Was there ever been out-in-the-wild or any kind of detected firmware rootkit in an M.2 SSD?
asked Mar 22, 2022 at 20:20
-
1I highly doubt it. M.2 is pretty new and drive malware is rare enough as it is (it's generally limited to nation-state threat actors and the like). It's certainly possible, though.– forestCommented Mar 22, 2022 at 20:47
Add a comment
|
1 Answer
No.
The only actual storage drive firmware infection is IrateMonk/MadBishop (IM used MBR bootloader substitution, MB injected into executables on filesystem), used and developed by NSA TAO Persistence Division from approximately 2007 through 2013. Release of the ANT catalog in late 2013 exposed it and made it attributable, so it was dropped. This only targeted SATA and SAS/SCSI drives, M.2/NVME wasn't around at the time.
Those older drives mostly had basically no security features or protection against firmware implanting, not only having no secure verification of firmware updates, but also allowing full read/write firmware access through diagnostic vendor-specific-commands (how firmware implants were installed on most drives). Many even had JTAG interfaces allowing easy implant development.
Self-encrypting-drives introduced security measures that made this basically impossible, firmware got cryptographically signed and VSC functions had to be unlocked through physical access (eg serial port). The Kaspersky "Equation Group" report in 2015 publicizing the technique was the final nail in the coffin, and got these security features adopted universally.
With modern drives security is locked down at the hardware level, there's only actually a few manufacturers of SSD controllers (eg Phison, Marvell) and their controllers enforce code signing, and only unlock diagnostic VSCs when a jumper is bridged and booted into "safe mode". As far as I know there are no current-production drives vulnerable to firmware attacks like the old days.
Also despite its notoriety this persistence method had little practicality and was extremely rarely used, even very rarely when a UnitedRake operator would deploy WickedVicar on a target it was usually just for the covert storage functionality to read/write to the system area through VSCs, not actually to infect the firmware.
This was an extremely niche and difficult technique even with how relatively easy old drives made it, with the current security features it could never be practical or even possible, even to extremely well resourced state actors. For modern M.2 drives firmware infection is simply not a realistic threat.
