News that a hacking group within or associated with the National Security Agency compromised the firmware of hard drive controllers from a number of manufacturers as part of a 14-year cyber-espionage campaign has led some to believe that the manufacturers were somehow complicit in the hacking—either by providing source code to controller firmware or other technical support. But it’s long been established that hard drive controllers can be relatively easily reverse-engineered without any help from manufacturers—at least, without intentional help.
Despite keeping hardware controller chip information closed, hard drive manufacturers’ use of standard debugging interfaces makes it relatively simple to dump their firmware and figure out how it works—even inserting malicious code that can trigger specific behaviors when files are accessed. Reverse-engineering it to the point of creating a stable alternative set of firmware for multiple vendors’ hard disk controllers that also includes persistent malware, however, is a significant feat of software development that only the most well-funded attacker could likely pull off on the scale that the “Equation group” achieved.
Hard drive controller boards are essentially small embedded computers unto themselves—they have onboard memory, Flash ROM storage, and a controller chip that is essentially a custom CPU (usually based on the ARM architecture). They also generally have diagnostic serial ports, or other interfaces on the board, including some based on the JTAG board debugging interface. Using software such as Open On Chip Debugger (OpenOCD), you can even dump the “bootstrap” firmware from the controller and analyze it with an ARM disassembler.
The legitimate use of these interfaces has helped individuals recover hard drives after firmware failures. But they can also be exploited to insert code into the flash memory of the controller that can write directly to the drive—even after the drive itself has been reformatted. At OHM 2013 (be warned, the site’s certificate is expired), an Amsterdam event organized by volunteers affiliated with International Festivals for Creative Application of Technology, Dutch hardware and software hacker Jeroen “Sprite_tm” Domburg (who previously came to Internet fame for his tiny Raspberry Pi—based arcade cabinet) demonstrated a proof of concept drive hack that allowed him to modify the /etc/shadow password file on a Linux machine and alter the root password, giving him superuser access to the system.
But an attacker doesn’t need to necessarily perform hands-on brain surgery on every hard drive to get a persistent attack. The best way to deal with this is to use the same sort of tool hard drive manufacturers use to send out legitimate firmware updates to customers—with a software tool that uses vendor-specific ATA or SCSI commands to re-flash the drive controller’s ROM. While these commands aren’t exactly documented, they have been reverse engineered for open-source diagnostic tools.
So, in theory, if an attacker was able to use another exploit to gain remote access to a machine and identify the hard drive on the system, they could then drop a customized installer onto the victim system that installs modified drive controller code that gives them a persistent backdoor. The problem, of course, is having a custom set of ROM code for precisely the hard drives that are on the targeted systems—a bit of work that would quickly elevate the cost of development of the attack to something attainable only by an organization with deep technical skill and deep pockets, or a relationship with someone willing to pay for it.
The National Security Agency would seem to meet those criteria. It’s already been documented that NSA has funded the development of other persistent attacks, especially as presented in NSA’s infamous ANT catalog. But other state-funded actors and criminal organizations could certainly benefit from the same approach in instances where a target uses a relatively consistent set of hardware, such as corporate environments with standardized desktops and notebooks.
via arstechnica.com
