2

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry specially the ones intended for desktop use mostly just update their firmware while the OS is running.

Now, I am wondering, the job of a firmware, very broadly speaking, is that it gets requests from the OS and according to how it introduces itself to the kernel, like as a DVD drive, gets some commands from the OS and executes them, and probably returns some data back to the OS, or performs an operation like ejecting the DVD tray. Now if this firmware is somehow hacked or infected and if you take it to another PC, is it possible for this firmware to infect other hardware on this new PC? What if this new PC has UEFI+TPM? Can TPM+UEFI combination at all prevent firmware alteration?

Also regarding 2021 standards how much is such an attack scenario possible?

I don't know something inside me tells me this is perhaps the most stupid question and simplistic view on how kernel interacts with firmware, but I didn't know where else to ask this question. I would be thankful if you could at least give me a few links so that I can understand this form of hardware/kernel security.

Improve this question

1 Answer 1

Reset to default
2

Now if this firmware is somehow hacked or infected and if you take it to another PC, is it possible for this firmware to infect other hardware on this new PC?

Yes, certainly. This could be done by supplying a custom boot sequence, or supplying altered information to the boot process (the malware does not need to integrate in the boot process: it can boot itself, do its thing, then reboot and allow the process to repeat, this time undisturbed.

The greatest hurdle in this would be the great variety of available hardware and firmware programming interfaces. The malware would need to run a very detailed diagnostic, and chances are that it couldn't, or it would be detected - come on, a system cold boot taking five full minutes?!?

The malware might, however, be able to detect special circumstances (i.e. a true firmware or software update), and hijack those. I.e., nothing happens normally; then you receive an authentic firmware or BIOS or OS update; you are used to those taking time and rebooting multiple times and so on. So you start the update, see the real message "OS update may take some time", then the PC remains blank and whirring for five minutes, then the BIOS update starts and finishes successfully. In those circumstances you might maybe worry that the BIOS update isn't working, but you would probably try and wait and see, as I myself did any number of times.

Then, the disk malware would need to detect when the system requires loading a specific executable, one that perhaps is executed every so often (it can do so by recognizing it is an executable from its header, and timing its activation). When it happens, it will reply with a different binary, executable on the appropriate platform. To the user, the binary (e.g. a cron job or scheduled task) will appear to have not been executed that one time. That binary would be the second stage, designed to propagate some other way (infecting USB or through the network).

Improve this answer
8
  • 1
    Thank you. I very much appreciated your answer, just as much as I enjoyed reading it. Very educational for me. So from what you said I understood that there are two scenarios one is that a hardware malware waits around for a reboot and on the next boot does its attack, which takes time and noticeable. or waits for user to do a casual firmware update and infect those update files. Now is it possible to prevent them using TPM? I mean is UEFI+TPM good at any level?
    – JackBixuis
    Jan 4, 2021 at 15:58
  • 1
    I... am not sure. TPM does allow hardware certification, but when verifying a mass storage device, as far as I can understand from the specifications, TPM assumes that the device content does not change between reads. But with a hacked firmware, this is exactly what would happen. So we would need a way of "passively" inspecting a storage device firmware without giving it control, and (a) there is no standard provision to do so, and (b) the method would have to be implemented with a different firmware. I'll look into it but it seems to me that this defeats TPM completely.
    – LSerni
    Jan 4, 2021 at 17:05
  • Thank you for being so understanding and helping me understand things and letting me know that this in effect does actually defeat the purpose of a TPM+UEFI setup.I wanted to actually goahead and purchase a new laptop with TPM+UEFI feature and keep very close physical security on it but now I think this maybe pointless since you agree with the way I think,that if a firmware is hit during casual update,because of a hacked OS or undisclosed zeroday then I have just wasted my money.I am sure you can imagine how thankful I would be if you shared the results of your findings about this. Tnx
    – JackBixuis
    Jan 4, 2021 at 18:09
  • 1
    The danger is mostly theoretical according to Kaspersky, unless maybe you work in the Iranian nuclear industry and your exact make and model of system is targeted. Possibly the firmware could be checked through the JTAG interface, if any is present [see this story: fmad.io/blog-ssd-bricked-restore.html]. kaspersky.com/blog/equation-hdd-malware/7623
    – LSerni
    Jan 4, 2021 at 18:33
  • 1
    Usually, the FW of a device is not readily accessible. It requires either knowing the internal "language" for an existing interface (never completely standard) or accessing HW pins if available, and they too are not always standard. So, you'd need extensive knowledge of the specific device, and not all would be software vulnerable (some might only have HW pins: those need physical servicing). But, IF a laptop has a flashable-FW device, and IF you know how its FW works... then yes, you can write a software that will FW-update (and hack) that laptop without taking it apart.
    – LSerni
    Jan 5, 2021 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .