alt Hacker NewsThey can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.
Replies
>They can hide it in your storage firmware
Everything you wrote is not an exclusive Lenovo risk and vulnerability but applies to every piece of compute sold in the worlds.
That's a cool thought experiment, but it doesn't work in practice.
> When it sees a certain string in any write to the disk
dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.