Malware and steganography in hard disk firmware

Abstract

The hard disk drive remains the most commonly used form of storage media in both commercial and domestic computer systems. These drives can contain a vast range of data both of personal value and commercial significance. This paper focuses on two key areas; the potential for the drive operation to be impacted by malicious software and the possibility for the drive firmware to be manipulated to enable a form of steganography. Hard drive firmware is required for the correct operation of the disk drive in particular for dealing with errors arising due to natural wear as the drive ages. Where an area of the drive becomes unreliable due to wear and tear, the disk firmware which monitors the reliability of data access will copy the data from the failing area to a specially designated reserved area. The firmware remaps this data shift so the old data area and the original copy of the data are no longer accessible by the computer operating system. There are now a small number of commercially available devices, intended for data recovery, which can be used to modify the hard drive firmware components. This functionality can be used to conceal code on the disk drive, either as a form of steganography or to potentially include malicious code with the intention to infect or damage software or possibly system hardware. This paper discusses the

Approximate MRAM: High-performance and Power-efficient Computing with MRAM Chips for Error-tolerant Applications

“…Prior works on typical digital steganography techniques either use unused metadata fields or exploit noise in the digital content where the hidden information is usually tied to the digital file itself or the file's content. In [17], firmware defines the hard disk drive's physical locations (sectors), which contains the hidden information, as unusable; hence, the operating system (OS) can not access those sectors, making the recovery process difficult and complicated. Moreover, the natural aging process introduces significant alterations in the analog domain that change the power-on state of the Static RAM (SRAM) cells, which can also be used for message hiding [18].…”

Forensic Trails Obfuscation and Preservation via Hard Drive Firmware

“…When the device is turned on the firmware will begin a self-check, this ensures correct device operation and will mark unreadable areas of the disk or hide any areas that are not used by the OS. Each device has specific firmware and unique checks (Sutherland, Davies and Blyth, 2011). However, each firmware has a similar layout.…”

Hiding Information in Flash Memory

“…However, hidden data is still innately tied to the existence of a digital file. Also, modifying hard drive firmware has been investigated as a potential way to hide information [14]. Data is hidden in sectors marked as unusable at the firmware level (instead of the OS or filesystem level), which renders the sectors inaccessible to most software and complicates recovery, as it is difficult to tell legitimately bad sectors from ones used for hiding.…”