bk99.de entertain the web since 1997

bk99.de
HN · Hardware securityCurated

Hard disk firmware offers persistent root access

Summary

Sprite_tm examines a hard disk controller and shows how modified firmware can manipulate data traffic and survive reinstallations. The experiment used an ordinary SATA hard drive. The controller contained an ARM processor.

Ideas

  • Hard disk controllers run complex firmware of their own.
  • Debug interfaces allow access to memory and processor state.
  • Manipulated firmware changes the sectors read without anyone noticing.
  • Changing the operating system does not overwrite the controller firmware.

Insights

  • Peripheral devices form trust domains of their own.
  • Reinstalling only removes malware within the storage layers that are written.
  • Closed firmware makes independent integrity checks harder.

Facts

  • The demonstration survived formatting and reinstallation.

Recommendations

  • Include device firmware in threat models.
  • Dispose of compromised storage media instead of just reformatting them.

References

Read the original article

Search the Web Archive

hanez.org · 2023

Passkey gets a touch-sensitive trigger

Johannes replaces the previous push button of his Passkey project with a touch surface and plans a final enclosure. The project repository was renamed from passkey to Passkey. The new button works by touch.

Own project · 2016

USB Killer vs. IBM T22: 1:0 to the stick

In October 2016 I plugged a USB Killer into a retired but still working IBM ThinkPad T22, and afterwards it was dead. This post explains how the small device takes the energy for its attack from the victim’s USB port and why almost any hardware loses. It also answers the question why you would not simply use 230 volts, and shows what this means for protecting your own devices.

CCC · 2015

Rowhammer.js: Hardware faults from the browser

Clémentine Maurice and Daniel Gruss show how repeated memory accesses cause DRAM bit flips and how even JavaScript can become a hardware-level attack surface. Rowhammer.js demonstrated a remote, software-induced hardware fault from JavaScript. Abstraction boundaries do not prevent attacks on shared physical resources.