Experts warn about SSD security risks
As Solid State Drives (SSDs) gradually replace hard disks over the coming years, particularly in laptops, security experts are warning about the additional security risks of using SSDs. It turns out that SSDs are vulnerable to physical hacking against both the flash memory and the chips that secure the SSDs and that traditional data shredding software is ineffective due to the wear-levelling process SSDs use to prolong the life of the flash cells.
Most SSDs use NAND chips much like those found in flash memory cards for digital cameras, which can be easily desoldered by a hacker and read using a flash chip programmer to get around locked SSDs, e.g. where the drive is password protected, but not encrypted. Afterwards, it is just a matter of using a disk recovery utility to reassemble the files from the data read out from the chips.
For controllers that use lock bits or encryption locks, another hack involves using a UV laser to wipe out the lock bits from fuses on the chip that secures the SSD. According to a chip hacker, nicknamed Bunnie, it is just a matter of using a conventional ROM reader to interface with the hacked chip once unlocked. However, SSDs that use an additional layer of hardware level encryption are resistant to the attack, unless the hacker manages to unlock the encryption keys.
As SSDs use wear-levelling to write data evenly across all the flash cells to avoid some cells being written to more times than others, this opens up another security risk for those that rely on traditional software based data shredding tools to destroy files, where hardware level encryption is not in use. A data shredder traditionally works by overwriting all bytes of a file with random data to prevent a data recovery tool from "undeleting" it.
However, due to the wear-levelling process on an SSD, overwriting a file with random data will likely result in different physical flash cells being written to, leaving the original flash cells that were used by the file untouched. As a result, these flash cells could potentially be read back at a later stage. So unless the data shredding software is designed to work with the wear-levelling process on SSDs, it can make it difficult to completely wipe sensitive data from an SSD, at least without carrying out a full low level format of the flash drive.
There are 5 comments
- MyCE Member
- Posted on: 27 Aug 08 03:36
- CD Freaks Rookie
- Posted on: 27 Aug 08 09:28
I assume that there would be at least some residual data on those as well.
Understand of course that a low-level would wipe those too, but that's no different than their suggestion for SSD, no?
Most popular headlines
- Sun 26 Oct 11:10 by DoMiN8ToR
Traces in the Android source code give us hints that the next Nexus device will ...
- Mon 27 Oct 05:10 by DoMiN8ToR
The Spanish company CineMartin claims to have developed software that makes it p...
- Tue 28 Oct 04:10 by DoMiN8ToR
Microsoft will no longer sell computers with Windows 7 installed starting t...
- Wed 29 Oct 07:10 by DoMiN8ToR
Our firsts with the free version of Cinemartin MyBD indicate that the software d...
- Mon 27 Oct 10:10 by Bavo Luysterborg
We've heard a lot about the next version Office, codenamed Office 16, but every ...