[Cryptography] Equation Group Multiple Malware Program, NSA Implicated

[John Gilmore]

> One question of detail -- are drives bus-masters on modern systems? 
> What does this drive do once it is pwned?  It would seem that just 
> seeing all the data come in isn't enough, it needs to be able to start 
> doing things actively.  If only to bypass the effects of FDE.

The simplest thing it can do is to read out malware-infested boot
code, but only right after reset (or during a pattern of accesses that
the BIOS uses during startup).  Anytime those sectors are read after
that, they appear to be perfectly normal.  And if you write to them,
they don't overwrite the malware.

If the system isn't using Full Disk Encryption, then there's lots more
that active disk drive malware can do.  All the instructions for all
the software that runs in the system are on the disk drive.  You
effectively have a man-in-the-middle attack between the CPU and the
drive platters, which can substitute data (e.g. the password file,
your .ssh config and cache), code (the login program), keys, web
server content (to attack people who access your web server), etc.

A mere disk drive, if properly programmed, can make your web server
serve different pages to different clients (including attack malware
to certain clients), examine the logfiles being written to itself in
order to detect incoming web accesses and respond individually to
them, etc.  Systems are just not written to assume malware in disk
drives, so they don't hide information from it that would help it
do nefarious things.

Once there's a MITM beachhead in the drive firmware, it can also be
configured to backdoor any number of likely installation candidates,
not just the software that happens to be installed on the drive at
that time.  So reinstalling the OS, or a later OS, or any OS
that boots with GRUB, say, doesn't present a problem to NSA.

If the system is using full disk encryption, then it needs to know the
keys and algorithms so it can see plaintext, but is otherwise the
same.  (Note that many disk drives now offer full disk
DRIVE-CONFIGURED AES encryption, done transparently to the software.
Just how much do you trust those drives?)

	John