Replies

Dose someone have a fix for it? Are there any scans that can detect the malicious code

Kaspersky is probably the very best virus lab in the world - No doubt being able to detect the bug is possible (and already accomplished, or they would not have in-the-wild statistics)... But hard drive firmware (and BIOS, modem, network,and video firmware) is normally not repairable without obtaining the specific software for the specific device and manually flashing (reloading/overwriting) the specific device. Not something for your average user, but any reasonably adept service tech could handle the job.

One might note that this entire problem is fixed just simply by designing the hardware to be unable to physically accept firmware revision without manually setting a jumper... A security oversight in favor of convenience, I suppose.

A write protect will not defend device firmware, at least not for something like a HDD. I know a former drive engineer, he told me that much of the firmware is actually on the disk, and extensible. He noted that most modern drives remap and move data from rough areas to good areas, all within the controller, transparent to the OS.

What this means, is that if someone knows how to hook the drive controller into code stored on disk, their software can install itself, then hide itself. Drives have had large ram caches for sometime, so probably pretty easy to whittle away a bit of that ram for some underhanded activity in the controller.

Basically there is no practical way for us end users and even engineers to control the entire chain. Many subsystems in the current pc have multiple teams working on just a single subsystem - and that is just the software side. One person to verify and vet all of the software would be impossible, not to mention the hardware itself.

So in digital systems, trust is a very flimsy concept, and it takes only a single line of code to open a hole. There are billions of lines of code in a PC.

Also, I have seen mention of “airgap” security. Wrong. No such thing exists. Modern cpus, gpus, controllers, etc are fast enough that they can create a radio transmitter out of the circuit board they are attach too. Just toggle a line rapidly, and you have a transmitter. Infect the target, have wet assets drive by that office every night with a modem that can grab the radio signal.