Researcher Turns HDD Into Rudimentary Microphone (bleepingcomputer.com)
An anonymous reader writes from Bleeping Computer: Speaking at a security conference, researcher Alfredo Ortega has revealed that you can use your hard disk drive (HDD) as a rudimentary microphone to pick up nearby sounds. This is possible because of how hard drives are designed to work. Sounds or nearby vibrations are nothing more than mechanical waves that cause HDD platters to vibrate. By design, a hard drive cannot read or write information to an HDD platter that moves under vibrations, so the hard drive must wait for the oscillation to stop before carrying out any actions. Because modern operating systems come with utilities that measure HDD operations up to nanosecond accuracy, Ortega realized that he could use these tools to measure delays in HDD operations. The longer the delay, the louder the sound or the intense the vibration that causes it. These read-write delays allowed the researcher to reconstruct sound or vibration waves picked up by the HDD platters. A video demo is here.
"It's not accurate yet to pick up conversations," Ortega told Bleeping Computer in a private conversation. "However, there is research that can recover voice data from very low-quality signals using pattern recognition. I didn't have time to replicate the pattern-recognition portion of that research into mine. However, it's certainly applicable." Furthermore, the researcher also used sound to attack hard drives. Ortega played a 130Hz tone to make an HDD stop responding to commands. "The Linux kernel disconnected it entirely after 120 seconds," he said. There's a video of this demo on YouTube.
"It's not accurate yet to pick up conversations," Ortega told Bleeping Computer in a private conversation. "However, there is research that can recover voice data from very low-quality signals using pattern recognition. I didn't have time to replicate the pattern-recognition portion of that research into mine. However, it's certainly applicable." Furthermore, the researcher also used sound to attack hard drives. Ortega played a 130Hz tone to make an HDD stop responding to commands. "The Linux kernel disconnected it entirely after 120 seconds," he said. There's a video of this demo on YouTube.
https://www.youtube.com/watch?...
*"Cogito Ergo Liberalis"*
Remember: NEVER SHOUT AT YOUR JBOD!.
It's not yelling, if it's yelling?
- http://www.milkme.co.uk
The original finding from 2008 is here:
https://www.youtube.com/watch?...
No idea why anybody thinks this is worth a talk now.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
No, you haven't turned your HDD into a microphone. It will never be accurate enough to pick up conversation, no matter what 'further research' you attempt. You've proved that making a loud noise at a HDD causes it to temporarily park That a sustained loud noise causes random latency spikes. You're a complete fucking idiot if you think this is ANYWHERE close to being able to reconstruct a kHz signal.
Before all the silly conversations begin about "omg anyone's computer can be turned into an eavesdropping device!!!1" ... remember that if you can compromise a computer to the point where you can make low-level manipulations to the hard disk ... you can also simply turn on the microphone.
Tired of FB/Google censorship? Visit UNCENSORED!
Next time I'm pissed off at work, and I got into the lab to scream, I can just say that I'm conducing a HDD experiment/test.
Let me know when you can do the same thing with a microwave oven.
#DeleteChrome
Wow this is so much leeter than plugging a speaker into a microphone jack and running it backwards. All the techturds have used a speaker backwards as a microphone. Backwards speaker microphone is like a right of passage for every leet fakenerd.
I got six microphones in my home file server. I can't wait to replace them with 1TB SSD for $50 each in the next five years.
Myopic.
Intentional or otherwise, this is unwanted.
With NSA firmware I'm sure it could pick up voices. Getting access to the "servo signal" used to push against the audio and track the magnetic groove doesn't seem like a difficult firmware modification for someone with source. I think it'd be mostly plumbing to put the signal in packets and get it out of the drive.
Very interesting read and fun watch, probably the watch was more interesting =) Don't shout at your disks folks! =)
Nobody cares that you plan on upgrading your computer one day. Calling your hard drives "microphones" isn't clever or funny either.
This isn't think kind of post that will make people run you out of town. But it's the sort of post that will keep people pissed off at you after you do something extremely dumb like concoct a post made totally out of lies and mistruths for no apparent reason other than to hit the submit button or some hamfisted attempt to monitize a comment.
Not this shit again. Mods, please down vote this shit.
Why not just ask creimer/cdreimer/fatcashews? As a highly regarded moderator (because of the "quality" of his posts!), he must have THOUSANDS of mod points!
I'd be curious to know if this research project actually delved deep enough to determine -- especially with the 130Hz tone test -- if it was the actual platters that vibrated, or the actuator arm vibrating (thus impacting the heads).
I'd also be curious to know if this type of test could be done against server-class MHDDs that heavily advertise shock vibration as one of their key differences (compared to "consumer-class" MHDDs). I did notice in the video that it looks like a 2.5" MHDD was used, usually designed and intended for laptops, where shock and vibration are even more serious given the portability of the system. Some 2.5" MHDDs (ex. Toshiba), through SMART attributes (specifically attribute 191), let you monitor the G-shock rate/event count. I can't tell what exact manufacturer and model of drive was used; looks like maybe HGST or Toshiba. It matters.
Regarding the 130Hz harmonic: I'm left wondering if this particular frequency has some effect on some part of the electrical or electronic busses, rather than the platters. libata in the Linux kernel "timing out" after 120 seconds is somewhat complicated to explain, due to how many places there are "timeouts" all across the board -- the PL used may have timeout wrappers around their read/write commands (read(2), write(2), and lseek(2) don't, or at least I've never seen it), ATA command/protocol timeouts, AHCI timeouts, SCSI/ATA emulation layer timeouts, and of course let's not forget MHDDs having their own timeouts (TLER or CCTL)). Many of the timeouts are configurable in Linux using sysctl or /proc tunables, but you have to know exactly what you're adjusting (many people do not).
I actually reviewed the YT video, specifically where dmesg is used -- videos, BTW, are quite possibly THE WORST way to convey detailed technical information of this particular nature -- and it's hard for me to say if the actual drive fell off the bus vs. the drive F/W responding to ATA commands in a timely fashion but rejected the CDB. Determining this is made even more painful due to Linux's buffer cache and other caching (see: difference between hdparm -i and hdparm -I; hdparm -i is supposed to query the kernel's already-cached set of information from (in this case) the ATA IDENTIFY CDB during boot/disk tasting, compared to hdparm -I which always sends ATA IDENTIFY to the device). Comparatively as a data point, the BSDs do not implement a buffer cache: all I/O to block devices (ex. /dev/ada0) is direct (i.e. always O_DIRECT); caching is only done at VFS and higher layers.
The dmesg output shown indicates something was trying to access LBA 133844 on /dev/sda. Analysis on this is further complicated by Linux's SCSI-to-ATA emulation layer -- do not confuse this with SAT/SATL, which isn't relevant here because it looks like you're using a native SATA hard disk hooked up to an actual SATA port on the HBA inside of your laptop and not, say, a SATA-to-USB adapter -- so lines like the below are actually shown using their SCSI command and CDB structure, **not** ATA command and CDB structure. I'll explain why the latter is more helpful in a moment. For example, the below taken from your video refers to the SCSI READ(10) command (command 0x28), which is the 10-byte CDB version of READ:
[xxxxxxx.xxxxxx] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 10 56 a0 00 00 08 ...
ATA protocol READ commands are usually 0x20 to 0x2F (excluding 0x28, which is reserved/unused), but common ones today are READ DMA EXT (0x25) (DMA-based 48-bit LBA read) or READ DMA QUEUED EXT (0x26) (NCQ-based 48-bit LBA read), so I know definitively the log line above is for SCSI.
Likewise, failure lines like:
[xxxxxxx.xxxxxx] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK ...aren't helpful either, because again, they're SCSI-esque and not ATA-esque. DID_BAD_TARGET is from the SCSI layer, and is some kind of ATA-to-SCSI translated host error co
Comparatively as a data point, the BSDs do not implement a buffer cache
You're describing FreeBSD. Net- and OpenBSD have separate raw- (direct) and block (buffered) devices.
Easy shit. Iâ(TM)m not impressed at all.
I wasn't aware of that. Thank you!
Hey anonymous,
Heres the complete kernel log of one of my test. HDD disconnect starts at line 156. Maybe it helps you.
https://pastebin.com/K22qc2Ju
Regards,
Alfred
One morning, after the power went off for a few seconds in the middle of the night, I noticed my sister messing with the microwave oven. She asked, "How did you get your initials into the display?"
She was disappointed when I told her that the acronym PF meant Power Failure.
You provide great information. For the complete paper I might use some of it, for example I didn't look at the smart parameters but they might provide some info.
BTW the firmware just completely blocks, as you can see in the video, it doesn't even answer the hdparm -I. But in my tests, I was also accessing the HDD constantly (this is to draw the delay graph showing above in the video) so it might be that a read() comand is queued and blocks, waiting for vibrations to stops, and it blocks all other commands being sent to the HDD.
Another information lacking in the article: I managed to permanently damage an HDD. It didn't completely stop responding, but now the read delay is much bigger than before. While testing it at high vibrations, the HDD did some loud mechanical noises, so apparently the HDD did try to park itself multiple times. That HDD is now unusable for tests because it randomly delays reads over 10 ms (normally the read syscall takes about 500 ns).
I wonder if this would be more useful as a seismograph?
Solid state drives make this exercise pointless.
they shit themselves
It's always one step forward two steps back with you chris.
Just when I thought you were close to becoming a real boy you start spazzing out. I'm afraid we'll have to send you back to special ed at this rate.
He's a highly respected slashdot commentator. Also he's not afraid to admit his poop is like frozen yogurt on a forum about computers.
6 accounts and none of them have any mod points bawwwwww!
I think this website help us: http://www.fanatik.com.tr/2014...