Tuesday, February 17th 2015
NSA Hides Spying Backdoors into Hard Drive Firmware
Russian cyber-security company Kaspersky Labs exposed a breakthrough U.S. spying program, which taps into one of the most widely proliferated PC components - hard drives. With the last 5 years seeing the number of hard drive manufacturing nations reduce from three (Korean Samsung, Japanese Hitachi and Toshiba, and American Seagate and WD) to one (American Seagate or WD), swallowing-up or partnering with Japanese and Korean businesses as US-based subsidiaries or spin-offs such as HGST, a shadow of suspicion has been cast on Seagate and WD.
According to Kaspersky, American cyber-surveillance agency, the NSA, is taking advantage of the centralization of hard-drive manufacturing to the US, by making WD and Seagate embed its spying back-doors straight into the hard-drive firmware, which lets the agency directly access raw data, agnostic of partition method (low-level format), file-system (high-level format), operating system, or even user access-level. Kaspersky says it found PCs in 30 countries with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria.
Kaspersky claims that the HDD firmware backdoors are already being used to spy on foreign governments, military organizations, telecom companies, banks, nuclear researchers, the media, and Islamic activities. Kaspersky declined to name the company which designed the malware, but said that it has close ties to the development of Stuxnet, the cyber-weapon used by NSA to destabilize Iran's uranium-enrichment facilities.
Kaspersky claims that the new backdoor is perfect in design. Each time you turn your PC on, the system BIOS loads the firmware of all hardware components onto the system memory, even before the OS is booted. This is when the malware activates, gaining access to critical OS components, probably including network access and file-system. This makes HDD firmware the second most valuable real-estate for hackers, after system BIOS.
Both WD and Seagate denied sharing the source-code of their HDD firmware with any government agency, and maintained that their HDD firmware is designed to prevent tampering or reverse-engineering. Former NSA operatives stated that it's fairly easy for the agency to obtain source-code of critical software. This includes asking directly and posing as a software developer. The government can seek source-code of hard drive firmware by simply telling a manufacturer that it needs to inspect the code to make sure it's clean, before it can buy PCs running their hard-drives.
What is, however, surprising is how "tampered" HDD firmware made it to mass-production. Seagate and WD have manufacturing facilities in countries like Thailand and China, located in high-security zones to prevent intellectual property theft or sabotage. We can't imagine tampered firmware making it to production drives without the companies' collaboration.
Source:
Reuters via Yahoo
According to Kaspersky, American cyber-surveillance agency, the NSA, is taking advantage of the centralization of hard-drive manufacturing to the US, by making WD and Seagate embed its spying back-doors straight into the hard-drive firmware, which lets the agency directly access raw data, agnostic of partition method (low-level format), file-system (high-level format), operating system, or even user access-level. Kaspersky says it found PCs in 30 countries with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria.
Kaspersky claims that the new backdoor is perfect in design. Each time you turn your PC on, the system BIOS loads the firmware of all hardware components onto the system memory, even before the OS is booted. This is when the malware activates, gaining access to critical OS components, probably including network access and file-system. This makes HDD firmware the second most valuable real-estate for hackers, after system BIOS.
Both WD and Seagate denied sharing the source-code of their HDD firmware with any government agency, and maintained that their HDD firmware is designed to prevent tampering or reverse-engineering. Former NSA operatives stated that it's fairly easy for the agency to obtain source-code of critical software. This includes asking directly and posing as a software developer. The government can seek source-code of hard drive firmware by simply telling a manufacturer that it needs to inspect the code to make sure it's clean, before it can buy PCs running their hard-drives.
What is, however, surprising is how "tampered" HDD firmware made it to mass-production. Seagate and WD have manufacturing facilities in countries like Thailand and China, located in high-security zones to prevent intellectual property theft or sabotage. We can't imagine tampered firmware making it to production drives without the companies' collaboration.
134 Comments on NSA Hides Spying Backdoors into Hard Drive Firmware
Maybe you don't care now, but what if you did? What if your society was taken over by really fucked up dudes who started doing things that any decent person would take issue with... and you were powerless to even protest because they know everything thing you do? Spying on all electronic communications, spying with drones. The ability to easily track anyone. Stalin would have been in constant orgasmic ecstasy if this had been possible in his day.
And I'll let you know why I think things are going to happen fairly soon that most people will have an issue with. Computers are getting more sophisticated all the time. Before long they will be "smart" enough to make some human workers obsolete... meaning that the person has *no* viable task that they can perform better or at a lower cost than a machine. These people will be unemployable, and as the machines continue to become more sophisticated, the number of persons in this category will grow.
Most likely welfare will be expanded, and propaganda will continue to pit the middle class (who experience higher taxes and declining living standards) against the lower class (who don't work and receive the dole). Divide and conquer. But the population will be mollified and distracted one way or another while the number of unemployable persons grows.
Every developed country in the world runs on a consumer capitalist economic model. That's because it has been shown to work better than any other. The consumer/worker is vital part of this system, because the prosperity of the capitalist depends on the prosperity of the consumer. The capitalist makes profit from making and selling stuff to consumers. If consumer income and wealth doesn't increases, then the capitalist's wealth can't either for long. It's symbiotic. It also favors a democratic government, human rights, and freedom. Why? The general population will work harder and be more efficient and more willing to fight wars if they are free, which ultimately increases the power and wealth of the capitalists.
This will soon be obsolete. As the economically useless humans become a greater % of the population, consumer capitalism will no longer be viable. From the capitalist standpoint the consumer is no longer a vital part of the system, but rather something that merely consumes resources while providing no value to them. Vermin. Instead they can use those resources for themselves, and use robotic serfs and slaves to build whatever they want directly and much more efficiently than ever before. Robots will also fight the wars.
What do you suppose will happen to our human rights and living standards then? The rich will have every reason to reduce the amount of resources "wasted" on keeping useless humans alive, meaning that our living standard will gradually deteriorate, along with any thoughts of of rights or freedom. Don't take freedom for granted folks... it became fashionable at the same time as consumer capitalism, and is in fact dependent on it. It will probably happen gradually enough to keep the population from complaining too much until it's too late to do anything about it. It might already be too late. I imagine in a short few decades we will be "happily" spending nearly all our time in VR pods hooked up to feeding and evacuation tubes... until we die. That is the only option we will have. And that is an optimistic scenario. Useless humans might be eliminated much more swiftly.
The alternative? That democracy and freedom are actually strong enough for the interests and wishes of the majority to win out over the desires of the powerful few. And so we share the bounty and all live better and more interesting lives without needing to work. Trends over the last few decades are not heading in this direction though... at all.
Good luck.
I'll leave this here...
You lost me as customer WD, by by !
~sarcasm~
Any fear in this is dumb because it's probably a simple a hard drive feature that some paranoid lunatic fancies as a NSA conspiracy. I suspect that most people need to calm down and need to understand how things work before getting their panties in a bunch about something that doesn't even give anyone access to the computer itself. To call this a "backdoor" is laughable to say the least and from a security standpoint doesn't concern me in any way, shape, or form.
It honestly saddens me that this even made it to TPU. What the hell is this, FOX News?
Fear has been a very effective tool lately to keep the masses confused and divided. I'm not sure how it works. Maybe it is via TV? I haven't watched TV in 25 years, so I don't know what is happening there. If I go to someone's house and it's on I try to get them to turn it off. It's *really* annoying once you become accustomed to not having it.
If you read the actual article, it has nothing to do with the firmware but rather a typical attack on eastern computer systems.The wording in the article is tricky because all it really says it that the NSA attacked some people. By the way there was a hard drive thing that they think is linked to the NSA. Nothing conclusive here other than speculation being taken as fact. I suspect that Tiffany Wu doesn't know what she's talking about.
Stats 101: Correlation doesn't always imply causation.
This doesn't sound like it's loaded at the factory though, but by malware reflashing your drive I think.My understanding from reading about this is it isn't flashed at the factory, but flashed by companion malware that then opens a backdoor to your HD by flashing it and running it's own network access somewhere.
"This particular piece of malware is delivered via modified hard drive firmware, and Kaspersky says that it’s compatible with nearly all major hard drive brands: Seagate, Western Digital, Samsung, you name it. Once it’s there, it’s nearly impossible to get rid of or even detect. Since it’s not taking up space on the hard drive’s platters, it can easily re-infect a system even after a drive has been fully formatted."
But wait, there's more: arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/
Or even better, imagine instead of infecting svchost.exe on the disk, you have a disk firmware that always returns infected svchost.exe when OS tries to read it.
... it does sound far fetched and I also have my doubts ... it's not that probable but it does seems possible if the hard drive factory security was compromised and firmware "enhanced".
Possible scenario, create a story to revive the fears of people to increase sales?
Or, is there a new line of software that is about to hit the market that remedies/detects this firmware infection problem?
I'm just thinking out in print.:rolleyes:
Anyways, here is a Kaspersky Labs Daily Blog post that tries to calm some folks down: Indestructible malware by Equation cyberspies is out there – but don’t panic (yet)
I was outside and an acorn hit me in the head... then, I had a flashback to the story of "Chicken Little".o_O
It also could infect a BIOS based MBR by simply intercepting MBR calls, similar to old floppy disk viruses, and reload itself via this means as a bootkit of sorts. A reinstall would not cure this, but as Kaspersky itself admits, is usually incredibly targeted when deployed. If you're not in Iran you probably don't have this. Even if you do have it, it's probably NOT being used.
Still, I eagerly await detection tools for this.
The USA has the power to stop hackers from stealing data and money. All the US companies and private individuals that have lost money should be getting refunds very soon.
This is great news. We should reverse the trend of people stealing from us and go on offensive so that we can do away with taxes. Lets take from others for a change. Despots will be replaced with Democracy.
Relief is on the way. I can hear all the 1's and 0's marching right back into our bank accounts now. Hell, I can
even hear them singing the national anthem while they are working.
The NSA needs your support.
The fact that anyone who read the article would understand this is spyware that infects firmware, and not firmware that is loaded from the factorys would shut a lot of people up. This is almost certainly only an issue if you have been directly targeted for say, enriching uranium. No one has to worry about their porn stash. Technically speaking (as we should on tech powerup), the fact that the major brands have aparently leaked their firmware source should be more disturbing than the idea of the infection itself.