Flaws in Popular Self-Encrypting SSDs Let Attackers Decrypt Data

We all have something to hide, something to protect. But if
you are also relying on self-encrypting drives for that, then you
should read this news carefully.

Security researchers have discovered multiple critical
vulnerabilities in some of the popular self-encrypting solid state
drives (SSD) that could allow an attacker to decrypt disk
encryption and recover protected data without knowing the password
for the disk.

The researchers—Carlo Meijer and Bernard van Gastel—at Radboud
University in the Netherlands reverse engineered the firmware
several SSDs that offer hardware full-disk encryption to identify
several issues and detailed their findings in a new paper (PDF^[1]) published Monday.

The duo successfully tested their attack against three Crucial
models of SSDs—Crucial MX100, MX200, and MX300—and four Samsung
SSDs—840 EVO, 850 EVO, T3 Portable, and T5 Portable drives and
found at least one critical flaw that breaks the encryption scheme.
But researchers warned that many other SSDs may also be at
risk.
The vulnerabilities explained below reside due to improper
implementations of ATA security and TCG Opal, two specifications
for implementing encryption on SSDs that use hardware-based
encryption.

Password and Data Encryption Key Are Not Linked

According to the researchers, Crucial MX100, MX200, Samsung 850
EVO, and T3 Portable SSDs have critical security issues in both the
ATA security and TCG Opal implementation.

Since there is no cryptographic binding present between the
password and data encryption key (DEK), an attacker can unlock
drives with any password by modifying the password validation
routine in RAM through JTAG debugging interface.

With physical access to the device’s debug ports, the
researchers were able to reverse engineer the firmware and modify
it to decrypt the hardware encrypted data by entering any
password.

Secret Master Password

The Crucial MX300 also has a JTAG port, but since it has been
disabled by default, the above approach is insufficient.

However, researchers discovered that Crucial MX300 SSD also has a
master password implementation, the default value of which is set
by the manufacturer, which in case of MX300 is an empty string.
If this value remains unchanged by the user, it could allow anyone
in possession of the default Master password to unlock the data
just with an empty password field—without requiring custom password
set by the user.

Wear Leveling Exploit

In Samsung 840 EVO, researchers were able to recover data
encryption keys (DEK) by exploiting wear leveling feature, a
technique used in solid-state drives (SSDs) to increase the
lifetime of erasable flash memory.

In most SSDs, wear-leveling algorithm works by regularly moving
static data to different physical locations in the NAND flash
memory. But even after the data is moved, it remains available on
the old location until it’s overwritten.

However, this process has an adverse effect on security, as the
pair explains, “suppose that the disk encryption key (DEK) is
stored unprotected, after which a password is set by the end user,
replacing the unprotected DEK with an encrypted variant.”

Don’t Trust BitLocker to Encrypt Your SSD

What’s more? Since Windows’ built-in BitLocker full-disk
encryption software by default uses hardware-based encryption if
available, instead of its own software-based encryption algorithms,
Windows users relying on BitLocker and using vulnerable drives
remain exposed to above-mentioned vulnerabilities.

However, you can force BitLocker to use software-based encryption
only by changing a setting in Windows Group Policy. You can do so
by following the below steps:

1. Open the Local Group Policy Editor by entering “gpedit.msc” in
   the Run dialog.
2. Head on to “Computer Configuration\Administrative
   Templates\Windows Components\BitLocker Drive Encryption.”
3. Double-click the “Configure use of hardware-based encryption
   for fixed data drives” option in the right panel.
4. Select the “Disabled” option there and click “OK” to save the
   new setting.
5. Once suspend the BitLocker protection and re-enable it to make
   the changes in effect.

Alternatively, rather than relying on BitLocker, you can use the
open-source VeraCrypt tool to encrypt your Windows system hard
drive or any other drive. VeraCrypt is based on the TrueCrypt
software and handles the encryption process by its own without
relying on SSD.

Moreover, unlike BitLocker which is available only on
Professional, Enterprise and Education editions of Windows 10,
VeraCrypt is also available on Windows 10 Home and Windows 7 Home
computers.

Security Patches for Samsung and Crucial SSDs 

Meijer and Gastel reported the vulnerabilities to Crucial and
Samsung before going public with their findings. While Crucial has
already released firmware patches for all of its affected drives,
Samsung has rolled
out^[2] security patches for its
T3 and T5 Portable SSDs.

However, for its EVO drives, Samsung recommends installing
encryption software (freely available online) that is compatible
with your system.

You can head on to the research paper titled “Self-encrypting
deception: weaknesses in the encryption of solid state drives
(SSDs)” published Monday by the researchers to learn more about the
reported vulnerabilities.