Researchers Find Security Flaws in Popular Data Storage Devices

Researchers Find Security Flaws in Popular Data Storage Devices

Researchers found a malicious expert can bypass existing protection mechanisms and access the data without knowing the user-chosen password.

Researchers at Radboud University have found critical security flaws in several popular data security devices manufactured by companies like Crucial and Samsung. The researchers say the flaws can be easily exploited to recover encrypted data without knowing the password.

In a paper released on Monday, the Radboud researchers explained they were able to reverse engineer the firmware of several solid state drives to find a "pattern of critical issues" across the devices makers.

For one of the drives the researchers worked on, the master password used to decrypt the drive's data was just an empty string and could be easily exploited by flipping a single bit in the drive's memory. Another drive could be in unlocked with "any password" by crippling the drive's password validation checks. 

The researchers found that users "should not rely solely on hardware encryption as offered by SSD's confidentiality," since finding that, in the case of Windows computers, often the default policy for BitLocker's software-based drive encryption is to trust the drive, and therefore rely entirely on the device's hardware encryption to protect data. 

Computer security researcher for Tripwire's VERT (Vulnerability and Exposure Reearch Team), Craig Young said that calling these devices encrypted is misleading in the first place.

"Expecting a hard drive maker to provide meaningful security of the data it stores is like letting lunatics run the asylum," Young said. "The best security protections are tiered and layered and in this case, that means not relying on the drive to handle authentication, encryption and data storage."

Mounir Hahad, head of The Juniper Threat Labs at Juniper Networks offered up a solution to securing against these kinds of vulnerabilities.

"I suggest that any company that deploys these models in their Windows laptops switches to software encryption immediately and reimages the drives to work around this issue," Hahad said. "Switching only to software encryption without reimaging does not provide protection for data previously on the disk."

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

  • Securing Entertainment Venues Securing Entertainment Venues

    One thing entertainment venues, sports stadiums and theme park officials want to accomplish is getting people back into their seats. That is happening today—but not without understanding and technology. In this episode, AJ DeRosa shares his insight on how COVID-impacted businesses are able to face safety and security issues with confidence and technology. We also discuss visitor expectations and how venue officials can ensure their space is secure as they welcome visitors back.

Digital Edition

  • Security Today Magazine - November December 2021

    November / December 2021


    • Navigating System Integration
    • Protecting Premises and People
    • Cashing in Your VMS System
    • Encryption and Compliance
    • Security Breach at 38,000 Feet

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety