Equation Group's Malware - Hard Drive Firmware Update - A possible fix?

Toggle sidebar Toggle sidebar
S

souldjers3v3n

Reputable
Feb 18, 2015
1
0
4,510
Hi Everyone,

The more I read about the Equation Group, the more I get worried that any hard drive out there is unsafe... That being said, does anyone here (with divine intervention) know if a firmware update could possibly resolve these malware infections integrated into a hard drives already infected firmware? And should these manufactures new firmware even be trusted? Granted - these are targeted attacks - but the privacy issues involved are outrageous. According to sources, the hard drive firmware source code would have to have been modified. Meaning the Equation Group had direct access to the manufactures hard drive firmware source code in the first place. Now, how is THAT possible.

I believe this calls for open source firmware... for every piece of hardware - Granted this may not come about for years to come - but believe me, security is a joke today and this about puts the nail in the coffin.

Tom's Hardware - Please have you IT Guru's or Security team look into this if at all possible!

I'm not looking for conspiracy theories here, this is a real world case / issue and I'm looking for real world factual resolutions - patches - answers.

Equation Group's Malware:
https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf

"... a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate."

Thanks!
 
Solution
F
I would expect that a firmware update would have a good chance of wiping out the malware. A drive's firmware consists of numerous modules, some in "ROM" on the PCB, but mostly in a reserved System Area (SA) on the platters. A few of these modules contain code, while most appear to contain data (eg SMART values, defect lists, translator, production logs). The malware would undoubtedly target the major code modules. It is usually these code modules that are targeted by a firmware update.

My advice would be to obtain an appropriate tool for your drive and use it to make a backup copy of your drive's firmware resources.

For example, the demo version of SeDiv will work with WD drives...
Sort by date Sort by votes
D

DataMedic

Honorable
Nov 22, 2013
384
0
10,960
On this forum thread: http://www.data-medics.com/forum/viewtopic.php?f=5&t=163 we've started a challenge among data recovery professionals to come up with a detection means for affected drive firmware. I don't expect it will take that long to find the code once we have a couple known infected drives to work with. (hoping Kaspersky will share one with us)

However it likely will take sophisticated equipment like PC-3000 to properly detect and remove the code. So this will likely be a service that will require data recovery personnel to come on site and test each drive in high security companies.

Seems, that it wasn't written into the drives from the factory, but rather is added in by a virus when the group activates it.
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,362
740
36,390
I would expect that a firmware update would have a good chance of wiping out the malware. A drive's firmware consists of numerous modules, some in "ROM" on the PCB, but mostly in a reserved System Area (SA) on the platters. A few of these modules contain code, while most appear to contain data (eg SMART values, defect lists, translator, production logs). The malware would undoubtedly target the major code modules. It is usually these code modules that are targeted by a firmware update.

My advice would be to obtain an appropriate tool for your drive and use it to make a backup copy of your drive's firmware resources.

For example, the demo version of SeDiv will work with WD drives.

http://sediv2008.narod.ru/Easy3.9Password01234567890.rar
http://sediv2008.narod.ru/Settings.rar

SeDiv WD Read ROM & Modules:
https://www.youtube.com/watch?v=9UgFfhkkAwY

I suspect that in WD's case, the malware would hide in the ROM and module 11 (aka "loader").

There are other tools for other drives at http://www.hddoracle.com and http://malthus.mooo.com.
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom