Biz & IT —

Western Digital self-encrypting hard drives riddled with security flaws

Encrypted data is often easily recovered, in some cases with no password required.

Western Digital self-encrypting hard drives riddled with security flaws

Several versions of self-encrypting hard drives from Western Digital are riddled with so many security flaws that attackers with physical access can retrieve the data with little effort, and in some cases, without even knowing the decryption password, a team of academics said.

The paper, titled got HW crypto? On the (in)security of a Self-Encrypting Drive series, recited a litany of weaknesses in the multiple versions of the My Passport and My Book brands of external hard drives. The flaws make it possible for people who steal a vulnerable drive to decrypt its contents, even when they're locked down with a long, randomly generated password. The devices are designed to self-encrypt all stored data, a feature that saves users the time and expense of using full-disk encryption software.

"After researching the inner workings of some of the numerous models in the My Passport external hard drive series, several serious security vulnerabilities have been discovered, affecting both authentication and confidentiality of user data," the researchers wrote. "We developed several different attacks to recover user data from these password protected and fully encrypted external hard disks."

Most of the disks studied encrypt and decrypt data using a USB bridge that connects a computer to the external drive's SATA interface. The interface is supposed to be off limits until after the computer user has entered the correct password, and to prevent cracking attacks that try billions of password guesses each second, the plain-text passcode is cryptographically salted and subjected to 1,000 iterations of the SHA256 hash function.

But a constellation of errors makes it possible to crack the password in a short amount of time. In one case, the underlying key was predictable because the random numbers used to generate it was derived from the current time on the computer clock. That flaw was fixed last year, but it's likely many people with vulnerable drives have no idea they're at risk. In other cases, it was possible to extract the hash off the drive and load it onto a computer so it could be subjected to off-line cracking.

Yet another flaw constitutes the equivalent of a backdoor that could allow an attacker to decrypt data without knowing or cracking the user password at all. The drives ship with a default password, but in cases where it has been changed to a user-defined password only once, the key corresponding to the default password remains stored on the device, making it trivial for adversaries to decrypt it. The flaw can overcome by resetting the password a second time, but without that knowledge, it's likely many users will not take the time to do so.

The 36-page paper raises serious questions about the reliability of untested encryption built into consumer devices. Readers who want to ensure their data is unreadable, should their hard drive be lost or stolen, should continue to rely on full-disk encryption provided a known software developer such as Symantec, which years ago acquired PGP and its Full Disk Encryption application. While there's no guarantee those apps aren't susceptible to their own crippling attacks, they've been on the market longer and have had more time to be subject to the type of brutal testing discussed in this paper.

Post updated in the last paragraph to add detail about Symantec.

Channel Ars Technica