5 ms·

Malware Could Use SSD Over-Provisioning to Bypass Security Measures

heythere22 5y ago
Am I reading this correctly: * 1st: Adjust the overprovisioning area and hope that the filesystem does not budge, * 2nd: run the malware as it is now accessible and * 3rd: change the overprovisioning again to hide the malware again? Or is the malware executing from non-partitioned disk space?
- Arnavion 5y ago
  Both. The paper isn't concerned with how the malware is executed, and malware is only one of the things it talks about storing in the OP area in the first place. The paper is just about the fact that there exist SSDs where the OP area can be made to grow and shrink dynamically through external factors, and thus can be used to store things that an unprivileged program won't find. Basically, whether a program can read the data from the OP area directly doesn't really matter. The privilege needed for that is equal or greater than the privilege needed to resize the OP area anyway.
  - feupan 5y ago
    I’m not sure I follow. While resizing such area seems excessive to even be possible by the owner, I don’t see how essentially writing on unreadable sectors is a concern. This is essentially piping to /dev/null if you can’t read from it.
    - Arnavion 5y ago
      Growing the OP area == making previously accessible area inaccessible. Shrinking the OP area == making previously inaccessible area accessible.
0x53 5y ago
The title is a little misleading. This is not a discovery of malware, but rather a theorized capability that malware could use. Link to the paper on which this is based: https://arxiv.org/ftp/arxiv/papers/2112/2112.13923.pdf https://arxiv.org/ftp/arxiv/papers/2112/2112.13923.pdf It appears as though the attack is based on the assumption that you have admin level access to the computer.
- johnklos 5y ago
  It's not a little misleading - it's very misleading. Reading "New Malware Uses", one can't come to any other reasonable conclusion that there exists new malware that, in fact, uses whatever else is in the title. There's nothing even slightly suggesting that this is speculation. "New Malware Could Use" would be worlds different. The bleepingcomputer.com title is not misleading because it has the word "can": "Firmware attack can drop persistent malware in hidden SSD area" https://www.bleepingcomputer.com/news/security/firmware-attack-can-drop-persistent-malware-in-hidden-ssd-area/ https://www.bleepingcomputer.com/news/security/firmware-atta...
  - marcan_42 5y ago
    It's not very misleading - it's 100% nonsense. It's not new, it's not malware, and it doesn't and can't bypass any security measures. This is a theoretical mechanism for hiding data in the OP areas on SSDs. It cannot be used to compromise anything, because by definition data in the OP area cannot be accessed by the host, and to infect the host you need to infect data it can access. At most it could allow e.g. RAM-resident malware to hide data in the SSD, but there are much easier ways of doing that. If you've compromised the host to the point where you can issue raw commands to compromise the SSD, you can just throw your encrypted data in a file and fake the OS's free space display to hide it. And besides, malware rarely needs copious amounts of local storage anyway. This is a niche technique among niche techniques that some hypothetical highly advanced malware could opt to use for some very specific thing, and my professional opinion as a security researcher is that no malware ever will actually find this technique useful enough to actually use it. Even the "can drop persistent malware" version is highly misleading, because you need a persistent bootstrap outside the OP area to do anything. You can't just hide your malware in the OP area and expect it to run. That's like hiding a cyanide pill under the couch cushions of your victim and expecting them to find it and swallow it. Basically, just another case of security academia living in their own little world and coming up with fun but useless ideas. Not relevant to actual malware in the wild; move right along. A better use case for this technique would be as a data-hiding trick. E.g. you could put stuff in the OP area that you want $government_agency not to find if they seize and scan your device at a border crossing. But then again, there are a million other ways of doing this that don't involve wacko manufacturer-specific SSD nonsense; steganography has been a thing for ages and, if done right, is nigh undetectable. Just put your raw 44.1kHz FLAC music collection on the disk and store whatever encrypted data you want in the LSBs. That's indistinguishable from flat spectrum dither noise.
mzs 5y ago
https://arxiv.org/abs/2112.13923 https://arxiv.org/abs/2112.13923
afrcnc 5y ago
No it doesn't. It's academic research and not actual malware. Technique is also useless.
- mtmail 5y ago
  What makes the technique or approach useless?
  - Diggsey 5y ago
    The fact that to execute the malware you need to be able to see it. If there's something that's visible whose job is to execute the payload hidden in the SSD, then that's the part that could be detected by AV software. That said, it might still be a useful technique just for storing data in a hard to detect way.
wmf 5y ago
From the paper: "Recently, researchers have created a technique to vary the over-provisioning area according to the workload in the data storage system..." So this is building research on research; it doesn't apply to actual SSDs. "Micron recently released an SSD with a flex capacity feature that changes the capacity of the storage device according to the workload..." OK, this attack applies to one SSD model that came out recently.
- Arnavion 5y ago
  It's not just the Micron. The Micron is only mentioned specifically because it lets you change the OP area size as a feature. Any SSD where the OP area can be resized dynamically for any reason is affected, and the paper says: >Recently, many storage devices vary the size of the OP area in real time to optimize performance. [...] The OP area can be freely changed by the user or by the firmware manager.
WaitWaitWha 5y ago
Putting anything into the overprovisioned (OPed) areas is of little value, as the controller considers OP to be "free to use" i.e. it will simply over write it next when it calls on it (housekeeping and wear leveling). There is nothing "permanent" about that area. It is not "fixed" location on the chips. If we set the OP to smaller than the original value, the controller has to know about it (because the "setting" is telling the controller to use more of the OP). The partition maybe not be expanded, but the controller knows about it. I have used this OP adjusting in some SSDs to sanitize for nearly a decade. Set OP to near zero, single-pass overwrite accessible area with random data, execute a Enhanced Secure Erase, then set the OP back to original value, execute second ESE. (The second ESE gives a feedback if the OP changing messed the drive up.)
- jacob019 5y ago
  If you can modify the firmware to rw this region then you can modify the housekeeping code to leave that it alone until there is no more free space. Furthermore some reserved regions nay be completely unused until you have failing cells, which may never happen. Conceivably an SSD virus could use the controller's CPU to hot patch the system with a persistent rootkit. It's been done before with harddrives.
  - Sayrus 5y ago
    If you control the firmware already, you don't even need over-provisioning. You basically have a higher access-level. A disk is rarely 100% full so you could easily squeeze a few megabytes on a non-overprovisioned disk. Depending on how powerful the controller is, you can hide your malware inside it, you can compress some part of the disk to make space for yourself, ... On a malicious firmware, you can make it so the host won't see the content unless it is queried "properly". Or the controller can return malicious content when queried.
71a54xd 5y ago
Wow this is a freaking cool attack vector!
- marcan_42 5y ago
  It's not an attack vector. It's a theoretical way of hiding data that cannot be itself used to attack anything, because malware needs to run to do anything, and to do that it needs to exist in data areas visible to the host, not hidden areas that aren't.
drclau 5y ago
Unless the code hidden there is magically executed, this is just a way of hiding data, and not exactly a malware attack vector. To make this work, you need to already run on the host the code that extracts the hidden malware and executes it, and at that point you have something that is detectable.

Am I reading this correctly: * 1st: Adjust the overprovisioning area and hope that the filesystem does not budge, * 2nd: run the malware as it is now accessible and * 3rd: change the overprovisioning again to hide the malware again? Or is the malware executing from non-partitioned disk space?

Arnavion 5y ago
Both. The paper isn't concerned with how the malware is executed, and malware is only one of the things it talks about storing in the OP area in the first place. The paper is just about the fact that there exist SSDs where the OP area can be made to grow and shrink dynamically through external factors, and thus can be used to store things that an unprivileged program won't find. Basically, whether a program can read the data from the OP area directly doesn't really matter. The privilege needed for that is equal or greater than the privilege needed to resize the OP area anyway.
- feupan 5y ago
  I’m not sure I follow. While resizing such area seems excessive to even be possible by the owner, I don’t see how essentially writing on unreadable sectors is a concern. This is essentially piping to /dev/null if you can’t read from it.
  - Arnavion 5y ago
    Growing the OP area == making previously accessible area inaccessible. Shrinking the OP area == making previously inaccessible area accessible.

0x53 5y ago

The title is a little misleading. This is not a discovery of malware, but rather a theorized capability that malware could use. Link to the paper on which this is based: https://arxiv.org/ftp/arxiv/papers/2112/2112.13923.pdf https://arxiv.org/ftp/arxiv/papers/2112/2112.13923.pdf It appears as though the attack is based on the assumption that you have admin level access to the computer.

johnklos 5y ago
It's not a little misleading - it's very misleading. Reading "New Malware Uses", one can't come to any other reasonable conclusion that there exists new malware that, in fact, uses whatever else is in the title. There's nothing even slightly suggesting that this is speculation. "New Malware Could Use" would be worlds different. The bleepingcomputer.com title is not misleading because it has the word "can": "Firmware attack can drop persistent malware in hidden SSD area" https://www.bleepingcomputer.com/news/security/firmware-attack-can-drop-persistent-malware-in-hidden-ssd-area/ https://www.bleepingcomputer.com/news/security/firmware-atta...
- marcan_42 5y ago
  It's not very misleading - it's 100% nonsense. It's not new, it's not malware, and it doesn't and can't bypass any security measures. This is a theoretical mechanism for hiding data in the OP areas on SSDs. It cannot be used to compromise anything, because by definition data in the OP area cannot be accessed by the host, and to infect the host you need to infect data it can access. At most it could allow e.g. RAM-resident malware to hide data in the SSD, but there are much easier ways of doing that. If you've compromised the host to the point where you can issue raw commands to compromise the SSD, you can just throw your encrypted data in a file and fake the OS's free space display to hide it. And besides, malware rarely needs copious amounts of local storage anyway. This is a niche technique among niche techniques that some hypothetical highly advanced malware could opt to use for some very specific thing, and my professional opinion as a security researcher is that no malware ever will actually find this technique useful enough to actually use it. Even the "can drop persistent malware" version is highly misleading, because you need a persistent bootstrap outside the OP area to do anything. You can't just hide your malware in the OP area and expect it to run. That's like hiding a cyanide pill under the couch cushions of your victim and expecting them to find it and swallow it. Basically, just another case of security academia living in their own little world and coming up with fun but useless ideas. Not relevant to actual malware in the wild; move right along. A better use case for this technique would be as a data-hiding trick. E.g. you could put stuff in the OP area that you want $government_agency not to find if they seize and scan your device at a border crossing. But then again, there are a million other ways of doing this that don't involve wacko manufacturer-specific SSD nonsense; steganography has been a thing for ages and, if done right, is nigh undetectable. Just put your raw 44.1kHz FLAC music collection on the disk and store whatever encrypted data you want in the LSBs. That's indistinguishable from flat spectrum dither noise.

mzs 5y ago

https://arxiv.org/abs/2112.13923 https://arxiv.org/abs/2112.13923

afrcnc 5y ago

No it doesn't. It's academic research and not actual malware. Technique is also useless.

mtmail 5y ago
What makes the technique or approach useless?
- Diggsey 5y ago
  The fact that to execute the malware you need to be able to see it. If there's something that's visible whose job is to execute the payload hidden in the SSD, then that's the part that could be detected by AV software. That said, it might still be a useful technique just for storing data in a hard to detect way.

wmf 5y ago

From the paper: "Recently, researchers have created a technique to vary the over-provisioning area according to the workload in the data storage system..." So this is building research on research; it doesn't apply to actual SSDs. "Micron recently released an SSD with a flex capacity feature that changes the capacity of the storage device according to the workload..." OK, this attack applies to one SSD model that came out recently.

Arnavion 5y ago
It's not just the Micron. The Micron is only mentioned specifically because it lets you change the OP area size as a feature. Any SSD where the OP area can be resized dynamically for any reason is affected, and the paper says: >Recently, many storage devices vary the size of the OP area in real time to optimize performance. [...] The OP area can be freely changed by the user or by the firmware manager.

WaitWaitWha 5y ago

Putting anything into the overprovisioned (OPed) areas is of little value, as the controller considers OP to be "free to use" i.e. it will simply over write it next when it calls on it (housekeeping and wear leveling). There is nothing "permanent" about that area. It is not "fixed" location on the chips. If we set the OP to smaller than the original value, the controller has to know about it (because the "setting" is telling the controller to use more of the OP). The partition maybe not be expanded, but the controller knows about it. I have used this OP adjusting in some SSDs to sanitize for nearly a decade. Set OP to near zero, single-pass overwrite accessible area with random data, execute a Enhanced Secure Erase, then set the OP back to original value, execute second ESE. (The second ESE gives a feedback if the OP changing messed the drive up.)

jacob019 5y ago
If you can modify the firmware to rw this region then you can modify the housekeeping code to leave that it alone until there is no more free space. Furthermore some reserved regions nay be completely unused until you have failing cells, which may never happen. Conceivably an SSD virus could use the controller's CPU to hot patch the system with a persistent rootkit. It's been done before with harddrives.
- Sayrus 5y ago
  If you control the firmware already, you don't even need over-provisioning. You basically have a higher access-level. A disk is rarely 100% full so you could easily squeeze a few megabytes on a non-overprovisioned disk. Depending on how powerful the controller is, you can hide your malware inside it, you can compress some part of the disk to make space for yourself, ... On a malicious firmware, you can make it so the host won't see the content unless it is queried "properly". Or the controller can return malicious content when queried.

71a54xd 5y ago

Wow this is a freaking cool attack vector!

marcan_42 5y ago
It's not an attack vector. It's a theoretical way of hiding data that cannot be itself used to attack anything, because malware needs to run to do anything, and to do that it needs to exist in data areas visible to the host, not hidden areas that aren't.

drclau 5y ago

Unless the code hidden there is magically executed, this is just a way of hiding data, and not exactly a malware attack vector. To make this work, you need to already run on the host the code that extracts the hidden malware and executes it, and at that point you have something that is detectable.