sula napisał(a):
http://www.techpowerup.com/209925/nsa-hides-spying-backdoors-into-hard-drive-firmware.html
Cytuj:
Russian cyber-security company Kaspersky Labs exposed a breakthrough U.S. spying program, which taps into one of the most widely proliferated PC components - hard drives. With the last 5 years seeing the number of hard drive manufacturing nations reduce from three (Korean Samsung, Japanese Hitachi and Toshiba, and American Seagate and WD) to one (American Seagate or WD), swallowing-up or partnering with Japanese and Korean businesses as US-based subsidiaries or spin-offs such as HGST, a shadow of suspicion has been cast on Seagate and WD.
According to Kaspersky, American cyber-surveillance agency, the NSA, is taking advantage of the centralization of hard-drive manufacturing to the US, by making WD and Seagate embed its spying back-doors straight into the hard-drive firmware, which lets the agency directly access raw data, agnostic of partition method (low-level format), file-system (high-level format), operating system, or even user access-level. Kaspersky says it found PCs in 30 countries with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria.
Ten artykuł chyba trochę nierzetelny jest. Tzn mam wrażenie, że pada tam sugestia, że infekcja następuje na poziomie produkcji:
by making WD and Seagate embed its spying back-doors straight into the hard-drive firmwareNatomiast z tego co widzę w samym raporcie jest to trochę inaczej sformułowane:
Cytuj:
The EQUATION group’s HDD firmware reprogramming module is extremely rare.
During our research, we’ve only identified a few victims who were targeted by this
module. This indicates that it is probably only kept for the most valuable victims
or for some very unusual circumstances
Teoretycznie w całym fragmencie nie pada nawet słowo backdoor (chociaż hidden/undocumented api można chyba w ten sam sposób traktować). Infekcja natomiast dalej następuje w normalny sposób, tzn. targetowane ataki. Więc jest to raczej info z kategorii tych którymi akurat zwykły użytkownik nie musi się przejmować.
https://securelist.com/files/2015/02/Eq ... nswers.pdfhttp://niebezpiecznik.pl/post/rosjanie- ... zysta-nsa/BTW w raporcie nie pada słowo NSA ani razu, choć chyba jest to dosyć mocno zasugerowane.
