Long article on Wired about it:
http://www.wired.com/2015/02/nsa-firmware-hacking/

Now that it has been discovered, I should think antivirus software could be written to at least detect it in action, followed by some kind of 'fix', possibly involving a redesigning of the HD firmware?

well, going by what's already been said...

Quote

Because the OS normally doesn't provide low level access to drive hardware to even an administrative user.

It's not just that -- if the malware tampers with the HARD DRIVE FIRMWARE, it can essentially make the hard drive return fake data, etc.  Even with the lowest level access to the hard drive, the hard drive firmware can hide any changes.  The only way to fix would be to reflash the hard drive firmware -- and it may very well be that the firmware changes make reflashing impossible via software.

There is no defense against this.

Its like a rootkit- that once it gets into your hard drive the only way out is to replace the drive controller with a known-good version and then very carefully salvage data without letting the virus be reactivated.

Quote from: SeraphimLabs on February 18, 2015, 09:33 PM

the task of delivering it to the target to infect the new hard drive without the OS noticing

like... packaging it as a critical update from the drive manufacturer... which we regularly install on customer equipment...

The best defense I've come up with so far is for the vendors to put a jumper on the drive that must be toggled to allow firmware writes.

Unfortunately this scenario defeats that type of defense, because the technician would move the jumper to install what is perceived to be a legitimate update and then unknowingly install the malicious version.

Having such a jumper would be a good first-line defense though to prevent automated deployment. The drive is wired such that with the jumper open the drive acts as hard drives currently do, but cannot install firmware. You would then shut the jumper to install a firmware update- but with the jumper shorted for firmware updates the drive would be prohibited from normal operation.

Once it gets into the drive its too late. You would have to access the drive's firmware without using the standard interface or letting the controller boot up, and compare the contents to a known-good version. If it starts running the infected firmware it could easily jump the gap and infect the known-good media as well, and would definitely attempt to hide itself.

A hardware jumper to enable any firmware flashing seems like a great idea for all devices.

Quote from: mouser on February 26, 2015, 06:57 PM

A hardware jumper to enable any firmware flashing seems like a great idea for all devices.

hey!  I like that!

I did too initially, but I don't think it will scale well for data centers that have (SAN) racks full of drives that would then need to be physically touched.

Quote from: superboyac on February 26, 2015, 11:01 PM

Quote from: mouser on February 26, 2015, 06:57 PM

A hardware jumper to enable any firmware flashing seems like a great idea for all devices.

hey!  I like that!

I did too initially, but I don't think it will scale well for data centers that have (SAN) racks full of drives that would then need to be physically touched.

The way I learned IT stuff, you don't upgrade any sort of firmware unless you either have issues to be corrected or are trying to add new features.

A data center would probably not be upgrading hard drive firmware in the first place unless they had a bad batch of drives that came through bugged, and such machines would likely already have had their drives exchanged for bug-free versions to maintain uptime.

Having a jumper setting to enable/disable firmware updates would provide containment for such malware and would prevent fully automated malware from installing exploits at that level because the typical user would not ever open the case let alone move the jumper to install the update.

It would not protect against intentional sabotage or a technician unknowingly installing a bugged update.

I've seen reports of firmware deliveries being intercepted en-route and physically modded with spyware.

I remember reading 2 reports, though I forget the exact details and links.

In one case, a security researcher (?) ordered a drive through Amazon (?), and tracked the shipping as it was routed across the country to some place in Virginia (?) (which has an army base or intelligence service), and then back over to the person. I'm fuzzy on the details, but that was the gist.

Does anyone have links? Or remember the details?

Are Your Computer Devices Hardwired for Betrayal?
"How Do We Fix It?
1. Firmware must be properly audited.....
2. Firmware updates must be signed......
3. We need a mechanism for verifying the integrity of installed firmware......."