Report: Spyware Hidden Deep Inside Hard Drives

[engine]

I'm not sure we're all the target of this as it appears, according to the report, that it's on hard drives destined for specific countries.

The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.Report: Spyware Hidden Deep Inside Hard Drives [reuters.com]

A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

NSA spokeswoman Vanee Vines declined to comment.

[lawman]

Ha, been reading that. Looks like whoever did it is onto something new now. Spooky.

[engine]

Not just hard drives. Basic spyware/adware has been found on usb memory. I've become more and more reluctant to insert usb memory i'm handed into anything other than a sacrificial machine.

If the government authorities are doing this, I agree, it's spooky and disturbing.

[creeking]

hmmm.


I wonder if that old 1-gig hard drive I have in the garage would be safer to use.

[engine]

It depends on what country you might be in, methinks.

[lucy24]

It depends on what country you might be in

Wouldn't it depend on how old the HD is?

[lawman]

Of course if we were doing it, we have to assume the other guys did too.

[graeme_p]

I doubt it is country dependent. - not reliably anyway. I doubt HD firmware is going to be country specific - there is no real need for it to be country specific, the distribution system is not going to be designed for it - I find it hard, that when a laptop factory is ordering hard drives they specify how many they need with US firmware, and how many with EU firmware etc. It is bad enough that they need to vary keyboards, but every variation in components adds complexity all the way up and down the supply chain.

@lawman, possibly, but I do not think any other government has as much influence over tech companies as the US does.

[lawman]

@Graeme_p

not talking about us at WW. Talking about the govt. Would be the gross negligence at the least for them not to make that assumption.

[lucy24]

It is bad enough that they need to vary keyboards

But that's just a matter of physically* swapping a few key caps to align with a default software setting. You've done it yourself by accident when cleaning a keyboard. The innards of the computer is a whole nother ballgame.


* Your computer doesn't "know" that the key labeled Q maps to codepoints 51 and 71. Or 5A and 7A if you move to Quebec. Changing your key caps won't convert QWERTY into AZERTY. Or Dvorak, for that matter.

[graeme_p]

@lawman, yes, I agree (any) govt should probably assume that their enemies are attempting this, but I doubt anyone other than the US would be anything like as successful.

[graeme_p]

The original report makes interesting reading.

[securelist.com...]

[graeme_p]

@lucy24, that is my point: they would rather make ev erythin identical to the last detail, minor changes, different keyboards are a nuisance, having another, component that is different will be even more of a nuisance.

I use a laptop with a US keyboard with UK mappings. I cannot just swap the keys round because of different combinations (with shift etc) but it still works fine (except I have to use alt key combinations for pipe and backslash).

[lucy24]

Well, you can always grab a sharpie and start marking up your keyboard. (I actually did this a few decades ago when I had one of those seethrough keyboard covers and couldn't remember where the GreekKeys diacritics went.) But can't you find a more congenial mapping?