Solid state drives present new security risks

SSDs are not a security panacea, experts warn

Solid-state drives are fast becoming popular replacements for hard drives, especially in laptops, but experts caution that SSDs aren't as secure as commonly thought.

SSDs may offer better data security than traditional hard drives, but they do not completely erase data and are vulnerable to physical hacks from light sources such as ultraviolet lasers, experts say.

Despite their relatively high cost and concerns about durability, SSDs are gaining popularity, particularly for use in laptops, because they consume less power and access data more quickly. Securing data on SSDs could become a larger issue when the technology becomes more widely used and reaches other portable devices such as smart phones, experts says.

Many SSDs use industry-standard NAND flash chips that were designed for cameras and MP3 players, so they have no physical security hooks that prevent them from being removed from enclosures, says Jim Handy, director of Objective Analysis, a semiconductor research and consulting firm. A hacker could easily unsolder NAND chips from an SSD and read the data using a flash chip programmer.

Once the data is read, the files could be reassembled using data recovery software, Handy says.

"There's really nothing sophisticated about this process," he says.

Another physical hack involves using an ultraviolet laser to wipe out lock bits — or encryption locks — from fuses on chips that secure SSDs, says a chip hacker who prefers to be called Bunnie and runs the blog site Bunnie Studios. Data arrays from SSDs can be read using standard means after the lock bits are wiped.

"No fancy equipment is required to read the [data] array once it is unlocked," Bunnie says. For example, the data arrays can be read using conventional ROM readers, devices typically meant to burn and verify unsecured ROM devices.

To lessen chances of hackers stealing data, encryption keys could be integrated inside the SSD controller device to handle disk encryption at the hardware level, says Craig Rawlings, marketing director at Kilopass. Kilopass sells products using XPM (extra permanent memory) technology that stores keys in system-on-chip devices.

Encryption keys can be hacked, but experts agree that encryption is the necessary first step to secure data on SSDs. Many companies, including Safend and Encryptx, have products that encrypt data on storage devices including SSDs.

Encryption adds another barrier so hackers have to bypass encryption layers, the controller and then reassemble raw data for a successful hack, says Sean Barry, senior data recovery engineer at Kroll Ontrack. This takes time, during which data may become invalid or useless.

Encryption also makes files on SSDs a lot easier to erase. Like hard drives, SSDs create multiple file copies, but encryption software can help erase secured files, says Kyle Wiens, CEO of iFixIt.

"Every time you write data it might write ... to a different part of the disk and then change the directory table around. So it forgets where the data was written before," Wiens says. Users may delete one file, but a replica could remain untouched in another sector.

The wear-levelling feature of SSDs — based on an algorithm that erases and writes data evenly across all the cells on a memory chip to prevent some from wearing out faster than others — makes files harder to completely erase, Wiens says.

Some encryption software monitors the wear-levelling process to track file remnants, which can then be deleted using the secure erase command, saus Knut Grimsrud, an Intel Fellow. Secure erase is a command for secure file deletion that needs to be supported by the encryption software.

"If all the software does is write over the top of the LBAs, I don't think it'll be as [effective] on an SSD as it may have missed remnants from the previous wear-levelling or something like that because the software doesn't know about that," Grimsrud says. LBA (logical block addressing) specifies the location of data blocks on storage devices.

Overall, it's easier to delete data from SSDs than from hard drives, which can be a good or bad. Data is stored on electrons in SSDs, and getting rid of electrons flushes out the data, Kroll Ontrack's Barry says. In hard drives, the data has to be overwritten or physically damaged to prevent it from being read.

The data flush could have its own advantage in terms of quickness, but in the wrong hands data on SSDs could be carelessly and easily lost, Barry says.

Join the newsletter!

Error: Please check your email address.

Tags ssdssecuritySecurity ID

Show Comments
[]