Data Security Flaws in Major Self-Encrypting SSDs Allow Attackers to Bypass Encryption and Decrypt Data – iStorage

Researchers at Radbound University in the Netherlands revealed that major flaws found in some self-encrypted SSDs allow an attacker to bypass the password-based authentication process and access encrypted data stored on the drives.

The researchers found that the data encryption keys used to secure data stored on the drives are not derived from the owner’s password, and that an attacker with physical access to the drives can reprogram the drives via a debug port in order to accept any password. Once the drives have been reprogrammed, the SSDs will use the stored data encryption keys to encrypt and decrypt all stored data.

With questions now arising into just how safe self-encrypted SSDs are, John Michael, CEO, iStorage Limited, stated: “This is an extremely worrying issue for anyone who has purchased such self encrypting SSDs believing that their data is encrypted and secure. According to researchers at Radbound University, the flaws range from very easy to slightly more complicated. ZDnet reported that they found that certain self encrypting SSDs come with support for a ‘master password’, which is written in the manual and can be used to gain access to the user’s encrypted password, effectively bypassing the user’s custom password. The other vulnerability relates to the user-chosen password not being linked to the data encryption key, allowing an attacker to reprogram the drives’ debug port in order to accept any password and access all data contained therein.

Customers need not be concerned about these flaws being present in iStorage products. They are not vulnerable to such attacks reported by the researchers. The iStorage generated data encryption key, in simple terms, is derived from the PIN that is configured and entered by the user on the onboard keypad. In addition, they incorporate a lock-down feature which prevents any attacker from reprogramming our firmware. Furthermore, the iStorage Common Criteria EAL4+ ready microprocessor, employs a flash lock mechanism that ensures the product constantly remains in a mode where all write-access to program memory is denied.

Unlike other similar so-called password-based and PIN authenticated products, iStorage products such as the diskAshur2, diskAshur PRO and diskAshur DT incorporate a secure microprocessor with no debug ports, essentially preventing attackers from modifying the firmware.

For example, a hacking company in China, Golon International, has listed on their website numerous microprocessors which they claim to have hacked. As an example, the Microchip PIC18F26K22, which is used within some so-called secure portable storage devices is listed as being hacked. Whereas the same company attempted to hack the iStorage secure microprocessor and failed. The company recommend that customers ask manufacturers of secure portable storage devices to disclose which microprocessor is incorporated within their products, and then visit the Golon website to see if such microprocessors are listed as being hacked. If they are, then we strongly recommend that customers steer clear of any products that incorporate such vulnerable microprocessors.

“This latest vulnerability with self encrypting SSDs is an example of why PIN authenticated portable storage devices such as iStorage products, which incorporate secure microprocessors, should be chosen over simple password-based and other PIN authenticated drives that use non-secure microprocessors.”

Continues Michael: “Aside from this, our customers should be reminded that iStorage drives have passed government security accreditations – where we have products which are certified to FIPS 140-2 Level 2/3, NCSC CPA, NLNCSA BSPA & NATO Restricted Level, all of which have successfully gone through the toughest testing standards and makes iStorage the world’s first and only company to have all such certifications.”