Tuesday, November 6th 2018
SSD the Next Frontier for Cybersecurity: Vulnerabilities Found with Native Encryption
Compared to hard disk drives, the logic that makes solid-state drives (SSDs) tick is far more complex, involving a far more powerful SoC, complete with native storage, and sophisticated firmware that tells the controller where each bit of user data is physically stored across an array of NAND flash chips. Not surprisingly, the more sophisticated you make your SSD firmware, the more security vulnerabilities you leave, as cyber-security researchers at The Radboud University found out.
A research paper draft published by Carlo Meijer and Bernard van Gastel tells us that hardware data encryption technologies built into modern SSDs are easy to bypass and recover protected data, rendering technologies such as TCG Opal useless. Most modern SSDs offer native data encryption, which encrypts data using popular methods such as AES, without posing an overhead for the host machine. "We found that many hardware implementations [of native encryption] have critical security weaknesses, for many models allowing for complete recovery of the data without knowledge of any secret."
The team examines two of the most popular SSD brands, Crucial and Samsung, and their most popular client-segment products: MX100, MX200, MX300, 840 EVO, 850 EVO, T4, and T5 external. "For multiple models, it is possible to bypass the encryption entirely, allowing for a complete recovery of the data without any knowledge of passwords or keys. A pattern of critical issues across vendors indicates that the issues are not incidental but structural,' the researchers argue while naming the TCG Opal standard as being extremely hard to implement correctly, 'and that we should critically assess whether this process of standards engineering actually benefits security, and if not, how it can be improved," the paper reads.
Shortly after the publication of this draft, Samsung responded with an online notice asking customers to immediately switch to software encryption methods to secure their data while it begins to figure out the research and possibly release firmware updates in the near future.
You can access the current draft of the research paper here (PDF).
A research paper draft published by Carlo Meijer and Bernard van Gastel tells us that hardware data encryption technologies built into modern SSDs are easy to bypass and recover protected data, rendering technologies such as TCG Opal useless. Most modern SSDs offer native data encryption, which encrypts data using popular methods such as AES, without posing an overhead for the host machine. "We found that many hardware implementations [of native encryption] have critical security weaknesses, for many models allowing for complete recovery of the data without knowledge of any secret."
Shortly after the publication of this draft, Samsung responded with an online notice asking customers to immediately switch to software encryption methods to secure their data while it begins to figure out the research and possibly release firmware updates in the near future.
You can access the current draft of the research paper here (PDF).
23 Comments on SSD the Next Frontier for Cybersecurity: Vulnerabilities Found with Native Encryption
I have nothing to hide really... desktop users shoud not even care.
The people that need encryption mostly use software encryption anyway, I don't know nobody that would trust hardware (especially if made in a different country).
Do backup to an offline harddrive even if you have something? So hard?
So keep in mind guys, Everything made by man can be broken, quit building sky castles and think from a mere consumer point not a tech enthusiast, the feature is seldom used, especially for these consumer drives. It is not enterprise/server area, where things like that matter, get real.
Install GPedit.msc on Win10Home. I've had to use this in the past, not sure if its still valid. :oops:
In that case the SSD can land in the hands of "bad" people who decode and check the data.
If the data is encrypted noone bothers descrypting it as that takes too long.
The real issue here is that people think it is encrypted so they just through the SSD into the recycling bin - however in reality the data is not encrypted.
I use the hammer approach. I recycle broken hardware but remove and destroy HDDs and SSDs before that. That is the safest. :-)
I work in encryption and this is pretty bad. What you have to do disable hardware acceleration for Bitlocker or use software based policy encryption instead. Using a drive's built in SED will make you vulnerable if stolen.