Reply to thread

Message

<blockquote data-quote="Digerati" data-source="post: 719989" data-attributes="member: 59833">Did you actually read that article? (correct link <a href="https://www.kaspersky.com/blog/equation-hdd-malware/7623/" target="_blank">here</a>)First, the article was from over 3 years ago - ancient history in the computer and computer security industries. And second, did you see where the author noted the threat was, &quot;as rare as pandas walking across the street.&quot;Bad guys are lazy opportunists. As that article noted, it would take extensive engineering, months of development, and millions in investments to develop such code and that has to be done for each and every hard drive model and firmware version out there - and there are probably 1000s of those. Note drive makers frequently update and revise the firmware for existing models and new drive models come out all the time. Not to mention SSDs are becoming more prevalent, especially as boot drives and SSDs are not subject to this type malware.&nbsp; So there are no lists of vendors affected because this is not happening. There is no chance the bad guys will get their investment money back so they are not going to do it. So such malware is limited to &quot;State&quot; funded spy agencies used for cyberwarfare purposes on enemy countries or terrorist organizations.But even in those cases, it is important to note the payload (information the spies are looking for) can only be retrieved through physical possession and analysis of the affected drive. That is, the spies would have to break into your home or place of work, install the malware in your drive without you knowing they were ever there, then come back some time later (perhaps weeks, months or even years later), and steal the computer to retrieve the data. Bottom line is this: If you were a target (or perpetrator!) of such an attack, you would not need to be asking such questions here, on a public forum like this!Drive makers don&#039;t encrypt their firmware. There&#039;s no need to. And it would not stop this type malware anyway.</blockquote>

[QUOTE="Digerati, post: 719989, member: 59833"] Did you actually read that article? (correct link [URL='https://www.kaspersky.com/blog/equation-hdd-malware/7623/']here[/URL]) First, the article was from over 3 years ago - ancient history in the computer and computer security industries. And second, did you see where the author noted the threat was, "[I]as rare as pandas walking across the street.[/I]" Bad guys are lazy opportunists. As that article noted, it would take extensive engineering, months of development, and millions in investments to develop such code and that has to be done for each and every hard drive model and firmware version out there - and there are probably 1000s of those. Note drive makers frequently update and revise the firmware for existing models and new drive models come out all the time. Not to mention SSDs are becoming more prevalent, especially as boot drives and SSDs are not subject to this type malware. So there are no lists of vendors affected because this is not happening. There is no chance the bad guys will get their investment money back so they are not going to do it. So such malware is limited to "State" funded spy agencies used for cyberwarfare purposes on enemy countries or terrorist organizations. But even in those cases, it is important to note the payload (information the spies are looking for) can only be retrieved through [U]physical possession[/U] and analysis of the affected drive. That is, the spies would have to break into your home or place of work, install the malware in your drive without you knowing they were ever there, then come back some time later (perhaps weeks, months or even years later), and steal the computer to retrieve the data. Bottom line is this: If you were a target (or perpetrator!) of such an attack, you would not need to be asking such questions here, on a public forum like this! Drive makers don't encrypt their firmware. There's no need to. And it would not stop this type malware anyway. [/QUOTE]

Verification