# NSA, Malware and Hard Drives **URL:** \ **Category:** Great Debates\ **Created:** [February 20, 2015, 12:47am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150 "2015-02-20T00:47:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Carryon](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@Carryon](https://boards.straightdope.com/u/Carryon)\ **Post date:** [February 20, 2015, 12:47am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/1 "2015-02-20T00:47:01Z")
I figured that had to be a thread about this, but I couldn’t find one, so please link to an active thread if there is one. Anyway, I was wondering what was the story or your thoughts behind the idea that the NSA was putting malware into hard drives that was basically undetectable. I must admit I don’t understand it enough to have an informed opinion and after reading websites, or more accurately comments on them, it seems like people think it’s impossible and not true to the work of Snowden. In case you aren’t aware here’s a link to a typical story about it [From Computer World Magazine.](http://www.computerworld.com/article/2885069/theres-no-way-of-knowing-if-the-nsas-spyware-is-on-your-hard-drive.html) I’d like to hear thoughts about this, especially from technical people who can tell us if it really is likely or propaganda from Russia. Thanks ---
**Author:** ![scabpicker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scabpicker/32/8268_2.png) [@scabpicker](https://boards.straightdope.com/u/scabpicker)\ **Post date:** [February 20, 2015, 2:14am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/2 "2015-02-20T02:14:25Z")
I read a blurb about this on ars technica yesterday. It’s totally plausible that it could be done, at this point how much it was done is a matter of speculation. ---
**Author:** ![Shalmanese](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shalmanese](https://boards.straightdope.com/u/Shalmanese)\ **Post date:** [February 20, 2015, 2:25am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/3 "2015-02-20T02:25:44Z")
> [@Carryon](#): > > it seems like people think it’s impossible and not true to the work of Snowden. It’s not the work of Snowden, it’s the work of Kaspersky labs, a Russian security firm that’s got a good reputation among security circles for doing good work but also somewhat unknown incentives (Kaspersky was trained by the KGB). Security people have flagged firmware malware as a serious security threat for a long time. Modern day computers aren’t a single computer anymore, they’re a collection of loosely communicating independant parts. Hard drive firmware, along with network card firmware, CPU microcode (especially the new secure enclaves like Intel vPro), baseband processors on phones and BIOS are commonly cited as prime attack surfaces for undetectable and unerasable malware. Until now, we’ve not had smoking gun definitive proof that state level actors are creating firmware based malware but every security professional pretty much assumes it’s an active area of investigation. ---
**Author:** ![FXMastermind](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fxmastermind/32/7289_2.png) [@FXMastermind](https://boards.straightdope.com/u/FXMastermind)\ **Post date:** [February 20, 2015, 2:38am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/4 "2015-02-20T02:38:38Z")
> [@](#): > > “They happened to capture some of the vestigial bits of the exploit setup that had not been removed from a system – the so-called “dropper” that knew how to check the drive’s make and model and then invoke the required drive-specific code to install the malware,” [Gibson said](http://www.computerworld.com/article/2885069/theres-no-way-of-knowing-if-the-nsas-spyware-is-on-your-hard-drive.html). “When you consider it, it’s really quite diabolical.” That’s an understatement. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [February 20, 2015, 3:24am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/5 "2015-02-20T03:24:56Z")
> [@Carryon](#): > > In case you aren’t aware here’s a link to a typical story about it > > [From Computer World Magazine.](http://www.computerworld.com/article/2885069/theres-no-way-of-knowing-if-the-nsas-spyware-is-on-your-hard-drive.html) > > I’d like to hear thoughts about this, especially from technical people who can tell us if it really is likely or propaganda from Russia. From the link: > [@](#): > > According to [a report by Reuters](http://www.reuters.com/article/2015/02/16/us-usa-cyberspying-idUSKBN0LK1QV20150216), a former NSA employee “confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.” From _that_ link: > [@](#): > > A former NSA employee told Reuters that Kaspersky’s analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it. _Survey Says:_ LIKELY As for the implications… well, given everything that’s come out about the NSA’s shenanigans, we’ve basically discovered that we have a monkey with a machinegun running loose. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [February 20, 2015, 3:48am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/6 "2015-02-20T03:48:46Z")
Frankly I think this is awesome. Until the scammer-hackers work out an exploit. Then it won’t be so awesome. The article says they think the spyware was released in 2008 and that the coders known as The Equation Group have been active since the 1990s. They must have pretty decent OpSec given that we are just learning about it now. Congratulations to that mysterious organization for a job well done: I wonder who they are. ---
**Author:** ![The\_Joker\_and\_the\_Thief](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@The\_Joker\_and\_the\_Thief](https://boards.straightdope.com/u/The_Joker_and_the_Thief)\ **Post date:** [February 20, 2015, 4:01am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/7 "2015-02-20T04:01:41Z")
> [@Measure\_for\_Measure](#): > > Frankly I think this is awesome. Until the scammer-hackers work out an exploit. Then it won’t be so awesome. > The article says they think the spyware was released in 2008 and that the coders known as The Equation Group have been active since the 1990s. They must have pretty decent OpSec given that we are just learning about it now. Congratulations to that mysterious organization for a job well done: I wonder who they are. [If you were a reflexive conspiracy theorist, you wouldn’t have to wonder, and this time you’d be right.](http://observer.com/2015/02/equation-group/) > [@](#): > > Kaspersky declined to outright name the United States National Security Agency (NSA) as the governing body behind the Equation Group, but there are a number of factors that point to the NSA as the responsible party. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [February 20, 2015, 4:04am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/8 "2015-02-20T04:04:00Z")
Assuming the hard drive manufacturers are not complicit, if something is modding the firmware of their drives, they can figure it out. They could also if desired write in a CRC check or checksum of some kind into the SMART systems that would show a code that could be printed on the label of the drive. poll the smart status, compare CRC in smart status to label, match = drive firmware intact. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [February 20, 2015, 4:13am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/9 "2015-02-20T04:13:54Z")
> [@drachillix](#): > > Assuming the hard drive manufacturers are not complicit, if something is modding the firmware of their drives, they can figure it out. They could also if desired write in a CRC check or checksum of some kind into the SMART systems that would show a code that could be printed on the label of the drive. > > poll the smart status, compare CRC in smart status to label, match = drive firmware intact. Yup. More exaggeration from the security world about undetectable super hacking. Maybe there are some theoretical particles that haven’t been detected yet but if it’s recorded on a hard drive it’s detectable. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [February 20, 2015, 6:13am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/10 "2015-02-20T06:13:00Z")
> [@The\_Joker\_and\_the\_Thief](#): > > [If you were a reflexive conspiracy theorist, you wouldn’t have to wonder, and this time you’d be right.](http://observer.com/2015/02/equation-group/) On the contrary, anybody who has run [run these sorts of scenarios](http://www.sjgames.com/inwo/lists/) realizes that there are any number of organizations matching the profile of The Equation Group. Examples include the Illuminati, the Adepts of Hermes, the Discordian Society, the Bermuda Triangle, Col. Mustard… ---
**Author:** ![Syne](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@Syne](https://boards.straightdope.com/u/Syne)\ **Post date:** [February 20, 2015, 6:15am UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/11 "2015-02-20T06:15:40Z")
All articles I’ve read have failed to define how the malware communicates and gets write access to your hard drive’s firmware. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [February 20, 2015, 12:43pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/12 "2015-02-20T12:43:21Z")
> [@TriPolar](#): > > Yup. More exaggeration from the security world about undetectable super hacking. Maybe there are some theoretical particles that haven’t been detected yet but if it’s recorded on a hard drive it’s detectable. The point of the firmware hack is that the malware is _not_ on the hard drive itself (where it could be detected by a scan) but hidden in the operating software that controls the hard drive. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [February 20, 2015, 12:50pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/13 "2015-02-20T12:50:09Z")
> [@Steve\_MB](#): > > The point of the firmware hack is that the malware is _not_ on the hard drive itself (where it could be detected by a scan) but hidden in the operating software that controls the hard drive. So? It’s not magic. If the firmware can be hacked then the hack can be detected. Even if the manufacturer has hardcoded the ‘malware’ you can still tell what it’s doing, and you can use a different controller for the drive. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [February 20, 2015, 12:59pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/14 "2015-02-20T12:59:35Z")
> [@Steve\_MB](#): > > The point of the firmware hack is that the malware is _not_ on the hard drive itself (where it could be detected by a scan) but hidden in the operating software that controls the hard drive. The claim is made that the code is not detectable nor scannable. So what prevents someone from removing the ROM and reading it? Or reading it while on the drive, but not powered up? If the drive reads it for execution, why can’t something else read it? Something else puzzles me…I think the illustration showing the memory dump and highlighting “i:\fanny.bmp” may be a figment of an artist’s imagination. If the bad file is stored on a drive’s firmware, there’s no reason for it to be named at all, and there’s no reason for it to conform to standard directory formats. If you’re trying to hide it, all the more reason to NOT make it look “conventional.” And .bmp is a bitmap graphic file, although it is possible to ignore that and execute the data as code. ---
**Author:** ![Syne](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@Syne](https://boards.straightdope.com/u/Syne)\ **Post date:** [February 20, 2015, 3:00pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/15 "2015-02-20T15:00:31Z")
> [@Steve\_MB](#): > > The point of the firmware hack is that the malware is _not_ on the hard drive itself (where it could be detected by a scan) but hidden in the operating software that controls the hard drive. Not even sure what this means. Every piece of information on your computer is either in the CMOS, which for the purpose of this discussion, tells your computer where to look for the hard drive, or on the hard drive, which contains everything else. So does this hack infect your computer’s CMOS? ---
**Author:** ![Syne](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@Syne](https://boards.straightdope.com/u/Syne)\ **Post date:** [February 20, 2015, 3:08pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/16 "2015-02-20T15:08:09Z")
There does appear to be two types of firmware. One on a chip, and one on the platter itself. Does this hack infect the first? [http://s12.postimg.org/8ia5ripil/Untitled.jpg](http://s12.postimg.org/8ia5ripil/Untitled.jpg) ---
**Author:** ![theR](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@theR](https://boards.straightdope.com/u/theR)\ **Post date:** [February 20, 2015, 5:10pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/17 "2015-02-20T17:10:40Z")
I’d suggest people with technical questions read the Kaspersky blog posts or a technical site like ArsTechnica rather than mainstream non-technical news before asking technical questions. That will explain the answer to some questions like Musicat’s. (The answer is that fanny.bmp was part of a mode of infection using USB sticks and CDs.) > **[“How do I stop this virus?” Equation Group victim pleaded for online help](https://arstechnica.com/information-technology/2015/02/how-do-i-stop-this-virus-equation-group-victim-pleaded-for-help-online/)** > > Little did dkk know, s/he was wrestling with same 0-day that hit Stuxnet victims. > **[How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last](https://arstechnica.com/information-technology/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/)** > > "Equation Group" ran the most advanced hacking operation ever uncovered. > **[Equation Group: The Crown Creator of Cyber-Espionage](https://www.kaspersky.com/about/press-releases/2015_equation-group-the-crown-creator-of-cyber-espionage)** > > Kaspersky Lab discovers the ancestor of Stuxnet and Flame – powerful threat actor with an absolute dominance in terms of cyber-tools and techniques > **[Equation: The Death Star of Malware Galaxy](https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/)** > > The Equation group is a highly sophisticated threat actor that has been engaged in multiple CNE (computer network exploitation) operations dating back to 2001, and perhaps as early as 1996. It is probably one of the most sophisticated cyber attack... ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [February 20, 2015, 5:22pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/18 "2015-02-20T17:22:05Z")
One of the things about the computer world is there are lots of outfits with lots of resources that would love nothing more than to discover an exploit like this especially if the hard drive manufacturers were involved. Hard drive manufacturers would love to find that a competitor was involved because a hard drive manufacturer being complicit in such a scheme would find themselves out of business overnight if it were revealed. ---
**Author:** ![scabpicker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scabpicker/32/8268_2.png) [@scabpicker](https://boards.straightdope.com/u/scabpicker)\ **Post date:** [February 20, 2015, 5:30pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/19 "2015-02-20T17:30:33Z")
> [@Syne](#): > > All articles I’ve read have failed to define how the malware communicates and gets write access to your hard drive’s firmware. The drives have proprietary code in their firmware which allows you to update it. Most of these commands are available from the O/S (the firmware update software is usually run from DOS), so it’s completely possible for the firmware to be updated from your operating system (though, I imagine it’s going to eventually cause an unexpected reboot). Since the commands are proprietary, a malicious party would have to either have the co-operation of the mfr., or would need to reverse engineer the commands. Some of the commands have been reverse engineered by persons developing open source hard drive utilities, so it’s not fantasy that they can be reverse engineered. The successful proof of concept I read about changes the entries in /etc/passwd and /etc/shadow, which would be detectable from the operating system. If it inserted it’s own code in the kernel when it was being loaded, it would be much more difficult to detect. I can’t think of any way of checking the firmware where the malicious updater couldn’t just update the values to be checked against, as well. Anything such as an MD5sum would have to be updated when legitimate firmware was changed, it’d probably be possible for the malicious update to change the same value. If I were to say anything makes this impractical, it would be the large number of combinations of drive firmware and operating systems out there. You’d be aiming for a moving target, and only hitting a small proportion of them each time. I don’t know if you’d be able to hit enough victims to make the necessary work worthwhile. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [February 20, 2015, 5:30pm UTC](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150/20 "2015-02-20T17:30:56Z")
> [@Syne](#): > > There does appear to be two types of firmware. One on a chip, and one on the platter itself. Does this hack infect the first? > > [http://s12.postimg.org/8ia5ripil/Untitled.jpg](http://s12.postimg.org/8ia5ripil/Untitled.jpg) most likely the latter the former may not even have a mechanism to write to it outside the plant of the hard drive manufacturer. [Next page](https://boards.straightdope.com/t/nsa-malware-and-hard-drives/713150.md?page=2)