NSA copycat spyware could be snooping on your hard drive

A new US National Security Agency (NSA) spying campaign has been uncovered that involved baking spying software deep inside hard drives made by some of the world's largest hard drive manufacturers.

Security researchers from Kaspersky Lab discovered that spies acting on behalf of the government found a way to exploit the source code to place malicious software in the firmware of drives made by the likes of Western Digital, Seagate, Toshiba, Samsung and many more.

Kaspersky declined to publicly name and shame the country behind the program yet it did confirm it is closely linked to the NSA-led Stuxnet cyberweapon that has been used against targets such as Iran in the past.

Spies worked hard to find out how to bake malicious software into the hard drive firmware and Kaspersky researcher Costin Raiu explained that the authors must have had access to the proprietary source code in order to rewrite the hard drive operating system.

To recover the information all that needed to happen was for the user to insert an infected CD or USB drive into a PC connected to the internet.

The NSA didn't comment on the reports although Reuters spoke to a former NSA employee who confirmed that Kaspersky's analysis was correct and it's thought the NSA got hold of the source code by either asking for it directly or posing as a software developer.

Over a dozen companies involved

IBM, Seagate, Toshiba, Micron, Western Digital and Samsung were among over a dozen firms identified by Kaspersky's analysis yet none were able to confirm the existence of the spying program or whether they had given the source code to the NSA.

Exposure of this new spying program will hit both the NSA and Western technology companies hard overseas and take attitudes towards them to an even lower ebb than was already the case following Edward Snowden's revelations that began in 2013.

Via: Reuters

• 10 things the GCHQ-NSA privacy ruling means for you