Researchers Find Security Flaws in Popular Data Storage Devices

Researchers Find Security Flaws in Popular Data Storage Devices

Researchers found a malicious expert can bypass existing protection mechanisms and access the data without knowing the user-chosen password.

Researchers at Radboud University have found critical security flaws in several popular data security devices manufactured by companies like Crucial and Samsung. The researchers say the flaws can be easily exploited to recover encrypted data without knowing the password.

In a paper released on Monday, the Radboud researchers explained they were able to reverse engineer the firmware of several solid state drives to find a "pattern of critical issues" across the devices makers.

For one of the drives the researchers worked on, the master password used to decrypt the drive's data was just an empty string and could be easily exploited by flipping a single bit in the drive's memory. Another drive could be in unlocked with "any password" by crippling the drive's password validation checks. 

The researchers found that users "should not rely solely on hardware encryption as offered by SSD's confidentiality," since finding that, in the case of Windows computers, often the default policy for BitLocker's software-based drive encryption is to trust the drive, and therefore rely entirely on the device's hardware encryption to protect data. 

Computer security researcher for Tripwire's VERT (Vulnerability and Exposure Reearch Team), Craig Young said that calling these devices encrypted is misleading in the first place.

"Expecting a hard drive maker to provide meaningful security of the data it stores is like letting lunatics run the asylum," Young said. "The best security protections are tiered and layered and in this case, that means not relying on the drive to handle authentication, encryption and data storage."

Mounir Hahad, head of The Juniper Threat Labs at Juniper Networks offered up a solution to securing against these kinds of vulnerabilities.

"I suggest that any company that deploys these models in their Windows laptops switches to software encryption immediately and reimages the drives to work around this issue," Hahad said. "Switching only to software encryption without reimaging does not provide protection for data previously on the disk."

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

  • Fresh Security Perspective from AMAG’s New Sales Director A Fresh Perspective on Security

    Fred Nelson may be new to the security industry but his sales and leadership methods are time tested, and true. Fred joined AMAG only a few months ago, but brings with him a wealth of experience in sales and life balance solutions. This year is off to a good start for AMAG with new solutions on the horizon.

Digital Edition

  • Security Today Magazine - April 2022

    April 2022


    • Similarities at Data Centers and Airports
    • Transitioning to the Cloud
    • Going High Tech
    • The Benefits of On-site Security
    • Optimizing Store Layouts

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety