![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Data Storage Data Storage](http://a.fsdn.com/sd/topics/storage_64.png)
![Hardware Hardware](http://a.fsdn.com/sd/topics/hardware_64.png)
How To Head Off ATA HDD Password Abuse 215
An anonymous reader submits "German c't magazine has a story about abusing the security features of ATA hard disks. The bottom line is that almost all ATA hard disks in desktop PCs can be password-protected. However, on most desktop PCs, the BIOS does not support locking this option -- so viruses or malware could set a random password, making any data unreadable unless recovered by professionals."
why would you do this? (Score:3, Interesting)
Re:why would you do this? (Score:5, Informative)
Xboxen will only boot from a locked hard drive, and to modify the files on an Xbox to, you know, allow you to run your own home written unsigned code, you need to be able to lock the drive once you've modified it to get the Xbox to recognize it.
I have encountered bioses that won't allow you to lock or unlock drives. Very annoying...
I have a crystal ball (Score:2)
In a way, these "trusted computing" solutions will be more risky than the open systems we have today. A virus on such a system could disallow your hardware to boot from any device and run any software, so even removing an affected drive would not be enough. User
Re:why would you do this? (Score:2)
Re:why would you do this? (Score:3, Funny)
Re:why would you do this? (Score:2)
So that when I die no one can go through my harddrive?
Re:why would you do this? (Score:2, Insightful)
tools tools tools
Re:why would you do this? (Score:5, Insightful)
Speed.
Only very sophisticated organizations have the means to lift data off a password-protected hard drive. Encryption, while more durable in that regard, sacrifices speed with every access to the files in question.
Re:why would you do this? (Score:2, Interesting)
This is just supesition but I'm assuming if 1 enables this in the bios, your password is then stored
in bios's cmos memory and the bios then uses that to unlock the drive, to the support an autoboot feature.
so the machine can boot by itself , w/o user interaction. So any computer that someone could just snatch and grab
will likely autoboot and unlock the drive, and not be very good security, maybe for office desktops where maybe
someone could open the case, take the drive , but not abscond with the the
Re:why would you do this? (Score:2)
Really? So I can't just buy another drive that is the same, swap the PCBAs and have instant access to my data? (give that a shot.)
Why would it? (Score:2)
There are boards that have chipsets aiming at supporting hardware-based encryption though (I know VIA has a few). Just like a sub-1Ghz GPU will kick your 3.2Mhz CPU's ass for 3d rende
Re:why would you do this? (Score:3, Interesting)
Of course, if you have a trojan installed or are being held hostage, these security princ
Re:why would you do this? (Score:2)
Re:why would you do this? (Score:2)
Re:why would you do this? (Score:2, Interesting)
But how safe is encrypting your files? What algorithm does it use? Is it implemented properly? Even if you know for sure, someone can read
professional? (Score:4, Informative)
Here is a website that shows how to unlock it, and you don't even have to be a professional!
http://www.rockbox.org/lock.html [rockbox.org]
Re:professional? (Score:5, Funny)
Re:professional? (Score:2)
Re:professional? (Score:2)
Re:professional? (Score:4, Informative)
Re:professional? (Score:2, Interesting)
you can wipe the disk for a recover if the master password is tampered.
Read the provided roxbox link.
Re:professional? (Score:2)
See the end of this document [t13.org].
Re:professional? (Score:4, Informative)
No, you certainly can't.
The hard drive will not accept any commands until you give it the correct password (stored in an eeprom). You'll get a stream of errors even if you just try to cat zeros to the drive's device.
In case it isn't obvious, I have first-hand experience with this, though on notebook drives, never desktop drives.
Re:professional? (Score:2, Informative)
To be clear, the link listed provides only one piece of information in addition to the heise article: drives come with a default master password, and it is possible to find out if it the default master password is still in place.
While handy information, it does not alleviate the security concerns. A locked drive is still inaccessable without the password. A malicious user or malware can change
Re:professional? (Score:3, Interesting)
Re:professional? (Score:3, Insightful)
directly from the site (Score:2)
Re:directly from the site (Score:2)
If the virus can set the password, I doubt that the actual contents are encrypted (that would require a few hours to do retroactively).
Re:directly from the site (Score:2)
Re:directly from the site (Score:2, Informative)
In fact the recovery company mentioned in the article reportedly didn't have to open the drive to recover the password... Probably there's a flaw in the logic that controls checking the password. I suspect the password is stored unencrypted on the disk and there's
Re:directly from the site (Score:3, Insightful)
Swap with one of your own design. Since the password is on the disk, the orginal logic board has to get it, right? That means the logic board can talk to the platters... You just need a logic board that retrieves the password for you. Then swap back and do whatever you want.
I bet that's how the data recovery outfits do it. They even stated in TFA that known models are no problem, unknown models may take awhile. Yup, designing a logic board to talk to some
Re:professional? (Score:5, Informative)
Re:professional? (Score:2)
Re:professional? (Score:2, Interesting)
The password is duplicated on each platter, so the new firmware will read the password and halt again.
Since the controller likely reads the password and stores it, if you can remove the flash chip, and you know what pin is the write pin, you should be able to;
Get duplicate drive.
Yank the rom and flash chip from the duplicate and break the write pin.
Swap the chips or just the boards.
Boot. (The password can't be written b
Re:professional? (Score:3, Interesting)
If it puts the password in the SDRAM and you try to yank the SDRAM write pin, the controller probably won't start at all. However, if you tap the memory bus, you might be able to issue your own command to erase the password in the RAM while the controller is runn
Re:professional? (Score:4, Interesting)
If this is just password protection and not encryption, wouldn't it be simpler to replace the drive controller with one using firmware that ignores the password? I'm certain the drive manufacturers would have a few of these laying around.
Re:professional? (Score:4, Informative)
Re:professional? (Score:5, Insightful)
Further, it shouldn't be that hard to solve this problem. The drive reads the data off the disk. There's a ribbon cable between the controller board and the disk. Tap the data stream. Feed it into a logic analyzer that has a digital data ouptut (e.g. a USB logic analyzer). Take the data captured, find the sync bytes, then shove the remainder into an RLL decoder.
Now figure out the ECC format used (it will typically be four bytes at the end of each sector, but this may vary). Strip the ECC bytes. You now have a track image of the track in question, probably with some extra sync bytes between sectors, but I'm not sure. If you want, you could simply single-step the drive motor repeatedly and copy the entire disk this way, but it is probably more effective to write a program that scans for things that right be an ATA password and tries them sequentially.
To make this easier, every 4 passwords or so, the tool should ask you to power-cycle the drive. To facilitate this, take a power extender cable and cut the 5v line. Put a momentary off pushbutton inline. Press for a second and then release. In all likelihood, you should only need to power cycle the drive electronics, not the drive motor (12v).
I've never tried this, of course, but in principle, it shouldn't be that bad....
Re:professional? (Score:2)
The location of the password on the platter may be determined by a random seed stored in the drive's flash ROM. The password might not be recoverable from a hash stored on the platter (so that the only way to bypass is to directly erase all sectors you suspect of having the password, which the non-hacked controller will refuse to do for you). The hash may be split and stored half on the platter, half on the flash (or the password simpl
Re:professional? (Score:2, Insightful)
Re:professional? (Score:2, Insightful)
The data is not encrypted.
Re:professional? (Score:2)
Simple FPGA interface? (Score:3, Interesting)
If this is the case, there are some IDE controller projects available on opencores. It shouldn't be a serious problem for someone to build a board that would allow you to mount the drive so you can copy data off of it - there are also open, well tested, PCI bridge modules freely available now.
http://www.opencores.org/browse.cgi/by_category [opencores.org]
If it is indeed the serious concern that people indicate, and it can be broken by the means you suggest - I challenge s
Re:professional? (Score:2)
Re:professional? (Score:2)
So you need to get access to them and erase the old password in order for a "blank" bios not to find a password mismatch.
Re:professional? (Score:2)
Which is not something most computer users know how to do. Trivial for most Slashdotters, but we have a higher level of skill than the typical computer user. It may seem strange to call a bunch of flaky geeks "professionals", but from most peoples' point of view , that's what we are.
Good lord, take a look at some of
Re:professional? (Score:2)
Wrong. You need to know the password to reset it.
RTFA.
http://www.heise.de/ct/english/05/08/172/ [heise.de]
Re:professional? (Score:2)
the word being "could" (Score:5, Insightful)
but when was the last highly destructive virus you saw ?
virus writers/skripterz have long since learnt, if you kill the host it is of no use to you, you achieve nothing
99% of viruses today are trojans because you can use your fancy stealth infection/propogation routines AND make a profit if you keep the host alive, locking a HD would be pointless and contrary to opinion most Virus writers are not stupid, misguided perhaps but not stupid
Re:the word being "could" (Score:4, Interesting)
Re:the word being "could" (Score:5, Informative)
Re:the word being "could" (Score:2)
Except that viruses - computer or real-world - aren't alive.
Re:the word being "could" (Score:2)
Re:the word being "could" (Score:2)
Mine is the ability to adapt.
Yours is evidently metabolism.
Re:the word being "could" (Score:2)
Re:the word being "could" (Score:2)
So true infuenza is so much "better" than ebola at propagating. Influenza genaraly does not kill but has you running around sneezing viral particles over everyone. Ebola gets you so fast that it does not propagate too well, plus people tend to stay clear of anyone bleeding from every hole and writhing in agony.
The problems occur when we have mutant strains of infuenza. These spread like flu but can kill. That is when the shit really hits the f
Re:The most successful ones don't kill the host (Score:2)
This comparison doesn't make any sense. Smallpox and plague are viruses, which are parasites. A parasite is a lifeform that lives by feeding off a host, and not helping the host in any way (usually harming it).
The bacteria in your gut aren't parasites; they're symbiotes. (Yes, just like the creatures in Stargate.) We rely on them to survive, just as they rel
Re:The most successful ones don't kill the host (Score:2)
Nope. Smallpox is, but plague is a bacillus, Yersinia pestis (formerly Pasteurella pestis).
Re:The most successful ones don't kill the host (Score:2)
Regardless, the bacteria that cause plague are parasitic in nature, whereas the gut bacteria are symbiotic.
Re:the word being "could" (Score:2, Interesting)
Design the virus to propogade for a fixed period of time and then lock down all of the hard drives over night.
LK
Re:the word being "could" (Score:3, Insightful)
"Need your data back? For only $1000, we'll send you the correct password. Send payment via Western Union to..."
Recent destructive worm (Score:3, Informative)
What about the witty worm?
It spread in less than an hour and the proceded to destroy data on the hosts hard disks.
Disk-Jacking to put hard drives At Your Disservice (Score:5, Insightful)
The problem is that if BIOS doesn't disable the function, a "well"-(i.e. viciously)-positioned malware (early in the boot process) could lock the hard drive on first reboot even before any protective software can kick in.
Re:Disk-Jacking to put hard drives At Your Disserv (Score:2)
Disk-Jacking to put hard drives At Your Disservice (Score:3, Informative)
Not only because any attack like this would have to work with rather primitive code on a wide(spread) variety of hardware (like an ATA hard drive - very few systems don't have one), but also because the goal of an extortionist is to have hostages (cf. the above quotes on the 1989 attack). The "horror scenario" is something like this: A malware written to
Disk-Jacking to put hard drives At Your Disservice (Score:2)
If you manage to backup every system in and out of your offices every few hours... congratulations, please let us know your storage solution...
And then if you can tell us how you put these backups back onto thousands of locked hard drives that you don't even have write access to anymore (otherwise all you'd need are spare hard drives for every
Disk-Jacking to put hard drives At Your Disservice (Score:2)
Security hole? (Score:3, Interesting)
Re:Security hole? (Score:2, Insightful)
Re:Security hole? (Score:2)
Re:Security hole? (Score:2)
Re:Security hole? (Score:2)
Re:Security hole? (Score:3, Insightful)
Re:Security hole? (Score:2)
Re:Security hole? (Score:2)
Re:Security hole? (Score:2)
On the other hand, while I have updated the firmware on a number of devices, I've never done so on a disk drive that I can remember.
It would be a good idea if the manufacturers made such firmware available that one could install before there was a problem.
Re:Security hole? (Score:2)
How is this any worse than if a virus were to erase the hard drive?
In an erase, you still have a functioning piece of hardware. You could partition, reformat, and reinstall. With a locked hard drive, you can't do any of that as I understand the problem. From the article "...The disk in this state allows no access to its data and accepts only a limited number of commands..."
Or even worse (Score:5, Interesting)
Re:Or even worse (Score:2)
It's like a comercial, please give generously.
Where is the firmware password stored? (Score:2)
I regularly work with surface mount ICs and there are solutions to remove and replace virtually any device.
Re:Where is the firmware password stored? (Score:2)
OS level fix (Score:2)
Re:OS level fix (Score:2)
Oops, the article said that. That's what I get for only reading half TFA. But, I did think of another hack - why not just buy a hard drive of the same make and model and switch the circut boards.
Re:OS level fix (Score:2, Insightful)
Funny (Score:3, Funny)
When does a diskette ever boot not "suspiciously slowly"?
Re:Funny (Score:2)
Dell BIOS HD Flaws (Score:5, Interesting)
The Dell BIOS allows users to set several different passwords to protect
their machines from unauthorised access. There is 1) a Setup Password,
which is required to enter the BIOS setup, as well as 2) a Hard Drive
Password, as per the ATA Security Feature Set Specification.
Unfortunately, once a Hard Drive Password is set which contains one or
more of the following characters,
, . ; : ' [ ] { }
it can not be later entered to access the machine. It appears as though
a bug in the BIOS code prevents those characters from being taken as
input when the user is asked for the password - however, the BIOS
incorrectly allows users to set passwords containing those characters.
This is not an incredibly serious problem as such, since a user can go
back into the BIOS setup and change the password there, provided the
BIOS Setup is not protected with an unknown password. Or, as a last
resort, Dell can be phoned to provide a master backdoor password, as
long as the user can prove herself the legal owner of the computer. Of
course, the prerequisite of physical access to the machine highly
mitigates this vulnerability.
It is however an interesting bug from the point of view of Dell's
practices. I have contacted them over two weeks ago, but their
'technical support' is unable to understand or resolve the problem. Two
of their representatives told me to reinstall Windows XP Chipset
drivers, even when I asked to be forwarded to people higher in the
technical support chain. Perhaps this post will encourage Dell to pay
more attention in the future.
Affected Systems: Dell Inspiron 2650 System BIOS, A11
(A11 is the current BIOS as of writing, and was released in late
September of this year)
Other BIOS/Dell models are perhaps vulnerable but have not been tested.
Re:Dell BIOS HD Flaws (Score:2)
keen, Dell appreciates your constructive criticism. Your Slashdot post has inspired a full-scale probe, from Bombay to New Delhi, into our technical support practices, and we plan to roll out new training methods to avoid situations like yours from happening again.
However, are you sure you have installed the latest Internet Explorer Hotfix? The version number is 6.1.2800.3.43.xpsp2.93.9.
Sincerely,
Michael Dell
--
Michael Dell
CEO an
big deal (Score:4, Insightful)
Re:big deal (Score:2)
Re:big deal (Score:2)
You RTFA. If a password is set, you can still erase the drive with the master password.
Furthermore, even if you lose the drive (and viruses can probably destroy drives by other means), that's just a cheap piece of hardware. The data is what counts.
easy prevention: only set administrator password? (Score:2, Interesting)
Access to the harddrive will only be prevented if the user password is set, but the user password can only be set when the administrator password is known.
So if I only set the administrator password, then the drive can be accessed as usual, but the user password cannot be set by some software.
Correct? or did I misunderstand that?
Re:easy prevention: only set administrator passwor (Score:4, Informative)
The incredibly stupid thing is there doesn't seem to be a way to say "disable the password mechanism completely". IMHO, this should be the default state, and it should require physical access to the drive (say, with a jumper) as well as (of course, any passwords) to switch it from one state to another. A laptop could connect that jumper to an external "security" button that you hold down while the BIOS does its thing.
Re:"Me too" on april fools (Score:2)
Where where you yesterday!
It was a laugh a minute here. Really. Honest.
Re:I love how they plan to force apple to comply (Score:4, Interesting)
to the effect that we will program a demonstration of the damaging action and make it available to Apple
This seems to imply that it has not yet been done. Any hardware changes that I have done (Open Firmware changes, DVD region set) have needed an admin password.
However, in the article it basically says that the machine has to compromised PRIOR to startup (when the security extension loads). If someone already has access to your machine with an admin password, I really don't see the point in locking the drive. There are easier ways to pull a prank or cause damage.
A hint.... (Score:2)
Re:A hint.... (Score:3, Insightful)
http://www.google.co.uk/search?q=ATA+master+passwo rd&start=0&start=0&ie=utf-8&oe=utf-8&client=firefo x&rls=org.mozilla:en-US:official [google.co.uk]
Looks pretty true to me.
Re:April Fools (Score:2)
2. no april fools joke. employees of the magazine demented it in their own forum.
Re:April Fools (Score:2)
- I am pretty sure that the April 1 article was in the previous edition of C't ('Blue Movies' from the power sockets, P 178), that was the edition that covered 1. April.
- 'hdparm -I' on one of my discs showed exactly the entries they were talking about.
Re:April Fools (Score:2)
Proof positive that it isn't an April fools joke... if it were, the command would have initiated a low level format of your HD, causing hearty chuckles all around.