NSA sponsored crackers have infected harddrive firmware for 14 years

fogpipe · 02-18-2015, 04:28 PM

http://arstechnica.com/security/2015...found-at-last/

The article (as far as i have gotten) seems to be focused on windows. Anyone know what this means, or how successful the same methods might be, for linux?

Quote:

In addition to planting exploits on the websites, the attack code was also transmitted through ad networks. The wide range of exploit carriers may explain why so many of the machines Kaspersky observed reporting to its sinkholes were domain controllers, data warehouses, website hosts, and other types of servers. Equation Group, it seems, wasn't infecting only end user computers—it was also booby-trapping servers known to be accessed by targeted end users.

Yikes!

Habitual · 02-18-2015, 04:45 PM

Yes, "Yikes!" indeed.

Miati · 02-18-2015, 05:50 PM

Quote:

Originally Posted by fogpipe

http://arstechnica.com/security/2015...found-at-last/

The article (as far as i have gotten) seems to be focused on windows. Anyone know what this means, or how successful the same methods might be, for linux?

Yikes!

Quote:

The CD from the 2009 Houston conference—which Kaspersky declined to identify, except to say it was related to science—tried to use the autorun.inf mechanism in Windows to install malware dubbed DoubleFantasy.

autorun.inf, of course.
Windows in admin is akin to Linux in root.
If you ran a linux virus from a cd as root, you can easily be infected.

If you follow the "normal" practice of doing 99% of stuff as a normal user, this would be contained within a users ~/ directory.
Bad, but won't compromise a system.

Quote:

By embedding malicious code inside the .LNK files, a booby-trapped stick could automatically infect the connected computer even when its autorun feature was turned off.

Again, don't run stuff as root.

fogpipe · 02-20-2015, 06:34 AM

Quote:

Originally Posted by Miati

Again, don't run stuff as root.

If the article is correct, and they have control of the hd firmware, at the file system level, and the malware loads with, or before, the os, im not sure root matters any more.

This is a diagram of how the malware loads in windows, note that the malware loads before the os loader:

http://cdn.arstechnica.net/wp-conten...boot-steps.png

veerain · 02-20-2015, 12:34 PM

With open source you know what your system is processing using cpu. Who knows what's inside the processor and any other hardware. For national security every chip/hw may be bugged. Can a user find out what's in them. And we try to improve the security of softwares very hard(perhaps not).

Miati · 02-20-2015, 06:49 PM

Quote:

Originally Posted by fogpipe

If the article is correct, and they have control of the hd firmware, at the file system level, and the malware loads with, or before, the os, im not sure root matters any more.

This is a diagram of how the malware loads in windows, note that the malware loads before the os loader:

http://cdn.arstechnica.net/wp-conten...boot-steps.png

True. I guess what I'm saying is don't let it get to that point. At some point it needs the permission to install the malware. If you permit it (admin in MS makes that easy) then it doesn't matter what os you use.

jefro · 02-20-2015, 09:01 PM

I think I'd need to see some proof of this.

I am sure however that there are many spies in the world on every side. There are countless crooks too that have only their own agenda.

My favorite device was still the art object Russia had in the US Embassy.

LinuxUser42 · 02-21-2015, 01:29 PM

Quote:

Originally Posted by veerain

With open source you know what your system is processing using cpu. Who knows what's inside the processor and any other hardware. For national security every chip/hw may be bugged. Can a user find out what's in them. And we try to improve the security of softwares very hard(perhaps not).

I would think that is part of why the various open bios projects came into being. People want to know what their computers are doing on a hardware level.

dragoraexpirafuego · 04-12-2015, 03:51 PM

I think we need an open source manufacturing project with lots of independent auditing to make a really secure processor + logic board.