7

I saw a very interesting answer stating that something else than hdd or ssd can be infected : Can a computer virus be stored somewhere else than on the hard drive?

It is very important for me to be sure that I'm in a secured environnement, especially when I'm making a system image.

As for my question, I'd like to know the most effective way to determine if a firmware/hardware other than hdd/ssd is infected (and how to secure it if it is). I currently use Avira Antivirus + Malwarebytes Anti Malware. I want to be sure that my computer, when plugged offline, is secured after restoring my system image.

This includes:

  • Bios / Uefi
  • System Management Mode (SMM)
  • GPUs
  • Network cards
  • And possibly others I'm not aware of.

I know it is very difficult for someone to infect those elements, and unlikely to happen, but it is still in the realm of possibilities hence we should have the needed knowledge required to know if we are infected and to protect us against those.

user9203881
  • 71
  • 5
  • Are you hoping for a magic solution? There is none. ... And, btw, restoring your HDD (data) backup doesn't do anything to your HDD firmware. – user155462 Oct 04 '17 at 11:39
  • Most of the item mentioned are susceptible to exploit should a vulnerabilities found, but injecting a malware and stay inside the hardware is a different story, i.e. conspiracy story. (If you afraid of unknown malware, just get your clean source OS and install them in offline mode) – mootmoot Oct 04 '17 at 11:53
  • 1
    Maybe there is no magic solution, but there is a best solution even though it is not the "best possible". As for the clean source OS, it seems you can't be sure of being in a secured system even if you re format. – user9203881 Oct 04 '17 at 13:08
  • @mootmoot How can you say that, given that there are known real-world examples? – user155462 Oct 04 '17 at 15:02
  • @user155462 conspiracy story != conspiracy theory. Conspiracy story is something like stuxnet, or those CIA/NSA backdoor. It is known conspiracy some electronics are tampered when shipping to the target end user. – mootmoot Oct 04 '17 at 15:12

3 Answers3

1

In theory you computer contains several critical devices with software writeable firmware. We know that there are a couple of bad guys infecting firmware (https://leaksource.wordpress.com/2013/12/30/nsas-ant-division-catalog-of-exploits-for-nearly-every-major-software-hardware-firmware/).

Pretty much any device connected to your PCI bus could take over your system for example by reading / writing memory.

In theory your hardware could even have been backdoored at the factory.

But to my knowledge so far we have not seen this stuff in the wild. So if you are not being specifically targeted by nation state actors you are not in danger.

Your Avira AV (one of the better AVs out there) would probably not help you since it doesn´t look at your firmware and I I would guess Avira has close to 0 samples of backdoored firmware so far. But yes, if your firmware later drops cheap malware into userspace the malware could get detected.

manduca
  • 1,111
  • 7
  • 10
  • I'm not targeted by nation states as far as I know ahah. So if I understand, there is 0 way to detect such uncommon malwares, even by using those pre-OS bootable cd malwares scan ? Which would mean, the only thing to do is to live with it, knowing it is not detectable by today's solutions. – user9203881 Oct 04 '17 at 13:12
  • Alternatively, perhaps we could scan our files in a second system if we want to be sure to be free from an infection, since having 2 "firmware infected computer" is even less likely to happen. – user9203881 Oct 04 '17 at 13:15
  • 1
    @Chatai Except scanning your files won't help, because a infected device firmware is no "file" that your OS and AV software will access. If the scanning computer is the infected one or not doesn't matter. – user155462 Oct 04 '17 at 15:04
  • Which would confirm that there's not much we can do for that particular malwares, apart from making sure our data is backed up effectively. – user9203881 Oct 04 '17 at 15:20
1

Reverse Engineer your system!

One thing that you can do is watch the network traffic of your pc using an IDS (like snort), since it is probably sure that the malware will eventually contact the mother-ship through internet.

I advise you to read the practical malware analysis book, there you can find how such a thing is achieved in detail.

If after multiple reinstallations of OS'es you still catch network signatures of malware , then try installing an alternative OS other than windows , since the malware may not be able to spread on OS'es other than windows

Getting rid of the virus once and forever!

If you are sure that you found something try starting your pc with different parts in it , while monitoring your network. You will eventually find the problematic part.

AXANO
  • 899
  • 7
  • 23
0

I'm pretty sure any non-volatile, writeable storage can be tampered with if the hacker has enough skills. We know for a fact that there's malware created by state actors and non that infects HDD controllers, UEFI, router firmware, and so forth, basically a rootkit so that it keeps injecting code into the the main drive space even if you reinstall the OS or upgrade the firmware. I don't think there's a realistic way to scan all the components in your computer. Commercial anti-virus software will probably not do anything even if it comes with "rootkit protection". But maybe if you search for how to protect against rootkits, you may find some commercial software I suppose.

But at the same time, these kinds of malware/rootkit are pretty rare I think, as there's plenty of attack vectors that users interact with. Other users may know much more, but typically these things come out of the NSA or some big organization for targeted attacks.

Edit: Maybe heuristic AV might be better suited to detect these, but that completely depends on what the rootkit/malware does. If it repeatedly injects some payload onto the main drive upon boot, something like that could be easier to detect, although it may not be able to tell exactly where it's coming from.

Maarten Bodewes
  • 4,562
  • 15
  • 29
downwardCorgi
  • 169
  • 4
  • After some research I've seen that there is some programs dedicated to search those "rootkits", named for instance GMER, Hitman Pro, and Malwarebytes. Malwarebytes specifically made a separate rootkit scanner, which they integrated since in their main Malwarebytes program. So it seems that Avira + Malwarebytes with rootkit scan enabled is the best kind of solution the general public can have. – user9203881 Oct 04 '17 at 15:18