Incident: Firmware Cyber-Attacks on Businesses: Neglected Threats and Implications

Published Date: 2015-02-22

Postmortem Analysis
Timeline 1. The software failure incident mentioned in Article 33333 happened in 2010 and 2013 [33333]. 2. The software failure incident mentioned in Article 113389 happened in the past two years from the article's publication date in April 2021. Therefore, the incident occurred between April 2019 and April 2021.
System 1. Hard drive firmware of various brands including IBM, Seagate, Western Digital, and Toshiba [33333] 2. Motherboard firmware [113389]
Responsible Organization 1. Equation Group (believed to be a product of the NSA) [33333] 2. Cyber-criminals targeting big organizations [113389]
Impacted Organization 1. The Equation Group and its victims were impacted by the software failure incident involving the firmware-flashing module designed to reprogram hard drive firmware with malicious code [33333]. 2. Businesses globally, including enterprises in the UK, US, Germany, Japan, and China, were impacted by firmware attacks as reported by Microsoft's survey [113389].
Software Causes 1. The failure incident was caused by a mysterious module designed to reprogram or reflash a computer hard drive's firmware with malicious code, surpassing anything else seen before. This module, named "nls_933w.dll," was used with the EquationDrug and GrayFish spy platforms [33333]. 2. The firmware flasher module deposited onto the system reached out to a command server to obtain payload code that it then flashed to the firmware, replacing the existing firmware with a malicious one. This allowed attackers to stay on the system even through software updates [33333]. 3. The firmware hack helped store data the attackers wanted to steal by creating hidden storage space on the hard drive, bypassing disk encryption. The attackers could access this hidden area to retrieve the stolen data later [33333]. 4. The firmware flasher module could reprogram the firmware of more than a dozen different hard drive brands, including IBM, Seagate, Western Digital, and Toshiba, showcasing the attackers' technical capabilities [33333]. 5. The attackers could hide large caches of documents in the service area of the hard drive disk, which contained large portions of unused space that could be commandeered for stealth storage [33333].
Non-software Causes 1. Lack of cryptographic signing of firmware by hard disk makers, leaving firmware vulnerable to alteration [33333]. 2. Absence of authentication in hard drive disk designs to check for signed firmware, enabling unauthorized changes to firmware [33333]. 3. Unused storage space in ROM chips of hard drives being exploited to hide data, bypassing encryption [33333]. 4. Unused large sectors in the service area of hard drive disks being commandeered to store data, potentially leading to data loss or drive failure [33333]. 5. Modification of hard drive firmware by attackers to hide data in covert storage areas, preventing detection of the true amount of free space on the disk [113389].
Impacts 1. The software failure incident involving the Equation Group's firmware-flashing module allowed attackers to reprogram hard drive firmware with malicious code, giving them stealthy and persistent control over systems, even through software updates. This impacted at least 500 victims, with only five having the firmware-flashing module on their systems [33333]. 2. The firmware hack helped store data that attackers wanted to steal in hidden areas on the hard drive, bypassing disk encryption. This allowed attackers to conceal documents and encryption passwords in the hidden areas for later retrieval, impacting the security of high-value computers not connected to the internet and protected with disk encryption [33333]. 3. The firmware attack described in the articles highlights the significance of protecting firmware from cyber-attacks. It mentions that 80% of firms surveyed had experienced at least one firmware attack in the past two years, indicating a widespread impact on businesses globally. Despite this, only 29% of security budgets were allocated to protect firmware, potentially leaving many organizations vulnerable to such attacks [113389].
Preventions 1. Implementing cryptographic signing of firmware by hard disk makers to ensure the integrity of the firmware installed on drives [33333]. 2. Building authentication mechanisms into hard drive disk designs to verify signed firmware for authenticity [33333]. 3. Regularly updating firmware with security patches to address vulnerabilities and prevent malicious tampering [113389]. 4. Allocating more resources and budget towards protecting firmware from cyber-attacks, as highlighted by Microsoft's report [113389].
Fixes 1. Implementing firmware security measures such as protecting firmware from tampering and ensuring firmware updates are applied regularly [113389]. 2. Developing secure hardware components that can prevent firmware attacks [113389]. 3. Increasing awareness and attention to hardware security, including firmware, in the technology industry and among businesses [113389]. 4. In the case of the specific incident involving the Equation Group's firmware-flashing module, victims may need to replace their hard drives to fully address the issue [33333].
References 1. Kaspersky researchers [33333] 2. Microsoft [113389] 3. Cyber-security researcher Robert Potter [113389] 4. Security firm Malwarebytes [113389] 5. Security researcher Gabriel Cirlig [113389] 6. National Institute of Standards and Technology (NIST) [113389]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to firmware attacks has happened again at Microsoft. The article mentions that Microsoft recently put out a report claiming that businesses globally are neglecting the need to protect computers, servers, and other devices from firmware attacks, despite experiencing firmware attacks themselves [Article 113389]. (b) The software failure incident related to firmware attacks has also happened at other organizations. The Kaspersky researchers uncovered a spying network called Equation Group, which had a module designed to reprogram computer hard drive firmware with malicious code. This incident involved victims targeted by the Equation Group, indicating that similar attacks have occurred at multiple organizations [Article 33333].
Phase (Design/Operation) design, operation (a) The software failure incident occurring due to the development phases related to design: - The incident described in Article 33333 is related to a software failure that occurred due to the design phase. The Equation Group developed a sophisticated hacking tool that involved subverting hard drive firmware with malicious code, surpassing anything seen before. The firmware-flashing module was designed to reprogram the firmware of various hard drive brands, allowing attackers to have persistent control over the system even through software updates. This failure was a result of the attackers exploiting the lack of security measures in the design of hard drive firmware, enabling them to conceal malware in the firmware, which antivirus scanners do not typically examine [33333]. (b) The software failure incident occurring due to the development phases related to operation: - The incident described in Article 113389 is related to a software failure that occurred due to the operation phase. Cyber-criminals have been designing malware that tampers with firmware in motherboards or hardware drivers, bypassing the computer's operating system and software designed to detect malware. This type of attack targets big organizations and can lead to data theft, system damage, and spying. The failure in this case is attributed to the neglect of firmware security by many firms, as firmware patching can be tricky and is often overlooked, creating a blind spot in cybersecurity practices [113389].
Boundary (Internal/External) within_system (a) The software failure incident discussed in the articles is primarily within_system. The incident involves firmware attacks that tamper with the firmware in hardware components of computers, servers, and devices. Cyber-criminals are designing malware to manipulate the firmware, which is a type of permanent software code controlling hardware components. This attack bypasses the computer's operating system and software designed to detect malware, as the firmware code is at a lower layer. Firmware attacks like RobbinHood ransomware and Thunderspy exploit vulnerabilities in firmware to gain access, encrypt data, and steal information [Article 113389]. The incident involves the manipulation of firmware within the system, highlighting the importance of protecting firmware from attacks originating from within the system itself.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The incident described in Article 33333 involves a firmware-flashing module named "nls_933w.dll" that is designed to reprogram or reflash a computer hard drive's firmware with malicious code. This module is used with spy platforms like EquationDrug and GrayFish and can subvert hard drive firmware, giving attackers control of the system in a stealthy and persistent manner [33333]. (b) The software failure incident occurring due to human actions: - The article in Article 113389 discusses firmware attacks that involve cyber-criminals designing malware to tamper with firmware in motherboards or hardware drivers. These attacks bypass the computer's operating system and can lead to serious consequences like data theft, system damage, and spying. The neglect of firmware security by firms and the complexity of firmware patching contribute to making firmware attacks a blind spot in cybersecurity [113389].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The incident described in Article 33333 involves a software failure incident that is related to hardware. It discusses how cyber-criminals are designing malware that tampers with the firmware in motherboards and hardware drivers, which are essential hardware components in a PC [113389]. - The firmware attack described in Article 113389 involves cyber-criminals targeting the firmware in motherboards and hardware drivers, which are hardware components of a computer system. This attack bypasses the computer's operating system and software designed to detect malware by tampering with the firmware code in the hardware [113389]. (b) The software failure incident occurring due to software: - The incident described in Article 33333 involves a software failure incident that is related to software. It discusses how a mysterious module named "nls_933w.dll" was designed to reprogram or reflash a computer hard drive's firmware with malicious code, surpassing anything else seen by the researchers. This module, used with spy platforms like EquationDrug and GrayFish, can subvert the firmware of hard drives, giving attackers control of the system in a stealthy and persistent manner [33333]. - The firmware attack described in Article 113389 involves cyber-criminals designing malware that tampers with the firmware in motherboards and hardware drivers, which are software components controlling hardware in a PC. This attack bypasses the computer's operating system and software designed to detect malware by tampering with the firmware code in the hardware [113389].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident discussed in Article 33333 is malicious in nature. The incident involves a sophisticated hacking tool believed to be a product of the NSA, which subverts hard drive firmware with malicious code to give attackers God-like control of the system. The firmware-flashing module named "nls_933w.dll" is designed to reprogram the firmware of various hard drive brands, allowing attackers to hide data stolen from the system in invisible storage space on the hard drive. This incident demonstrates a deliberate attempt to compromise systems for surveillance purposes [33333]. (b) The software failure incident discussed in Article 113389 is non-malicious in nature. It highlights firmware attacks where cyber-criminals tamper with firmware in motherboards or hardware drivers to bypass a computer's operating system or detection software. The article emphasizes that firmware attacks are often overlooked by firms, and the lack of attention to firmware security can lead to serious consequences such as data theft, system damage, and spying. The incidents mentioned in the article, such as RobbinHood ransomware and Thunderspy attack, illustrate the potential risks associated with firmware vulnerabilities [113389].
Intent (Poor/Accidental Decisions) poor_decisions The intent of the software failure incident discussed in the articles is related to **poor_decisions**. - The incident involving the firmware-flashing module designed to reprogram hard drive firmware with malicious code by the Equation Group, believed to be a product of the NSA, demonstrates a deliberate and sophisticated approach to subverting firmware for surveillance purposes [33333]. - The article highlights that firmware attacks are a result of neglecting key aspects of cybersecurity, such as protecting devices from firmware attacks, and the lack of allocation of security budgets towards firmware protection, indicating poor decisions in prioritizing cybersecurity measures [113389].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence is evident in the discovery of the Equation Group's firmware-flashing module designed to reprogram hard drive firmware with malicious code. This module, named "nls_933w.dll," was found to be able to subvert hard drive firmware, giving attackers God-like control over the system persistently even through software updates. The incident showcases the high level of technical expertise and competence required to develop such a sophisticated and stealthy attack tool [33333]. (b) The software failure incident related to accidental factors is highlighted in the neglect of firmware security by businesses globally. Despite the increasing prevalence of firmware attacks, many firms are neglecting to allocate sufficient resources to protect against such attacks. This negligence can be attributed to a lack of awareness or oversight rather than intentional actions, leading to vulnerabilities that cyber-criminals can exploit [113389].
Duration permanent (a) The software failure incident described in the articles is more of a permanent nature. The incident involves firmware attacks that tamper with the firmware in hardware components, such as motherboards and hardware drivers, which control the hardware components in a PC [113389]. These firmware attacks are designed to bypass the computer's operating system and any software meant to detect malware, making them difficult to detect and remove [113389]. Firmware attacks, like the RobbinHood ransomware and Thunderspy attack, can lead to serious consequences such as data encryption, data theft, system damage, spying, and more [113389]. The article emphasizes that firmware attacks are a significant concern for businesses, and the National Vulnerability Database has recorded a five-fold increase in attacks against firmware in the last four years [113389]. Additionally, the incident described in the articles involves a sophisticated firmware implant developed by the NSA that modifies the firmware of a hard drive to hide data in covert storage areas, making it invisible and inaccessible unless a custom command is sent to unlock it [33333]. This implant aims to prevent the system from disclosing the true amount of free space available on the disk, allowing for hidden storage space that can be accessed later [33333]. The firmware implant's capabilities suggest a long-term strategy for storing and retrieving data covertly, indicating a permanent impact of the software failure incident [33333].
Behaviour omission, value, byzantine, other (a) crash: The articles do not mention any specific software failure incident related to a crash. (b) omission: The firmware attack incidents described in the articles can be related to omission failures as they involve malware tampering with firmware in a way that bypasses the computer's operating system or any software designed to detect malware, leading to the system omitting to perform its intended functions correctly [113389]. (c) timing: The articles do not mention any specific software failure incident related to timing failures. (d) value: The firmware attack incidents described in the articles can be related to value failures as they involve malware tampering with firmware to perform malicious actions such as gaining root access, encrypting files, and stealing data, causing the system to perform its intended functions incorrectly [113389]. (e) byzantine: The firmware attack incidents described in the articles can be related to byzantine failures as they involve malware behaving in a stealthy and persistent manner, subverting the firmware to gain control of the system, and concealing stolen data in hidden areas of the hard drive [33333, 113389]. (f) other: The other behavior described in the articles is related to the firmware attacks being a significant security concern that many firms overlook, leading to a blind spot in cybersecurity practices and potentially serious consequences such as data theft, system damage, and spying [113389].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence theoretical_consequence (a) death: People lost their lives due to the software failure - There is no mention of people losing their lives due to the software failure incident in the provided articles [Article 33333, Article 113389]. (b) harm: People were physically harmed due to the software failure - There is no mention of people being physically harmed due to the software failure incident in the provided articles [Article 33333, Article 113389]. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted due to the software failure incident in the provided articles [Article 33333, Article 113389]. (d) property: People's material goods, money, or data were impacted due to the software failure - The software failure incidents described in the articles primarily focus on cyber-security threats related to firmware attacks, where data security and privacy are at risk. There is no direct mention of people's material goods, money, or data being impacted as a consequence of the software failure incident [Article 33333, Article 113389]. (e) delay: People had to postpone an activity due to the software failure - There is no mention of people having to postpone an activity due to the software failure incident in the provided articles [Article 33333, Article 113389]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incidents described in the articles primarily focus on cyber-security threats related to firmware attacks, affecting computer systems and data. There is no specific mention of non-human entities being impacted as a consequence of the software failure incident [Article 33333, Article 113389]. (g) no_consequence: There were no real observed consequences of the software failure - The articles clearly discuss the significant consequences of firmware attacks on data security and privacy, indicating that there are observed consequences of the software failure incident [Article 33333, Article 113389]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles discuss potential consequences of firmware attacks, such as data theft, system damage, spying, and more, which are considered serious but not explicitly mentioned as occurring in the reported incidents. These potential consequences are discussed in a theoretical context [Article 33333, Article 113389]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - The articles primarily focus on the implications of firmware attacks on data security and privacy, highlighting the risks posed by such cyber-security threats. The consequences discussed revolve around potential data theft, system compromise, and espionage, emphasizing the importance of protecting firmware from malicious tampering [Article 33333, Article 113389].
Domain information, health, government (a) The failed system was related to the information industry as it involved a spying network discovered by Kaspersky researchers, which included a module designed to reprogram computer hard drive firmware with malicious code. This incident was significant in terms of cybersecurity and espionage [Article 33333]. (j) The incident also had implications for the health industry as one of the machines affected by the firmware-flashing module was used for special secure communications, indicating potential use in sensitive areas like healthcare or other industries requiring high levels of security [Article 33333]. (m) The incident could also be related to the government industry as the spying network Equation Group, believed to be associated with the NSA, was involved in the development and deployment of the firmware-flashing module for espionage purposes. This highlights the potential impact on government operations and national security [Article 33333].

Sources

Back to List