Is there any kind of malware or RAT that cannot be gotten rid of by a thorough wipe with DBAN, flashing the BIOS and re-installing OS? More importantly, if you've been ratted and did all these things, is there still a possibility that the attacker created a backdoor into your system? An explanation of what backdoors usually entail and whether taking the above steps would get rid of them would be appreciated.

  • sure - if the backups or sources for the OS, etc. are also infected. – schroeder Dec 22 '15 at 18:03
  • Firmware of USB Ports, HDD or SSD might also be infected. – John Dec 22 '15 at 18:17
  • 1
    Or if the router is compromised and you get quickly reinfected. – Steffen Ullrich Dec 22 '15 at 18:17

Sure it's possible. Look at the NSA ANT catalog. You'll find devices like COTTONMOUTH, which are implanted in USB connectors and allow for re-infection; DEITYBOUNCE which implants malware in a Dell server via BIOS and the RAID controller (flashing the BIOS should prevent this); GINSU which installs itself from a PCI bus device; IRATEMONK which is implanted in the firmware of certain hard drives; and IRONCHEF which replaces the BIOS (replacing the BIOS with a variant that reinfects a BIOS during the reflashing operation would be possible.) And many of their other devices, like HOWLERMONKEY, can intercept your information without infecting your system.

While it may be possible, a second question is "is it probable?" Is someone as sophisticated as the NSA digging into your computer? I don't know you, so I can't answer that. But since the NSA can do it, others have taken this on as a challenge. The NSA Playset is a collection of Open Source projects that attempt to replicate some of the NSA capabilities. SLOTSCREAMER is a PCI based attack device; ADAPTERNOODLE is a USB based attack device. They haven't replicated the hard drive firmware attacks yet, but it's on their list.

  • But these are all for hardware. I was talking about software hacks. – Bob Ogden Dec 23 '15 at 0:55
  • DEITYBOUNCE, IRATEMONK, and IRONCHEF are all firmware attacks that don't require additional hardware. They may only work on certain systems, though. For example, Seagate, WD, Maxtor and Samsung are all vulnerable to IRATEMONK, but there is no mention of Hitachi or Toshiba drives being vulnerable. – John Deters Dec 23 '15 at 1:27

Your Answer

