface, if any is present [see this story: fmad.io/blog-ssd-bricked-restore.html]. kaspersky.com/blog/equation-hdd-malware/7623 – LSerni Jan 4 at 18:33
  • I don't know enough vocabulary to thank you enough LSerni, but fmad.io/blog-ssd-bricked-restore.html was super dooper fascinating read. Very fluent and flowing in composition and also proving that the distance between heaven and hell and a few K$ is a simple JMP and MOV :) BUT help me understand something, are you saying that it takes all that equipment to alter a firmware and so I have nothing to worry about? But if it is this simple, simply leaving your PC or laptop near someone who knows the stuff can get you hacked only a Pie and a few wires and a disassembler.How can we be secure? – JackBixuis Jan 5 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.