Repository navigation
Seagate F3
Seagate F3 is a hard drive architecture first introduced in 2007 with the Barracuda 7200.11 family, designed to unify their ATA and SCSI drives into a single platform. By 2010 F3 had completely replaced the older ST10 architecture in Seagate SATA hard drive production, it continues to be used in their latest drives being produced today.
In 2014 Seagate began introducing security features restricting Vendor Unique Command (VUC) access for their Self-Encrypting Drive (SED) models, requiring an unlock handshake before sensitive commands are accessible.
DiskSec performs the following checks on Seagate F3 drives:
This check executes a vendor-specific variant of the ATA IDENTIFY DEVICE command called ID Page, which returns various information about the drive's firmware such as the package version and build time. This check should always succeed, even for drive models with restricted VUC access.
This check attempts to enumerate the drive's System Area (SA) modules (named system files in Seagate terminology), outputting the total number of modules and their total size on success.
This check attempts to read memory directly from controller RAM. It does this by reading from memory address 0, a fixed address where an ARM exception vector should always be located. It then parses the returned data, validates that it is a valid ARM exception vector, and outputs success if so.
This check scans the drive for Indicators of Compromise (IOCs) of the firmware implant with official cover name IRATEMONK. It emulates the logic of the implant's installation and management tool, performing the same checks that tool uses to locate the implant's data-storage location within an infected drive. If successful, it outputs a value corresponding to where the implant's data is stored in the drive's System Area, this value is a logical-address location with a currently unknown specific meaning and structure.