SWAP: NSA Exploit of the Day
Today’s item from the NSA’s Tailored Access Operations (TAO) group implant catalog:
SWAP
(TS//SI//REL) SWAP provides software application persistence by exploiting the motherboard BIOS and the hard drive’s Host Protected Area to gain periodic execution before the Operating System loads.
(TS//SI//REL) This technique supports single or multi-processor systems running Windows, Linux, FreeBSD, or Solaris with the following file systems: FAT32, NTFS, EXT2, EXT3, or UFS1.0.
(TS//SI//REL) Through remote access or interdiction, ARKSTREAM is used to reflash the BIOS and TWISTEDKILT to write the Host Protected Area on the hard drive on a target machine in order to implant SWAP and its payload (the implant installer). Once implanted, SWAP’s frequency of execution (dropping the playload) is configurable and will occur when the target machine powers on.
Status: Released / Deployed. Ready for Immediate Delivery
Unit Cost: $0
Page, with graphics, is here. General information about TAO and the catalog is here.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.
4g5nk54jgn54kjn • February 6, 2014 2:44 PM
You can dump the code using a driver or real mode OS.
FYI it’s BIOS code that sets the HPA registers not firmware ROM. It may be possible to do it from the ROM backdoor though through intercepting and injecting ATA register calls.
I also wonder if NSA and Computrace have any deal? Computrace implants BIOS rootkits at the foundry on a lot of units..
At least it’s not another boring PCB, although the radar and sonar PCBs were interesting..