Spying software embedded inside all hard drive manufacturer's drives

devil21

Member
Joined
Aug 15, 2007
Messages
26,109
I've seen reports that new NSA 'leaks' are forthcoming.

http://www.businessinsider.com/r-russian-researchers-expose-breakthrough-us-spying-program-2015-2

SAN FRANCISCO (Reuters) - The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

much more at link
 
The big question here, is how do you find and remove it? The smaller question is when exactly did they start doing this? Drives older than that date would have that "feature", although they'd be awfully small by today's standards.
 
I assume ever new device post 2000 has been compromised from the bios level. I'm sure many aren't but how to know? You can't, as those fascist companies which will deny up and down they work with the gov, but work with the gov to "protect" you against terrorism and are protected from any liability. Barf.

That really imo is the biggest threat to cryptocurrencies, you literally can not secure it, if the firmware of the hard drive has been compromised, do whatever you want it doesn't matter, and it looks like all of them are compromised. So, thanks, we have no means of working in private. Government owns everything. The only way in the future to avoid that, is a custom made device, where "EVERY" piece of hardware and code is made in house (firmware to, not just the os). Then it'd be "Safe". That doesn't really exist at the moment.
 
Fictional or just by another name?

Telescreens are fictional devices which operate as both televisions and security cameras. They feature in George Orwell's novel Nineteen Eighty-Four as well as all film adaptations of the novel. In the novel and its adaptations, telescreens are used by the ruling Party in Oceania to keep its subjects under constant surveillance, thus eliminating the chance of secret conspiracies against Oceania.

All members of the Inner Party (upper-class) and Outer Party (middle-class) have telescreens in their homes, but the proles (lower-class) are not typically monitored as they are unimportant to the Party. As later explained in Emmanuel Goldstein's book of which Smith reads some excerpts, the Party does not feel threatened by the Proles, assuming that they would never rebel on their own, and therefore does not find a need to monitor their daily lives.

The character O'Brien claims that he, as a member of the Inner Party, can turn off his telescreen (although etiquette dictates only for half an hour at a time). While the programmes could no longer be seen or heard, the screen still functioned as a surveillance device, as after Winston is taken into the Ministry of Love, the audio of his meeting with O'Brien with the telescreen "off" is played back to Winston. The screens are monitored by the Thought Police. However, it is not clear how many screens are monitored at once, or what the precise criteria (if any) for monitoring a given screen are (although it is seen that during an exercise programme that Winston takes part in every morning, the instructor can see him, meaning telescreens are possibly an early variant of videophones). Telescreen cameras do not have night vision technology, thus, they cannot monitor in the dark. This is compensated by the fact that their microphones are incredibly sensitive, and they are said to pick up a heartbeat. As Winston describes, "...even a back can be revealing..."[1]

In addition to being surveillance devices, telescreens are also televisions (hence the name). It broadcasts propaganda about Oceania's military victories, economic production figures, spirited renditions of the national anthem to heighten patriotism, and Two Minutes Hate, which is a two-minute film of Emmanuel Goldstein's wishes for freedom of speech and press, which the citizens have been trained to disagree with through doublethink. Many of the telescreen programmes are transmitted in Newspeak.
...
http://en.wikipedia.org/wiki/Telescreen
 
Wow! This is a big deal. I hope this story gets tons of coverage. Hard drive makers need to be outraged. Hopefully this will convince them to never share their source code with the government again. Even more I hope that this will make absolutely everyone more "paranoid" as Damian put it, in general.

The time for serious encryption is now. The time for serious security is now. It's time to lock down our computers from the government.
 
Wow! This is a big deal. I hope this story gets tons of coverage. Hard drive makers need to be outraged. Hopefully this will convince them to never share their source code with the government again. Even more I hope that this will make absolutely everyone more "paranoid" as Damian put it, in general.

The time for serious encryption is now. The time for serious security is now. It's time to lock down our computers from the government.

Definitely, Total Internet Encryption. The only problem with that, is that they already have their noses in on the bottom line there, too.... oh wait, I'm paranoid. :toady:
 
Fascinating stuff. I only started reading it but it seems like Kapersky just released a shit load of info on a variety of different malware exploits from some ultra sophisticated attack group they dubbed "Equation group." They didn't come out and say it, but strongly implied that the equation group is the NSA. Hopefully further Snowden leaks will corroborate this.
 
It's possible encryption wouldn't even protect you from this disk drive malware. If the unencrypted data ever ends up on your drive for any reason then it's too late. It's pretty tricky and difficult to tell when exactly your computer is saving your work to your storage. For example, if you start writing an email or forum post or whatever, then get distracted and allow your PC to hibernate - it's too late. It's all been flushed to your drive and saved for eternity.
 
You beat me to it... I was about to post this story... :p

Here's another link about Kasperny's detailed research into it.

http://arstechnica.com/security/201...-nsa-hid-for-14-years-and-were-found-at-last/

Other than the two of you that actually read the article, you need to.

It's not every hard drive. It's systems that are targeted, but now that the cat's out of the bag, they might start targeting all of them.

It re-writes the firmware of 6 different manufacturers hard drives.

A different branch hides in the registry, is encrypted, can't be detected or removed and takes over the operation of your OS.

It attacks macs and smartphones too.

seriously, read the article and maybe even the full presentation. Just the article is looooong...

:mad:

-t
 
So far, it looks like the hard drive stuff was targeting OEM stuff (like when you buy a whole system already built) in China. If this was NSA, technically, they did what we pay them to do. But it is always good practice to treat any drive as a potential target.

What you will need to do (assuming you have a compromised drive) is to flash it with known good firmware that is verified by checksum. I might make a thread about checksums later if I'm up for it.

The other part of this is someone would still need to get some code running on your system to make use of the hard drive exploit, so if you like installing malware on your machine, you may want to prepare to format the drive (after flashing new firmware) and start over.
 
So far, it looks like the hard drive stuff was targeting OEM stuff (like when you buy a whole system already built) in China. If this was NSA, technically, they did what we pay them to do. But it is always good practice to treat any drive as a potential target.

What you will need to do (assuming you have a compromised drive) is to flash it with known good firmware that is verified by checksum. I might make a thread about checksums later if I'm up for it.

The other part of this is someone would still need to get some code running on your system to make use of the hard drive exploit, so if you like installing malware on your machine, you may want to prepare to format the drive (after flashing new firmware) and start over.

Unfortunately, that won't help.

Go read.

-t
 
The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.

-t
 
Unfortunately, that won't help.

Go read.

-t

It happens at boot time, so if you format the drive, you could remove it by also wiping the MBR.

The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.

-t

Not sure what to do about the vault, except destroying the drive, or doing 100's of passes writing random data. DoD does around 7 passes.
 
Last edited:
https://en.wikipedia.org/wiki/National_Industrial_Security_Program#Data_sanitization

The Defense Security Service provides a Clearing and Sanitization Matrix (C&SM) which does specify methods.[5] As of the June 2007 edition of the DSS C&SM, overwriting is no longer acceptable for sanitization of magnetic media; only degaussing or physical destruction is acceptable.

http://www.dss.mil/isp/fac_clear/download_nispom.html

Unrelated to NISP or NISPOM, National Institute of Standards and Technology (NIST) Computer Security Division Released Special Publication 800-88 Revision 1, Guidelines for Media Sanitization December 18, 2014 http://csrc.nist.gov/news_events/news_archive/news_archive_2014.html#dec18

-t
 
Back
Top