[Cryptography] trojans in the firmware

[grarpamp]

On Wed, Feb 18, 2015 at 8:57 PM, Henry Baker <hbaker1 at pipeline.com> wrote:
> At 03:12 PM 2/18/2015, grarpamp wrote:
>>Afaik, all vm's today simply pass through all drive commands.
>>
>>It seems a move all the BSD's and Linux could make today,
>>without waiting on untrustable hardware vendors to roll out signature
>>verification in hardware, is to simply kernel block all commands
>>unnecessary to actual production use of the disk. Permit only
>>from a list of READ, WRITE, ERASE, INQ, TUR, RST, and so on.
>>Thus every other command component, including firmware update,
>>vendor specific, and binary fuzzing, gets dropped and logged.
>
> ????  If the disk drive or flash drive firmware has already
> been compromised, none of this will work, because the firmware
> simply waits for the appropriate "legitimate" read & write
> commands, and does its thing.

Obviously. This is only meant to help protect clean
systems, or prevent subsequent malicious commands if
they happen to go through a user to kernel path that has
for some reason not yet been compromised (say through
the usual /dev to driver to hardware path).

> BTW, what happens with "emulated" disks -- e.g., .vdi files --
> in vm's ?  Presumably these emulated disks have no firmware to
> update, so any attempt would either be ignored or crash the
> system.

Depends on how the vm is coded. My guess is vm's that emulate
say disk devices, munge those opcodes too. Yes, looking at how
virtualbox and even lightweight instances like jails code/handle it
could be useful. Try it and see :)

In all cases, having the logging capability for non production
opcodes without having to postfilter them out of some
debugging stream would be nice. Obviously again caveat
parts of the system that have not been compromised,
and defense in depth.