undefined

points

[-]

They can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.

https://spritesmods.com/?art=hddhack&page=1

by TheDong3 hours ago|

parent|

[-]

That's a cool thought experiment, but it doesn't work in practice.

> When it sees a certain string in any write to the disk

dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.

by close041 hours ago|

parent|

[-]

The general point related to the topic of the article is that the many controllers running on your device (not limited to Lenovo BTW) are black boxes almost impossible to inspect. The encryption engine on a hardware encrypted USB stick is making everything even harder. It can implement something like this but it's probably made to be extremely difficult to dump the firmware or inspect the features implemented in silicon.

If I'm doing software encryption like dm-crypt or zfs encryption then I don't need to bother with hardware encryption too. It's easier to trust software encryption. We have many interoperable and even open source implementations of the same encryption methods, the output is readable in open formats, so they can be validated against each other if needed.

by sandworm10149 minutes ago|

parent|

prev|

[-]

>> will encrypt the data before it's written to disk

The people buying much of these "hardware encryption" products do so because they believe it removes the need for software encryption to/from the device.

by PorciiVorbesc11 hours ago|

parent|

prev|

[-]

>They can hide it in your storage firmware

Everything you wrote is not an exclusive Lenovo risk and vulnerability but applies to every piece of compute sold in the worlds.

by autoexec10 hours ago|

parent|

[-]

True, but Lenovo has repeatedly demonstrated that they're willing to do it, lie to customers giving them a false sense of security while leaving them vulnerable, and will continue to put their customers at risk even after being caught several times.

by daneel_w12 hours ago|

prev|

[-]

> How can I be sure my lenovo laptop is safe?

You cannot.

by Krutonium11 hours ago|

prev|

[-]

Honestly that would be a decent way to become internet famous for a bit lol.