1

I have connected a hard disk containing bootable Windows to a system confirmed to have a rootkit and attached that disk to a couple of other systems through SATA. I'm wondering (It's kind of been gnawing at me):

  1. Can the rootkit theoretically infect the disk? How likely would it be?

  2. Assuming it could, can it then go on to spread to the other systems the disk was attached to? (Be it through BIOS or other firmware for devices such as NIC.)

  3. Assuming it could, is there any way to get rid of it without flashing the BIOS? (I don't want to accidentally mess anything up.)

  4. Is there a way to confirm for sure the BIOS and other firmware wasn't tampered with through a healthy system without, of course, infecting the healthy system?

  5. What would you do in such a scenario?

1 Answer 1

1

Is this (officially?) confirmed rootkit known to behave in the described way? If not, then there is probably no reason to worry.

No one knows how likely that is but in principle you connect a compromised device to another one. So theoretically this is possible and you'd need to know the state of your hardware/firmware before and after connecting the disk.

Or you need to know a known good version (like firmware/BIOS update files). Analyzing/reflashing would be a solution. Or depending on the work/cost required buying new hardware as alternative.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .