Firmware attack can drop persistent malware in hidden SSD area

guest · Dec 30, 2021

December 30, 2021

Korean researchers have developed a set of attacks against some solid-state drives (SSDs) that could allow planting malware in a location that's beyond the reach of the user and security solutions.

The attack models are for drives with flex capacity features and target a hidden area on the device called over-provisioning, which is widely used by SSD makers these days for performance optimization on NAND flash-based storage systems.
Hardware-level attacks offer ultimate persistence and stealth. Sophisticated actors have worked hard to implement such concepts against HDDs in the past, hiding malicious code in unreachable disk sectors.
Click to expand...

How flex capacity works
Flex capacity is a feature in SSDs from Micron Technology that enables storage devices to automatically adjust the sizes of raw and user-allocated space to achieve better performance by absorbing write workload volumes.

It is a dynamic system that creates and adjusts a buffer of space called over-provisioning, typically taking between 7% and 25% of the total disk capacity.
Click to expand...

The attack models
One attack modeled by researchers at Korea University in Seoul targets an invalid data area with non-erased information that sits between the usable SSD space and the over-provisioning (OP) area, and whose size depends on the two.

The research paper explains that a hacker can change the size of the OP area by using the firmware manager, thus generating exploitable invalid data space.
The problem here is that many SSD manufacturers choose not to erase the invalid data area to save on resources.
Click to expand...

The researchers note that forensic activity on NAND flash memory can reveal data that has not been deleted in over six months.
In a second attack model, the OP area is used as a secret place that users cannot monitor or wipe, where a threat actor could hide malware.

The obvious advantage of such an attack is that it is stealthy. Detecting malicious code in OP areas is not only time-consuming but also requires highly-specialized forensic techniques.
Click to expand...

arXiv: Forensic Issues and Techniques to Improve Security in SSD with Flex Capacity Feature
(PDF): https://arxiv.org/ftp/arxiv/papers/2112/2112.13923.pdf

Micron® Flex Capacity Feature — Tunable Storage in a Flash
https://media-www.micron.com/-/media/client/global/documents/products/technical-marketing-brief/ssd_flex_capacity_feature_tech_brief.pdf

Log in or Sign up

Firmware attack can drop persistent malware in hidden SSD area

guest Guest

Log in or Sign up

Firmware attack can drop persistent malware in hidden SSD area

guest Guest

Useful Searches