I wonder how hard it it to infect a laptop or netbook in 60 minutes or less in a way the victim cannot easily clean their machine by wiping hard disk drives.
Let's assume the following:
- The attacker has physical access to the machine. I.e. they wait until their victim leaves their desk. They know how long their victim will be away. (I.e. 5 minutes or an hour.)
- The machine is either turned on (and must stay that way) or turned off (and must stay that way), or the victim will notice.
- The victim's machine has USB-ports, ethernet cable connection, wireless LAN and (possibly) Bluetooth enabled.
- The attacker has as much time to prepare their attack as they need, even some years. They have several chances to try, as long as they don't break anything.
The hack must result in the following:
- The victim will not be able to remove the infection by reinstalling their system or securely wiping the disk or buying a new hard disk. (1)
- The victim will only be able to remove the infection by using a completely new mainboard, or at least flashing the BIOS chip (just resetting shouldn't help).
- The attacker will be able to steal the victims data (minimum requirement), for example passwords or company data. They must at least be able to use keylogger-like functionality, better gain complete control over the victim machine.
- No dirty old never-updated-Windows exploits. The victim is running a regularly updated Unix derivate (i.e. latest OSX or Linux).
- The victim would notice an attack if there was anything to notice. Nothing remotely visible must change. The victim expects being attacked, and will assume a technical error is an attack, no matter how unlikely it seems to be. The victims skill level is a somewhat experienced coder, but not in the hardware field. The victim, however, trusts their coworkers to a certain point, i.e. leaving their machine for lunch.
- No fance UEFI things here. Plain old BIOS, with a lot of data available about it. (It isn't a new laptop.)
I leave the methods the attacker uses in detail completely open.
Their skill level however should be assumed to be extremely high. (For example, someone with 20+ years of experience, good at ASM, C++, and C, with a high knowledge of hardware as well as software and very good Unix skills. Fascinated by exploits and hacking for all their lives, and having succeeded pretty often breaking into hard- and software systems, as well as at reverse engeneering. I.e. they might pull off anything a single person is able to do, and will find their tools. However, if they found a tool which would get them the job done in 5 minutes, they'd use it. They're pretty pragmatic.) Let's say they are a (secretly criminal) programmer who's more experienced than anyone else on the team, the only one who is not just a "web guy" or sysadmin.
If you were such an attacker, how would you do it? Would you think it's possible, and how would you try? (The requirement "a new harddisk and wiping all data including backups won't help" must be fulfilled. The rest is up to you.)
(1) An easy "software" way to do this would be to infect a file the victim will keep accessing over and over again, either remotely or locally. This, however, does not fulfill the requirement. The infection must persist even if all data is wiped completely, and the machine will never access the company network again.