Hard drives reportedly infected by NSA malware

by Vineet Kosaraju|February 19, 2015

Russian security software maker Kapersky Lab have found several hard drives with traces of a malware reportedly released by the NSA, named Fanny.

A report compiled recently by Russian security software maker Kapersky Lab indicates that the U.S. National Security Agency (NSA) has likely been infecting hard disk drives (HDDs) and solid-state drives (SSDs) for personal computers for almost two decades.

The report states that the specific malware, named Fanny, is linked to previous NSA spyware, such as the Stuxnet computer worm that sabotaged Iran’s nuclear program. Kapersky Lab does not directly state the NSA is involved, but rather puts the blame on the “Equation Group.”

The malware targeting HDDs and SSDs, named Fanny, was created by the “Equation Group” and has been infecting computers for almost two decades.
Courtesy of Kapersky Lab
The malware targeting HDDs and SSDs, named Fanny, was created by the “Equation Group” and has been infecting computers for almost two decades.

 

According to principal security researcher at Kapersky Lab, Igor Soumenkov, there are no detection methods to check if a personal HDD is infected.

“There is no way to understand whether your HDD is infected. Once the hard drive gets infected with this malicious payload, it’s impossible to scan its firmware,” he said in an email reply to Computerworld. “It means that we are practically blind, and cannot detect hard drives that have been infected by this malware.”

The malware reportedly cannot be detected by antivirus programs either and can produce data for any government agency controlling the drive. Hard drive manufacturers Seagate, Western Digital, Toshiba, IBM, and Maxtor were affected, as well as SSD makers like Micron and Samsung.

Some of the countries most impacted by Fanny include Iran, Russia, and Pakistan. The United States reportedly has a low infection rate.
Courtesy of Kapersky Lab
Some of the countries most impacted by Fanny include Iran, Russia, and Pakistan. The United States reportedly has a low infection rate.

 

According to Reuters, an employee confirmed that the NSA developed this specific technique but is unsure if they are responsible for using the malware.

Records indicate that while some malware samples were compiled in 2002, others were registered as early as 1996, nineteen years ago. During this time period, 30 countries were infected, with the most common including countries like Iran, Russia, and Pakistan.

Although the Fanny timeline has been pinpointed from between 2008 to 2010, it may have been released as early as 1996.
Courtesy of Kapersky Lab
Although the Fanny timeline has been pinpointed from between 2008 to 2010, it may have been released as early as 1996.

The malware has mainly targeted government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists.

The full report of the malware released by Kapersky Lab can be found here.