Researchers Find Security Flaws in Popular Data Storage Devices

Researchers Find Security Flaws in Popular Data Storage Devices

Researchers found a malicious expert can bypass existing protection mechanisms and access the data without knowing the user-chosen password.

Researchers at Radboud University have found critical security flaws in several popular data security devices manufactured by companies like Crucial and Samsung. The researchers say the flaws can be easily exploited to recover encrypted data without knowing the password.

In a paper released on Monday, the Radboud researchers explained they were able to reverse engineer the firmware of several solid state drives to find a "pattern of critical issues" across the devices makers.

For one of the drives the researchers worked on, the master password used to decrypt the drive's data was just an empty string and could be easily exploited by flipping a single bit in the drive's memory. Another drive could be in unlocked with "any password" by crippling the drive's password validation checks. 

The researchers found that users "should not rely solely on hardware encryption as offered by SSD's confidentiality," since finding that, in the case of Windows computers, often the default policy for BitLocker's software-based drive encryption is to trust the drive, and therefore rely entirely on the device's hardware encryption to protect data. 

Computer security researcher for Tripwire's VERT (Vulnerability and Exposure Reearch Team), Craig Young said that calling these devices encrypted is misleading in the first place.

"Expecting a hard drive maker to provide meaningful security of the data it stores is like letting lunatics run the asylum," Young said. "The best security protections are tiered and layered and in this case, that means not relying on the drive to handle authentication, encryption and data storage."

Mounir Hahad, head of The Juniper Threat Labs at Juniper Networks offered up a solution to securing against these kinds of vulnerabilities.

"I suggest that any company that deploys these models in their Windows laptops switches to software encryption immediately and reimages the drives to work around this issue," Hahad said. "Switching only to software encryption without reimaging does not provide protection for data previously on the disk."

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.