IDG News Service – Solid-state drives are fast becoming popular replacements for hard drives, especially in laptops, but experts caution that SSDs aren’t as secure as commonly thought.
SSDs may offer better data security than traditional hard drives, but they do not completely erase data and are vulnerable to physical hacks from light sources like an ultraviolet laser, experts say.
Despite their relatively high cost and concerns about durability, SSDs are gaining popularity, particularly for use in laptops, because they consume less power and access data more quickly. Securing data on SSDs could become a larger issue when the technology becomes more widely used and reaches other portable devices like smart phones, experts said.
Many SSDs use industry-standard NAND flash chips that were designed for cameras and MP3 players, so they have no physical security hooks that prevent them from being removed from enclosures, said Jim Handy director of Objective Analysis, a semiconductor research and consulting firm. A hacker could easily unsolder NAND chips from an SSD and read the data using a flash chip programmer.
Once the data is read, the files could be reassembled using data recovery software, Handy said. “There’s really nothing sophisticated about this process,” he said.
Another physical hack involves using an ultraviolet laser to wipe out lock bits — or encryption locks — from fuses on chips that secure SSDs, said a chip hacker who prefers to be called Bunnie and runs the blog site bunnie studios. Data arrays from SSDs can be read using standard means after the lock bits are wiped.
“No fancy equipment is required to read the [data] array once it is unlocked,” Bunnie said. For example, the data arrays can be read using conventional ROM readers, devices typically meant to burn and verify unsecured ROM devices.
To lessen chances of hackers stealing data, encryption keys could be integrated inside the SSD controller device to handle disk encryption at the hardware level, said Craig Rawlings, marketing director at Kilopass. Kilopass sells products using XPM (extra permanent memory) technology that stores keys in system-on-chip devices.
Encryption keys can be hacked, but experts agreed that encryption is the necessary first step to secure data on SSDs. Many companies, including Safend and Encryptx, have products that encrypt data on storage devices including SSDs.
Encryption adds another barrier so that hackers have to bypass encryption layers, the controller and then reassemble raw data for a successful hack, said Sean Barry, senior data recovery engineer at Kroll Ontrack. This takes time, during which data may become invalid or useless.
Encryption also makes files on SSDs a lot easier to erase. Like hard drives, SSDs create multiple file copies, but encryption software can help erase secured files, said Kyle Wiens, CEO of iFixIt.
So what is the solution… Well Samsung has a clean self encrypting SSD solution.. Here is the news article about it that came out in April 2009
Lee, MA and San Jose, CA-April 16, 2009-Wave Systems Corp. (NASDAQ: WAVX) and Samsung Electronics Co., Ltd., have collaborated to give professionals on the go the ultimate in hard drive security. Along with blazing speed, ultra-fast boot-up and silent operation, Samsung’s new self-encrypting SSDs automatically encrypt information as it’s saved to the drive, an industry first for SSDs.
Full disk encryption (FDE) has already been adopted as a standard feature available in many commercial laptop and desktop systems with hard disk drives. Samsung self-encrypting drives – 256-, 128- and 64-gigabyte SSDs – provide FDE bundled with Wave’s EMBASSY® management software and are now available through at least one major OEM.
“Samsung has combined the tremendous performance advantages of solid state technology with integrated hardware encryption for drives designed especially for today’s ‘road warrior’ professionals,” said Jim Elliott, memory vice president, Samsung Semiconductor, Inc. “Business users now get the best of performance and security in a single drive. “
Solid state drives offer numerous advantages over traditional platter hard drives. SSD performance is not impacted by FDE, a drawback frequently seen with today’s HDDs that use software FDE. Also, because they have no moving parts and are based around flash memory, the SSDs are far less prone to reliability issues caused by bumps and bounces from normal notebook PC use, and from excessive heat generation. They additionally boast two to five times faster overall performance, including boot-up time and application launching, as well as longer battery life in notebook PCs. Samsung self-encrypting SSDs will be available in both 1.8″ and 2.5″ form factors; the 1.8″ being the world’s first encrypted storage drive of this size. Flash memory also retains data even when the power is turned off, enabling “near-instant” turn on for the user’s system, and they don’t require “spin up” time that drains batteries.
Samsung’s new 256GB, 128GB, and 64G SSDs are the first solid state drives to incorporate hardware-based encryption, which has made headlines in recent weeks with publication of the industry’s Opal storage specification published by the Trusted Computing Group (TCG). Benefits of hardware encryption over today’s software-only encryption approaches include faster performance, better security and an “always on” feature. Because encryption keys and access credentials are generated and stored within the drive hardware, they never leave its confines and are never held in the operating system or by application software. This hardware FDE approach is considered more secure and less complex to manage.
“Samsung is breaking new ground in performance and security with its solid state FDE drives,” said Steven Sprague, Wave’s president and CEO. “Whether it’s with cars or computers, many people will always demand the very best in performance and Samsung is delivering on that promise. With self-encrypting drives, users have the peace of mind that whatever’s on the drive-credit card numbers, medical records, sensitive personal data or intellectual property is always protected.”
Good stuff. Over & out.
