How To Head Off ATA HDD Password Abuse

An anonymous reader submits "German c't magazine has a story about abusing the security features of ATA hard disks. The bottom line is that almost all ATA hard disks in desktop PCs can be password-protected. However, on most desktop PCs, the BIOS does not support locking this option -- so viruses or malware could set a random password, making any data unreadable unless recovered by professionals."

Comments

why would you do this?

[Doppler00]

Why on earth would you want to password "protect" a hard drive? How would that be any better than properly encrypting your files?

Re:why would you do this?

[tivoKlr]

Well, for software modding an Xbox for starters.

Xboxen will only boot from a locked hard drive, and to modify the files on an Xbox to, you know, allow you to run your own home written unsigned code, you need to be able to lock the drive once you've modified it to get the Xbox to recognize it.

I have encountered bioses that won't allow you to lock or unlock drives. Very annoying...

Re:why would you do this?

[Anonymous Coward]

For the Xbox, you only need to lock it again if you want to run it with a normal MS bios and not one of the unoffical MS bioses, or one of the ones designed for just Linux.
I've been running mine unlocked ever since I replaced the hard drive. I don't run a normal MS bios, so I never saw a reason to lock it again.

Re:why would you do this?

[notque]

Why on earth would you want to password "protect" a hard drive? How would that be any better than properly encrypting your files?

So that when I die no one can go through my harddrive?

Re:why would you do this?

[Anonymous Coward]

Why on earth would you want to password "protect" a hard drive? How would that be any better than properly encrypting your files?

So that when I die no one can go through my harddrive?

You didn't answer his question. How would a firmware lock be better than strong encryption?

(It's a cute little supplement, IMHO, but definitely not a replacement.)

Re:why would you do this?

[darkwhite]

Why on earth would you want to password "protect" a hard drive? How would that be any better than properly encrypting your files?

Speed.

Only very sophisticated organizations have the means to lift data off a password-protected hard drive. Encryption, while more durable in that regard, sacrifices speed with every access to the files in question.

Re:why would you do this?

[Anonymous Coward]

Because with encryption I can still get at the data to analyze, and it doesn't lock me out, requiring a powercycle of the drive/hard reset to try more passwords after 5 bad attempts.
With the firmware lock, I have to disable the lock to get at the data. Since it is also done in hardware, it doesn't mater what OS or filesystem is on the drive.

Re:why would you do this?

[Anonymous Coward]

Neither process alone REALLY protects your data, if they want your files, all they have to do is wait for you to start the machine and log in. In that regard, individual file encryption minimizes the problem to only those items that were open at the time.

Someone else mentioned the xbox drive locking but it suffers from the same problem... boot the xbox then swap the drive over to a PC.

Re:why would you do this?

[mm0mm]

the external hard drive you had in your bag yesterday?

Re:why would you do this?

[discordja]

of course, the proper tools and you can easily bypass that as well (professional data recovery teams wouldn't have much of a job to do if it was easy as you say to lock the data away for good). pull the drive apart and read straight off the platters if need be.

tools tools tools .. sure the NSA could break strong encryption given enough time but so could any determined individual that wanted to read the disk.

Re:why would you do this?

[darkwhite]

If you have started the machine and logged in, it is assumed that you are actually in control of the machine and its environment. The proper way to protect a running machine is to lock the screen and the bootloader (so the only way to get local access to the disk is to power cycle and face the master password) and to have a secured network interface (which you can never be 100% sure about but you can get pretty close).

Of course, if you have a trojan installed or are being held hostage, these security principles don't work. The ATA password feature was designed to protect corporate data without the slowdown and incompatibilities possible when using software encryption.

Re:why would you do this?

[TWX]

the point isn't for unbeatable, fully 100% secure everything, it's like The Club for your car, to make you a less desirable target. If there are 100 PCs in a given sample, with four with locked drives, properly set up OS-level security, and no way to quickly gain access to the inside of the machine to physically mess with things (I'm assuming a semi-public environment), then those other 96 are the ones that people will typically mess with.

Re:why would you do this?

[Newtonian_p]

What if you want to use XBox live? My understanding is that the service checks your BIOS and bans you if you don't have the official MS one.

Re:why would you do this?

[Anonymous Coward]

No, if u have a modchip the original bios can be booted, however if u softmod, or flash original bios then ur banned from liveif u go on with a non-unique or hacked bios

Re:why would you do this?

[archen]

My understanding is that this was intended mainly for laptops. I'm not sure how long this has been a part of the standard, but I wouldn't be surprised if many laptops were still being distributed with Windows 98 when this was drawn up. Is it better than encrypting your files? Well of course not, but it doesn't slow down the hardware at all, and it's rather simple.

But how safe is encrypting your files? What algorithm does it use? Is it implemented properly? Even if you know for sure, someone can read the data off the drive use a brute force attack (impractical but possible). With the ata password you can't (easily) read anything off the drive short of a raw read off of the platters, so I wouldn't say it's that bad of an idea.

I'm just sort of curious how this would affect ATA RAID controllers. Would it pass such a command through, or just ignore it?

Re:why would you do this?

[Anonymous Coward]

Easy solution: I don't use XBLive.

If you use a non-MS bios (modded) it will get you banned. If the mod is disabled, so you are using an offical MS Bios, you can usually play with Live with out trouble.
However, there appears(a few months ago) that they are doing some XBox-Harddrive linking, so if you hard drive changed serials for some reason (say you have a mod chip and you have used that to install a different hard drive and lock it), you can get banned as well.

Re:why would you do this?

[james_r_boyer]

For a business laptop its acutally quite cool. I know my old pentium 120 thinkpad had the ability to do this and its a great way of making a portable machine completely useless to a theif.

Re:why would you do this?

[that _evil _gleek]

Ya.
This is just supesition but I'm assuming if 1 enables this in the bios, your password is then stored
in bios's cmos memory and the bios then uses that to unlock the drive, to the support an autoboot feature.
so the machine can boot by itself , w/o user interaction. So any computer that someone could just snatch and grab
will likely autoboot and unlock the drive, and not be very good security, maybe for office desktops where maybe
someone could open the case, take the drive , but not abscond with the the whole machine.

Of course, there could be a CMOS bios lock as well, and if the password is there and booting options restricted,
then if one zaps the cmos via jumper, one loses the drive password, and that could work pretty well for security,
Though if it send to autoboot a cd or floppy , it would be easy to get the appropiate cmos util, run it to clear
the password, then steal drive password. If the bios was set to only boot the locked drive, then 1 might be able to
replace the drive, maybe using 1 with exact same parameters ( if auto config is off), and boot (then steal info from cmos again) unless the bios will refuse to boot an unlocked the drive -- I mean if the bios goes to trouble of checking that
the drive is locked... again just guessing but if a locked drive just returns ERR_LOCKED or whatever to any ati command
then the bios might only try to unlock the drive, if its locked... so swapping drives might work.. Considering a good implementation and good user behavior , it could be good. Also if you can't lock a drive w/o the old password..

Now if the above is true, and the hacker knows the CMOS of the machine very well, then its possible that a prog
could access the cmos memory lock down the cmos setting to only boot the now infected drive, put the drive password
in cmos (its probably encrypted with some simple hash, but assume he or she has broken that ) , now do the drive lock,
and 0wn the machine... Now the user is locked in. He or she has noticed that his computer is slower, but he can't
do anything about it, and he can't boot to trusted media, because the cmos is locked, if the cmos is zapped the drive password is lost and all data is lost, he can use the machine but has to live with slowdowns as the machine is used for ddos attacks and the like.

Re:why would you do this?

[Anonymous Coward]

BS!

If I saw 100 PC's and only four with locked drives, I'd steal the four and crack into them at a later "safer" place! People/Corporations wouldn't idly lock four out of 100 PC's just for the fun of it! They would most likely be the ones with critical/important data on it that may be used maliciously!

*If you know what you are doing and the rewards outway the risks* Do you steal a 1986 Ford XF Falcon (minimal security) or a BMW M3 Coupe (pics from google search

Re:why would you do this?

[markwalling]

u m3an that u actually ha5 3 l3tt3r5? n0 way dud3, l1k3 ur t0ta77y g01ng t0 ru1n 1337 sp33k 4 a11 0f u5 1337 h4x50r5 damn thats annoying

Re:why would you do this?

[draziw]

Only very sophisticated organizations have the means to lift data off a password-protected hard drive. Encryption, while more durable in that regard, sacrifices speed with every access to the files in question.

Really? So I can't just buy another drive that is the same, swap the PCBAs and have instant access to my data? (give that a shot.)

Re:why would you do this?

[ciscoguy01]

I can't imagine a valid reason to password protect a hard drive, especially at drive level-though most support that now.
There are supposedly default passwords for many PC Bioses. I haven't tested them but if the ones I have saved are valid bios pw is not good security in any case.
Postscript controllers like used on the early Apple Laserwriter printers had such a password capability at the controller level. It amazes me that there was never any mischief with those in all these years, at least that I have heard of.
Those things were $5900 when they came out years ago!

Re:why would you do this?

[Niet3sche]

OP and everyone else seems to be missing something here: you would want to do this if you're into kleptography. For instance, you could insert your password-protecting payload into a worm/virus, and then include drop-box instructions/etc and have a "ransom received" virus hit the box again, enter the correct password, and then disable the password and die. If, that is, you're an honest blackmailer. The short of it? "Cooperate with us and send money otherwise suffer and either do without or spend a good deal more money getting the data recovered". Great for the whole information brokerage idea.

Re:why would you do this?

[Alsee]

Only very sophisticated organizations have the means to lift data off a password-protected hard drive.

And those "sophisticated organizations" are making money selling exactly that service. They will cheerfully do it for anyone for a few hundred bucks.

If you have any specific need for data security then any system that can be disabled merely by spending a couple of bucks does not provide any security at all.

-

I love how they plan to force apple to comply

[mal0rd]

Apple also sees no need for action - to load a kernel extension it is necessary to enter the administrator's password, the company noted. We have come to an agreement with Apple to the effect that we will program a demonstration of the damaging action and make it available to Apple. Perhaps someone in the United States will change his or her mind once he or she can only access their hard disk after entering correctly "c't Magazin für Computertechnik" (including the umlaut!).

Re:I love how they plan to force apple to comply

[theid0]

to the effect that we will program a demonstration of the damaging action and make it available to Apple

This seems to imply that it has not yet been done. Any hardware changes that I have done (Open Firmware changes, DVD region set) have needed an admin password.

However, in the article it basically says that the machine has to compromised PRIOR to startup (when the security extension loads). If someone already has access to your machine with an admin password, I really don't see the point in locking the drive. There are easier ways to pull a prank or cause damage.

Re:I love how they plan to force apple to comply

[Anonymous Coward]

On the other hand, it's a lot easier for the average Mac user to enter the umlaut in für than it is for the average PC user. option-u,u compared to alt-(keypad)0252.

I've been using PCs for years and I still had to look the alt-code up, yet I can easily remember the Mac method. Then again, I do understand basically what an umlaut is.

Still, if I had to enter "c't Magazin für Computertechnik" everytime any system booted, I'd rather enter it on a Mac.

professional?

[AmigaAvenger]

unless recovered by a professional? It takes all of 2 minutes to make a boot disk with atapwd and reset it. Besides, the reason no virus does this is because it needs an operational machine. If you lock out the drive you aren't going to spread yourself very far.

Here is a website that shows how to unlock it, and you don't even have to be a professional!

http://www.rockbox.org/lock.html

Re:professional?

[Anonymous Coward]

If you lock out the drive you aren't going to spread yourself very far.

Think of it like this: A Slashdotter with a venereal disease. He isn't going to infect anyone.

Re:professional?

[Anonymous Coward]

Have you read what it says on the page you link to?, that only works if password is the blank, if a viri would set a random password you are screwed, you got yourself a 3.5" paperweight

Re:professional?

[C_To]

Did you read the bottom part of the page you quoted? It said there was no way to fix the ATA password in Maximum security mode without knowing what it is.

Re:professional?

[Cylix]

Eh,
you can wipe the disk for a recover if the master password is tampered.

Read the provided roxbox link.

Re:professional?

[warrior]

No, you cannot use atapwd to reset it. There are two passwords, a master and a user. If you know the master password, you can use atapwd to reset the user password. These passwords are stored across platters and are stored as a checksum in flash on the HD controller. Resetting the password is not trivial at all. There are two options, use a logic analyzer and try to intercept the pieces of the password on it's way in to generate the checksum (haven't heard of anyone being able to accomplish this), or take the drive apart in a clean room, erase the password of the platters and attach a virgin controller. There are no companies in the US that will do either of these for you, and I don't think that's a coincidence. The very few (3-4) companies that perform this service make very good money of it. If you don't believe me, set your master ATA pwd to a known value and try to reset it by any means _without_ using the password. You can't, you're hosed. Most people at this point chuck the disk, they're cheap. But if you need the data you'll pay anything. The idea behind it is that should it get stolen, the data is safe. The companies that do data retrievel require proofs of ownership. However, for the fool that forgets or accidentally sets the password, you're hosed. For those of you that own Toshiba 80GB laptop hdds, beware, there's a flaw in the controller that may glitch and set a random password for you. In that case you'll want to talk to Nortek.

Re:professional?

[js7a]

Why the heck can't you just replace the chip with the flash with a new one? Or take it out and flash it back to it's initial state and plug it back in?

Re:professional?

[Anonymous Coward]

How about if it infects, spreads and then locks down?

Re:professional?

[Qzukk]

There are two options, use a logic analyzer and try to intercept the pieces of the password on it's way in to generate the checksum (haven't heard of anyone being able to accomplish this), or take the drive apart in a clean room, erase the password of the platters and attach a virgin controller ....

If this is just password protection and not encryption, wouldn't it be simpler to replace the drive controller with one using firmware that ignores the password? I'm certain the drive manufacturers would have a few of these laying around.

Re:professional?

[fm6]

unless recovered by a professional? It takes all of 2 minutes to make a boot disk with atapwd and reset it.

Which is not something most computer users know how to do. Trivial for most Slashdotters, but we have a higher level of skill than the typical computer user. It may seem strange to call a bunch of flaky geeks "professionals", but from most peoples' point of view , that's what we are.

Besides, the reason no virus does this is because it needs an operational machine.

Good lord, take a look at some of the viruses out there. Most of them render the machines they're on unusable, after taking some time to propagate themselves. Next you'll be telling me the HIV virus is harmless!

Re:professional?

[flowerp]

Wrong. You need to know the password to reset it.
RTFA.

http://www.heise.de/ct/english/05/08/172/

Re:professional?

[darkwhite]

Your reasoning is correct - that should be the easiest way. But I'm willing to bet the HDD manufacturers don't have a few of these laying around because if it became known that a particular HDD has password-bypassing controller boards available on the grey/black market, the corporations who use this feature as part of their security procedures would stop buying that manufacturer's drives.

Re:professional?

[Anonymous Coward]

Why the heck can't you just replace the chip with the flash with a new one?

The password is duplicated on each platter, so the new firmware will read the password and halt again.

Re:professional?

[rhythmx]

Resetting the password is not trivial at all. There are two options, use a logic analyzer and try to intercept the pieces of the password on it's way in to generate the checksum (haven't heard of anyone being able to accomplish this), or take the drive apart in a clean room, erase the password of the platters and attach a virgin controller.

Actually replacing the controller would probably not have to be done in a clean room. The way that newer HDDs are manufactured is to have the platters and heads sealed in a metal box with a ribbon cable or something going to an external controller. Since you don't have to break the seal on the drive enclosure, replacing the controller becomes a relatively simple matter involving a screwdriver and possibly light solder work, but *only* if the new controller is exactly the same as the old one.

It's a much cheaper method than hiring a data forensics consultant, but it would still not be cheap. It would cost you the price of a whole new drive (the only way to get an identical controller) to get your data back.

For some, the inablity to disable the password feature could cause huge monitary damages. If someone were to be so malicious, for example, they could disable thousands of drives across a corporate network with a single password, and then demand ransom for its disclosure.

Re:professional?

[mkldev]

I'm willing to bet drive manufacturers -do- have custom firmwares that do that. Why? Because otherwise they would end up generating a lot of bricks while testing bug fixes to those parts of the firmware....

Further, it shouldn't be that hard to solve this problem. The drive reads the data off the disk. There's a ribbon cable between the controller board and the disk. Tap the data stream. Feed it into a logic analyzer that has a digital data ouptut (e.g. a USB logic analyzer). Take the data captured, find the sync bytes, then shove the remainder into an RLL decoder.

Now figure out the ECC format used (it will typically be four bytes at the end of each sector, but this may vary). Strip the ECC bytes. You now have a track image of the track in question, probably with some extra sync bytes between sectors, but I'm not sure. If you want, you could simply single-step the drive motor repeatedly and copy the entire disk this way, but it is probably more effective to write a program that scans for things that right be an ATA password and tries them sequentially.

To make this easier, every 4 passwords or so, the tool should ask you to power-cycle the drive. To facilitate this, take a power extender cable and cut the 5v line. Put a momentary off pushbutton inline. Press for a second and then release. In all likelihood, you should only need to power cycle the drive electronics, not the drive motor (12v).

I've never tried this, of course, but in principle, it shouldn't be that bad....

Re:professional?

[imsabbel]

Well, you arent done with changing the controller, because there is still the password on the discs.
So you need to get access to them and erase the old password in order for a "blank" bios not to find a password mismatch.

Re:professional?

[hashwolf]

"Besides, the reason no virus does this is because it needs an operational machine."

Hah!

Well know stratagem employed by a good number of destructive viruses...

1) Spread to as many machines as you can...
2) Lock all hard drives on a specific date...
3) ....
4) Profit! *

* For us techs obviously!

Re:professional?

[HappyClown]

Nope, RTFA. Part of the firmware and password is stored on the HDD itself, so even replacing the entire drive controller hardware doesn't help.

Re:professional?

[Spoing]

1. 1. Why the heck can't you just replace the chip with the flash with a new one?

   The password is duplicated on each platter, so the new firmware will read the password and halt again.

Since the controller likely reads the password and stores it, if you can remove the flash chip, and you know what pin is the write pin, you should be able to;

Get duplicate drive.

Yank the rom and flash chip from the duplicate and break the write pin.

Swap the chips or just the boards.

Boot. (The password can't be written back to flash.)

Passwords are ignored.

Copy data off of the drive.

The downside being that you now have two useless drives, though you could swap in the flash chip from the protected drive to see if it can be used in the new duplicate.

Re:professional?

[ScrewMaster]

True ... the only question is how he got it in the first place.

Re:professional?

[gmuslera]

Well, a method to low down the email worm trend is to release a virus (i.e. the next mydoom/beagle/etc) that sends a big numbers of copies of itself (1k, 10k, whatever), and then encrypt the disk. The people that always click on attachments or use unsafe clients will start to fade fast (specially because will have no clue on how to unlock it or find websites with software for that).

Re:professional?

[TummyX]

Yes it will. Who cares what's stored on the HDD? The BIOS doesn't need the password to read data. It's not like the data is encrypted using the password as a key.

Re:professional?

[spectre_240sx]

All of the sudden the neighbors dog walking funny makes sense.

Re:professional?

[HappyClown]

*sigh*. I said RTFA for a reason. If you actually HAD read it, you would have seen this paragraph:

"The hard disk manufacturers have repeatedly assured the public that they have not built into their devices backdoors in the form of secret master keys and are hence themselves unable to unlock a password-secured hard disk. Even swapping the electronics of the protected hard disk for that of an unprotected one will not suffice to outwit the protection, because large sections of the firmware and the password itself are stored on the hard disk itself and not as one might have expected in flash memory on the motherboard."

Re:professional?

[mysidia]

You mean: there is not a way provided to unlock the disk other than erasing it if locked in Maximum mode, even if you know both passwords.

I bet there's some way around it though: it's just not atapwd.

Re:professional?

[darkwhite]

You can't. You still need to pass the password with the SECURITY ERASE UNIT command.

See the end of this document.

Re:professional?

[tacarat]

Well, that's assuming the virus isn't set to drop a bomb on the system on a certain date. The idea of making 1,000 or more computers become inoperable at the exact same moment would appeal to blackmailers, pranksters or folks with other motives.

Re:professional?

[Lehk228]

yes there is, get an identical drive and swap the logic boards.

Re:professional?

[darkwhite]

It doesn't have to be so easy if the OEM is really concerned about this.

The location of the password on the platter may be determined by a random seed stored in the drive's flash ROM. The password might not be recoverable from a hash stored on the platter (so that the only way to bypass is to directly erase all sectors you suspect of having the password, which the non-hacked controller will refuse to do for you). The hash may be split and stored half on the platter, half on the flash (or the password simply salted with a unique constant value on the controller's internal ROM before hashing), making the original password useless with a new controller board. The password might be stored not in plaintext bytes but in some more obscure format.

Many of these things can probably be overcome by tapping the buses and deducing things, but it might be extremely difficult.

And of course the OEM might have some test units with the protection disabled, I'm just saying it's probably extremely hard to obtain them (unless you're a national security organization in the country where they're located...)

Re:professional?

[tomhudson]

yes there is, get an identical drive and swap the logic boards.

RTFA: The passwords, and most of the drive firmware, are stored on the drive platters, not on the logic boards.

Re:professional?

[darkwhite]

The controller likely reads the password from the platter on each power up and stores it in the on-chip cache or the SDRAM (the modern ATA drive controller has to be a full-featured processor). It most likely doesn't copy the password to the flash.

If it puts the password in the SDRAM and you try to yank the SDRAM write pin, the controller probably won't start at all. However, if you tap the memory bus, you might be able to issue your own command to erase the password in the RAM while the controller is running.

Re:professional?

[Anonymous Coward]

TFA specifically noted that enough of the internal software for the HD is on the platter, that this won't work.

Ie tfa implies that the flags and passwords are on the platter, not in the controller.

Therefore if you know of instances where it has worked, don't assume that it will work in all cases.

In the case of a maximum security locked drive, since the data itself is not encripted I presume if the contents are valuable enough, the standard data recovery schemes that re mount the platters in a test jig and address them with diagnostic heads would recover the data.

So I doubt that maximum security mode is of real value. The protection is brittle, if the data is worth real money, it can be got at.

And the failure mode seems unreasonably damaging for the brittle protection offered.

Shoka

Re:professional?

[TummyX]

Ofcourse swapping the electronics from a protected hard disk to an unprotected one won't work. But swapping the electronics for one that *doesn't care* about the password will.

The data is not encrypted.

Re:professional?

[Anonymous Coward]

Speak for yourself, you fucking retard. You have no idea what you're talking about. You have no idea how to reset a locked HD.

Please just shut up and / or kill yourself. Fuck....

Re:professional?

[Rolo Tomasi]

All recent drives allow uploading of firmware updates. So you simply

1. read out the firmware
2. disassemble the firmware
3. find the code that checks for password
4. replace it with NOPs
5. upload patched firmware to drive
6. Profit!

Of course this assumes that you can still upload new firmware to a locked drive ... no idea if that works, but who knows, even if not, maybe there's some weakness that would allow you to do it.

Re:professional?

[Anonymous Coward]

What are you, a fucking nigger or something?

"I had no regular employment during this period. I subsisted on a variety of part-time and seasonal jobs, including consulting on small- and home-office computing. I filled in my extra time with volunteer and academic work, some of which I still continue. My volunteer activities include tutoring work for the Marin Literacy Project, database design for various nonprofit agencies, and editorial/production work for Project Gutenberg and the Free Online Dictionary of Computing."

Re:professional?

[Anonymous Coward]

Didn't you read the comment at all? The passwords are on the platters, that's the actual disk media. Only a checksum is in the flash.

Re:professional?

[David Horn]

RTFA. The article actually states that the recovery company accessed the contents of the drive WITHOUT taking it apart.

Re:professional?

[techfury90]

You could desolder the flash and do that, or create something that clips onto the flash chip while still on the controller and flash that way.

Re:professional?

[techfury90]

So? You could just attach something to where the controller connects and use that to blank out the password.

Re:professional?

[evilviper]

you can wipe the disk for a recover if the master password is tampered.

No, you certainly can't.

The hard drive will not accept any commands until you give it the correct password (stored in an eeprom). You'll get a stream of errors even if you just try to cat zeros to the drive's device.

In case it isn't obvious, I have first-hand experience with this, though on notebook drives, never desktop drives.

Re:professional?

[k8to]

I am baffled that the parent was modded up, given that it is clearly incorrect even according to the link listed.

To be clear, the link listed provides only one piece of information in addition to the heise article: drives come with a default master password, and it is possible to find out if it the default master password is still in place.

While handy information, it does not alleviate the security concerns. A locked drive is still inaccessable without the password. A malicious user or malware can change the master and user password and still render the drive a brick.

Re:professional?

[incabulos]

How trustworthy do you believe the people are that made these 'protections' ? Their assurance that they have done the right thing and havent inserted any secret backdoors into their proprietry code is not good enough, I'm sure it would be a simple thing to bring up plenty of examples in which companies have lied in similar situations. This is another form of Treacherous Computing, in which control over your system is not retained by you, but is in the hands of some third party.

Its a similar problem to having proprietry BIOS present on the motherboard, an issue now being addressed by the Campaign for Free BIOS. Given that the harddrive has a type of firmware, its likely flash-upgradable in some fashion. It would be a great thing to replace this with Free Software that allows the user to have full control over their system.

Re:professional?

[Anonymous Coward]

I am not an EE. But... Couldn't you just take a HDD that you had the pass to. Make an image of the ROM, Then flash the ROM on the victim drive with your ROM image. Hook the victim drive back up to a compputer and your password should work on it.

Granted this may take some low level electronics voodoo but I am sure that there are plenty of gEEks out there who could figure out a wy to do it.

Re:professional?

[Anonymous Coward]

I got mine from a slashdotter, you insensitive clod!

Re:professional?

[Rich0]

I don't think you need to chuck the disk. I think there is an ATA command which tells the disk to clear the password - after erasing the contents of the disk.

So, the hard drive doesn't become useless - but the data on it does...

Re:professional?

[Anonymous Coward]

The command set for re-flashing a hard disk is very hard to get hold of, as is the protocol. With so many drives and versions of firmware, plus uncooperative, a common back door should exist. One, like issue security erase, then recover the freshly erased data is one possibility. As most flash has 2 partitions, faulting one flash partition is another avenue.

Re:professional?

[1u3hr]

Well, that's assuming the virus isn't set to drop a bomb on the system on a certain date. The idea of making 1,000 or more computers become inoperable at the exact same moment would appeal to blackmailers, pranksters or folks with other motives.

True, but if there is a virus installed, it can destroy (or encrypt) data in any number of other ways already. The professional virus writers, who could unleash such a thing, seem focussed on hijacking machines rather than destroying them. Anyway, the consequences seem to be exactly the same as a hardware failure, for which you should have backups anyway.

Re:professional?

[evilviper]

The controller likely reads the password from the platter on each power up and stores it in the on-chip cache or the SDRAM [...]. It most likely doesn't copy the password to the flash.

I don't haven't experienced passworded desktop drives, but I can tell you that notebook drives certainly don't work this way. If they did, it would be a simple matter to run a powerful magnet over the drive to erase the password stored on the platter(s). Unfortunately, that does not work.

There is a tremendous ammount of information on the web from people who have tried to recover passworded notebook hard drives, and I've never heard a report of success by wiping the platters.

You will find, however, that swaping the board with an identical one, always works perfectly. That's because the password IS stored in an eeprom, and this fact is well-known to anyone with any experience with passworded hard drives.

Feel free to password-protect an old notebook hard drive you have sitting around, and try unlocking it. You'll get a lot of education on the subject, very quickly.

Re:professional?

[k8to]

According to BOTH the Heise article and the linked message: no.

Drives store the password data on the drive, not on the electronics, so the attack vector of controlling the electronics directly, while theoretically workable, will be difficult enough to be a waste of time. Apparently, again according to the article, data recovery specialiasts have figured out how to bypass the password security. It is possible they they use logic probes and the like, or it is possible they are just sending unxpected and poorly checked ATA commands. Certainly, if they can do it, you can do it.

So yes, it is _possible_ to retreive the data, but it is not clear how one would even start to go about it. It is likely that the cost of retreiveing the data yourself will be significantly higher than paying the specialists, and significantly higher than buying a new drive. It might _not_ be significantly higher than the cost of data loss.

Re:professional?

[Anonymous Coward]

you are a fucking retard, TummyX. What kind of a retarded name is TummyX anyway?

the word being "could"

[Anonymous Coward]

but when was the last highly destructive virus you saw ?

virus writers/skripterz have long since learnt, if you kill the host it is of no use to you, you achieve nothing

99% of viruses today are trojans because you can use your fancy stealth infection/propogation routines AND make a profit if you keep the host alive, locking a HD would be pointless and contrary to opinion most Virus writers are not stupid, misguided perhaps but not stupid

Re:the word being "could"

[Tony Hoyle]

It depends... in nature viruses silently reproduce before killing the host. There's no reason why computer viruses couldn't do the same - this would be very effective.

Re:the word being "could"

[Lord Kano]

What if someone is trying to get revenge on a former employer?

Design the virus to propogade for a fixed period of time and then lock down all of the hard drives over night.

LK

Re:the word being "could"

[kwalker]

Yes but the MOST successful viruses go years before they kill the host so as to maximize their infection rates. Plus often when a virus kills the host it's because the virus became TOO successful. Some viruses, like some of the herpes viruses, never kill the host, thereby living as long as the host organism does.

Re:the word being "could"

[Anonymous Coward]

It depends... in nature viruses silently reproduce before killing the host. There's no reason why computer viruses couldn't do the same - this would be very effective.

Effective at what, mimicking nature? There's no advantage to doing that.

Re:the word being "could"

[0racle]

Lots of viruses never kill the host unless they have an already compromised immune system. When was the last time someone without AIDS died from a cold. On top of that, a computer virus could be defined as a program made to cause havoc. Killing the host system removes the chance of that instance infecting others, making a poor virus. That is probably one of the reasons you haven't had to worry about mysterious formatting going on.

Re:the word being "could"

[cosmo7]

thereby living as long as the host organism does

Except that viruses - computer or real-world - aren't alive.

Re:the word being "could"

[nacturation]

So the clever blackmailer would then send a ransom note to an attached printer, wait for confirmation of a successful print, and then initiate the lockdown. If it can't find a printer, it would just use that host to spread to other machines. Gotta be ethical, right? :)

"Need your data back? For only $1000, we'll send you the correct password. Send payment via Western Union to..."

Re:the word being "could"

[kwalker]

True, but tell them that. They certainly propegate and reproduce like they think they are.

Re:the word being "could"

[Anonymous Coward]

It's called a payload. Viruses usually have two parts, the infection routines and the payload. You make a worm/trojan that will redproduce and distribute itself as quickly as possible and eventually activate a payload code that will do something eeevil.

Until now, most worms don't have a payload, or have been something as simple as DOSing microsoft or some other web site, or rebooting the machine every 30 seconds. But there is no reason the worm couldn't wait 30 days (or until a virus scan) and change the HDD pasword, flash the BIOS with random data, turn off all fans and start calculating all the digits of PI, and so on.

My guess is that we haven't seen this happen because it's beyond the skills of your average script kiddie, but I've always worried about what would happen if somebody with a clue got pissed one day and actually decided to write a real worm.

I guess the fact that this hasn't happened gives you hope on the computing industry. Apparently everyone with a clue understands that this power should be used for good, not evil :)

Re:the word being "could"

[Short Circuit]

The same concept of natural selection applies. A viruses' genetic line only continues as long as more viruses of like form are created. Killing an infected host prevents that host from being used to propogate the virus.

I'm still waiting for someone to produce a VBScript that randomly self-obfuscates every time it tries to spread, and stores itself in a different place, using a different auto-run mechanism, every time it infects a new host.

Add in webcrawling support to find new snippets of VBScript to insert into its code, for self-mutation.

That one will be hard to defend against. Plugging every security hole will be difficult, so long as the script keeps finding proof-of-concept code for new avenues of attack.

Heck...I might try writing something in Perl that eval()s code snippets it finds on the Internet. That ought to be interesting to watch run in a sandbox.

Re:the word being "could"

[Anonymous Coward]

There's no advantage to doing that.

There is if you want to piss a bunch of people off. , which I'm willing to bet would come to pass if worm spread around silently, then suddenly nuked the computer.

People say there's no advantage to going into a crowd and blowing yourself up... Yet they still do it. I wonder why that is.

Re:the word being "could"

[mrsev]

Depends on your defenition of alive. I have not seen a "perfect" definition yet.

Mine is the ability to adapt.

Yours is evidently metabolism.

Re:the word being "could"

[mrsev]

"When was the last time someone without AIDS died from a cold."

So true infuenza is so much "better" than ebola at propagating. Influenza genaraly does not kill but has you running around sneezing viral particles over everyone. Ebola gets you so fast that it does not propagate too well, plus people tend to stay clear of anyone bleeding from every hole and writhing in agony.

The problems occur when we have mutant strains of infuenza. These spread like flu but can kill. That is when the shit really hits the fan. Look up the Spanish Flu from the begining of the 20th century.

It is very intersting actually the comarisons that can be made with IT and biology as IT gets more and more advanced. You can now use models of epidemiology for predicting viral infections of PCs. The stuff about vaccinations can be related to windows patches. It is important for your neighbours kids to be vaccinated as well as your own. It is important for your neighbours computer to be secure or he will waste your bandwidth.

Re:the word being "could"

[1u3hr]

It depends... in nature viruses silently reproduce before killing the host.

Cold viruses don't usually, for instance. Most peoepl have viral infections several times a year and survive, not to mention herpes and such on your skin, etc, etc.

But some do, the new ones. After a while they become less lethal, the longer their host lives and is incubating more virus, the better for it. From what I've read, our cells are full of ancient virus fragments that started as infections and became domesticated enough to merge into our DNA.

"Me too" on april fools

[halsathome]

_One_ april fools joke from a news source is cool. Wen you see the tenth "joke" on slashdot, its a bit old. When _all_ of those are just re-reporting of other sites' jokes, its pathetic.

Re:"Me too" on april fools

[Tony Hoyle]

Only tenth?

Where where you yesterday!

It was a laugh a minute here. Really. Honest.

Disk-Jacking to put hard drives At Your Disservice

[D4C5CE]

There's a larger risk looming in this unwelcome feature... From an earlier submission:

Heise has just released a dire warning (and temporary treatment) from c't regarding ATA hard disk security passwords: There may be a gaping security hole in millions of computers that allows malware to lock the hard drives from their legitimate users. Some will remember what this means from extortionate trojan horses as early as 1989 (search for "Panama" - judicial outcome in 1995). Now factor in how some similar disaster, "supported" by firmware, could spread over the Internet rather than by postal mail today...

It seems crucial to protect one's system ASAP against what could become a boon for blackmailers.
The problem is that if BIOS doesn't disable the function, a "well"-(i.e. viciously)-positioned malware (early in the boot process) could lock the hard drive on first reboot even before any protective software can kick in.

Security hole?

[Gzip Christ]

How is this any worse than if a virus were to erase the hard drive?

Re:Security hole?

[johkir]

Here's a possible profitable situation. I get into your offices one day, perhaps for an interview. Through some social engineering, I get access to a PC to 'check my email.' I also load this virus, which, after spreading itself around a bit, goes through it's time delay, and then locks the HD, on as many disks as it can. The cheapest solution is to install new ones. I, of course, know the password, and I just wait at the dumpster for all your personnel/financial info and maybe some proprietary software to land my way. Profit!

Yes, you could wipe the drive with a nice big magnet, but where is that? Oh well.

Re:Security hole?

[fm6]

It's not, of course. Just as putting epoxy in a keyhole is no worse than burning down the whole building. But both are malicious acts you want to try to prevent.

Re:Security hole?

[Gzip Christ]

You could do the exact same thing by overwriting the original files with encrypted versions that only you have the decryption key for. In fact, that would let you put arbitrarily strong encryption on the data rather than relying on the relatively weak protection of a hard drive password. I fail to see how hard drive passwords allow you to do anything worse that what you could otherwise do (e.g., via deletion or encryption).

Re:Security hole?

[Wesley Felter]

That takes time, especially on large drives. Setting the password takes virtually no time.

Re:Security hole?

[johkir]

Good point. But a virus could work in a few clock cycles, and may not be detected until it's too late. And encryption is worse, in my view, since the data is not lost entirely, just lost to you. And someone else can profit from it.

Re:Security hole?

[parabyte]

It is worse because you can throw away the drive. You can not even format it without knowing the password when maximum security mode is used. And even replacing the controller does not help because the pw is also stored on the platters.

Re:Security hole?

[nharmon]

All hard drives, working or not, are stored for 2 years. After that they are smashed to tiny bits, forwarded to a member of senior management for verification, and then disposed of. I guess I wouldn't be surprised if most companies did not do this.

Re:Security hole?

[LordKronos]

A wipe may take some time, but for most users, an unconditional format is just as effective and is almost instant.

Re:Security hole?

[berzerke]

How is this any worse than if a virus were to erase the hard drive?

In an erase, you still have a functioning piece of hardware. You could partition, reformat, and reinstall. With a locked hard drive, you can't do any of that as I understand the problem. From the article "...The disk in this state allows no access to its data and accepts only a limited number of commands..."

Re:Security hole?

[Anonymous Coward]

Through some social engineering, I get access to a PC to 'check my email.' I also load this virus, which, after spreading itself around a bit, goes through it's time delay, and then locks the HD

That scenario casually mentions social engineering, without explicitly stating just how extreme the social engineering was: you say you want to check your mail, and someone replies by telling a stranger the password for root!

Re:Security hole?

[Anonymous Coward]

It can go either way. It all depends on whether the most recent data is most important, or whether you have adequate backups and can just restore those to the erased drive.

Re:Security hole?

[MegaFur]

ah-ah--an "unconditional" format will be the long, slow kind. A quick format, if the option is available will be the fast kind.

But why do either of those things when you can just write zeroes to the partition table?

Re:Security hole?

[Anonymous Coward]

Carl Sagan, not Sagen.

Re:Security hole?

[eric76]

The obvious solution would be a hacked version of the drive's firmware that ignores the password.

On the other hand, while I have updated the firmware on a number of devices, I've never done so on a disk drive that I can remember.

It would be a good idea if the manufacturers made such firmware available that one could install before there was a problem.

Re:Security hole?

[1u3hr]

ah-ah--an "unconditional" format will be the long, slow kind. A quick format, if the option is available will be the fast kind. But why do either of those things when you can just write zeroes to the partition table?

Because it's pretty easy to recreate the partition table. Eg, Testdisk saved my data after a Windows crash destroyed the parttion table.

Re:Security hole?

[MegaFur]

Hey, that's pretty cool. Thanks. :-)

Re:Disk-Jacking to put hard drives At Your Disserv

[FidelCatsro]

OK im not Device programmer , but is it technicaly possible to create a virus that on certain brands of BIOSs using the hardware interface(i know MSI boards support software overclocking and many Graphics cards) could overclock the computer in some way and cause perminant dammage to the system as i am fairly certain you could and if so why is this not a more major worry as this could cause real damage

Re:Watch the article's date

[kfg]

Duke Nukem Forever running on Debian Sarge HURD?

KFG

Or even worse

[dilvish_the_damned]

What if someone encrypts all your data one night? You show up for work one morning only to find the latest worm has encrypted all your data and it forces you to recite the lyrics to ELOs Another Heart Breaks ("one, two, three," etc..) before you can get at your data again. Look, if it has enough access to reset the password on your ATA drive, you probably have bigger issues to worry about, like the gaping hole in your OS that allows user code direct access to your hardware.

Re:Or even worse

[Deliveranc3]

Bugger singing,
It's like a comercial, please give generously.

Re:Or even worse

[Seraphim1982]

It's going to take a lot of time to encrypt data. People might realize that something is up the first time they try to access a file that has been encrypted, or when booting thier computer suddenly takes hours.

directly from the site

[TubeSteak]

In Maximum security mode, you cannot unlock the disk! The only way to get the disk back to a usable state is to issue the SECURITY ERASE PREPARE command, immediately followed by SECURITY ERASE UNIT.

The SECURITY ERASE UNIT command requires the Master password and will completely erase all data on the disk. The operation is rather slow, expect half an hour or more for big disks. ...

Well doesn't that suck

Re:directly from the site

[Yartrebo]

can't you crack open the drive and read the platters with whatever special device recovery experts have?

If the virus can set the password, I doubt that the actual contents are encrypted (that would require a few hours to do retroactively).

Re:directly from the site

[Anonymous Coward]

no you cant. If you open the drive outside of a clean room you will destroy it.

So if your point is that if you build your own class 100 clean room and buy the password recovery tools from Nortek, then yes, you could do it yourself.

I think at that point though, most would consider you a professional recovery expert.

Re:directly from the site

[mp3phish]

You would probably be better off replacing the circuit board on the drive with the same board from another drive of the same model. Would get rid of the passwords and would not require nearly as much specialty work as it would to remove the platters and read it with special machineary.

Re:directly from the site

[Anonymous Coward]

Actually, the article states that the password is distributed across the platters, and a checksum is in the flash memory on the controller board. Therefore stripping out the controller board & replacing it is not going to make the drive work.

In fact the recovery company mentioned in the article reportedly didn't have to open the drive to recover the password... Probably there's a flaw in the logic that controls checking the password. I suspect the password is stored unencrypted on the disk and there's a way to issue the "retreive password for checking" command with a special device connected to an IO port on the controller board.

Re:directly from the site

[Anonymous Coward]

no you cant. If you open the drive outside of a clean room you will destroy it.

How about all of those jackasses who tore their drives apart, cut a hole in the sheetmetal and then glued in a peice of lucite? They still do it today, and they don't seem to have reliability problems if they do it correctly, and shit they introduce all kinds of nasty shit into their drives.

I don't think drives are quite a fragile as you seem to think. All the dust and crap gets flung to the outside, where they actually have airfilters that trap it.

Re:directly from the site

[techfury90]

And I doubt the data on the platters is encrypted. Password maybe, but not the data most likely.

Re:directly from the site

[pegr]

Variation of the swap logic boards trick...

Swap with one of your own design. Since the password is on the disk, the orginal logic board has to get it, right? That means the logic board can talk to the platters... You just need a logic board that retrieves the password for you. Then swap back and do whatever you want.

I bet that's how the data recovery outfits do it. They even stated in TFA that known models are no problem, unknown models may take awhile. Yup, designing a logic board to talk to someone else's drive might take a bit of time.

Re:directly from the site

[Cramer]

Modified firmware... if you have a logic board capable of driving the head logic, you can read, change, and/or erase the stored password(s). I've not seen an IDE drive that doesn't have a diag "port" on it. (it's not an actual connector, just a bunch of contact pads.)

Haha!

[zerojoker]

Is this supposed to be funny or did the Slashdot staff really fall for this April's 1st joke??? If it's supposed to be funny, I can assure you, it's not. Not after the last day... In the second case it only seems to prove what we always thought :-)

A hint....

[imsabbel]

This story was yesterday published on heise online...

Re:A hint....

[jimicus]

blackbird root # hdparm -I /dev/hde

/dev/hde:

ATA device, with non-removable media
Model Number: ST340016A

[ --- cut --- ]

Security:
Master password revision code = 65534
supported
not enabled
not locked
not frozen
not expired: security count
not supported: enhanced erase

http://www.google.co.uk/search?q=ATA+master+passwo rd&start=0&start=0&ie=utf-8&oe=utf-8&client=firefo x&rls=org.mozilla:en-US:official

Looks pretty true to me.

Re:A hint....

[Anonymous Coward]

My hd on my thinkpad is frozen.

Must be an april fool ;-)

April Fools

[eatjello]

If this was meant to be an April Fool's joke, they could have at least made up a _new_ technology. As it is, ATA passwords are as old as ATA hard drives (which is to say, ancient). Thus, it is just another /. useless article day.

Re:April Fools

[LuckyStarr]

1. rtfa
2. no april fools joke. employees of the magazine demented it in their own forum.

Re:April Fools

[Vlad_the_Inhaler]

I originally thought that this was connected to April 1, but a couple of points made me reconsider:

- I am pretty sure that the April 1 article was in the previous edition of C't ('Blue Movies' from the power sockets, P 178), that was the edition that covered 1. April.
- 'hdparm -I' on one of my discs showed exactly the entries they were talking about.

Re:April Fools

[StarsAreAlsoFire]

- 'hdparm -I' on one of my discs showed exactly the entries they were talking about.

Proof positive that it isn't an April fools joke... if it were, the command would have initiated a low level format of your HD, causing hearty chuckles all around. ;)

cyberterrorism

[Anonymous Coward]

Imagine a worm/virus that spreads like mad and then locks hundreds of thousands or harddisks. That would be remarkably less than cool.

Remember,

[Anonymous Coward]

in Soviet Russia, your hard drives pwns you!

Re:THE pope is DEAD! For real this time

[Anonymous Coward]

Please use the correct format:

I just heard some sad news on CNN. Pope John Paul II was found dead in his Vatican apartment today. There weren't any more details. Even if you didn't care much for his work, there's no denying his contribution to archaic beliefs. Truly a Catholic icon.

Where is the firmware password stored?

[OneDeeTenTee]

If it's in a known and common chip on the control board couldn't someone just replace the chip?

I regularly work with surface mount ICs and there are solutions to remove and replace virtually any device.

Re:Where is the firmware password stored?

[jimicus]

RTFA. The firmware for a typical hard drive, along with the password, doesn't live exclusively on the controller. Some (all?) of it is written to the disk itself.

Re:Disk-Jacking to put hard drives At Your Disserv

[Anonymous Coward]

Because compared to data, hardware is cheap, genius.

If you're a company, what concerns you more--having to buy a new CPU (~$250US, tops) or no longer being able to access your customer database, or internal accounting information, or whatever ($????)

c't?

[Attackman]

Is that an adult magazine that happens to be anti-UN?
"In the June issue of c't: girls, girls girls, and why we hate Kofi Annan!"

Re:c't?

[Anonymous Coward]

Is that an adult magazine that happens to be anti-UN?

Actually, it happens to be a computer magazine that is not much into politics.

"In the June issue of c't: girls, girls girls, and why we hate Kofi Annan!"

I dont know where you got that quote, but I suppose you just invented it...

Disk-Jacking to put hard drives At Your Disservice

[D4C5CE]

could overclock the computer in some way and cause perminant damage to the system (...) why is this not a more major worry as this could cause real damage

Not only because any attack like this would have to work with rather primitive code on a wide(spread) variety of hardware (like an ATA hard drive - very few systems don't have one), but also because the goal of an extortionist is to have hostages (cf. the above quotes on the 1989 attack). The "horror scenario" is something like this: A malware written to interfere at an early stage, e.g. as a replacement Master Boot Record, to lock the drive with a random password and display a message (which includes a scrambled representation of the password used) telling the user that the system won't work on reboot, and where to send money for "his or her" particular unlock code and/or a "personal" unlock disk. For those who are "lucky" enough to follow these "orders", there is a chance of getting the data back (i.e. "buying back" one's own system against "payola") until the blackmailer gets busted or bored... For anyone else just hitting reset, there will be no reboot, and specialist recovery to remove a 32-bit lock as the only chance (except for the vague hope that the malware or decrypter will very soon be "open-sourced" by the authorities on catching that crook).

Microsoft's Xbox does this

[Anonymous Coward]

The xbox uses the ata password feature to prevent unauthorized activity on a disk. The password can be twarted by hot swapping the drive into another machine after the xbox has unlocked the drive. After that point though a few other things stand in your way

Re:Ok, so what?

[bragolach]

Did they ever?

OS level fix

[argoff]

If the BIOS doesn't do it, the OS, upon boot could simply instruct the drive not to accept password change commands. Which wouldn't stop a sufficient virus from sabatoging the next boot and setting it, but still it increases security.

Re:OS level fix

[argoff]

If the BIOS doesn't do it, the OS, upon boot could simply instruct the drive not to accept password change commands. Which wouldn't stop a sufficient virus from sabatoging the next boot and setting it, but still it increases security.

Oops, the article said that. That's what I get for only reading half TFA. But, I did think of another hack - why not just buy a hard drive of the same make and model and switch the circut boards.

Re:OS level fix

[enosys]

The article said the password was stored on the disk, not in flash memory on the board. Someone here claimed that it's stored in both. Remember, this is supposed to provide some security for your data if the disk is stolen. If swapping circuit boards "fixed" it that would be terrible security.

Re:Disk-Jacking to put hard drives At Your Disserv

[Anonymous Coward]

wow arn't you clever , though you forgot that data is regularly backed up if you have half a brain and knocking out a major system in your network could cripple it and cost a great deal of money

ive seen this before

[ufpdom]

Its called the HDD passwd in a xbox.. Its how all xbox's are password protected against their own motherboard.. to prevent duplication and crap.. too bad its been broken more times than this entire post :) Viva la xbox revolucion!

COMRESET on S-ATA?

[91.605.59.17]

Can you tell me if there's a possibility of tricking the controller into believing that there has been a reset? Because someone at the boards from Heise mentions this for S-ATA disks:

A SRST initiated over the device control register would be interpreted as a COMRESET. Since the disk isn't able to distinguish a software-reset from a hardware-reset, it would open the freeze lock - outside the BIOS obviously, what would lead the ATA-security open for changing the password.

More funny would be to ...

[kahunak]

Erasing it or even recording some random porn images before password protecting, almost every user would just discard it, but there would be some of them who pay lot of money to discover one hundred copies of goatse .... really funny!

Re:More funny would be to ...

[awacs]

"Erasing it or even recording some random porn images before password protecting, almost every user would just discard it, but there would be some of them who pay lot of money to discover one hundred copies of goatse .... really funny!" ... or, to be even more nasty, d/l some kiddie porn. *That* would not be funny at all.

Funny

[soniCron88]

"A DOS from a diskette boots suspiciously slowly"

When does a diskette ever boot not "suspiciously slowly"?

Re:Funny

[tonsofpcs]

DOS boots from a diskette in about 15 seconds [max] on my 80386, and that includes the BIOS POST, so really its about 1 or 2 seconds.

You can restore an erased drive

[Anonymous Coward]

You can restore an erased drive from backups.

A locked drive can't be restored when you don't know the password.

It's the difference between deleting the data, and deleting the drive. Drives are cheap now, but not to the point where throwing away drives can be ignored.

The most successful ones don't kill the host

[Anonymous Coward]

What's a more successful species? Smallpox or bubonic plague, or the bacteria that live in your gut that help digest your food and make you fart?

Re:The most successful ones don't kill the host

[Grishnakh]

What's a more successful species? Smallpox or bubonic plague, or the bacteria that live in your gut that help digest your food and make you fart?

This comparison doesn't make any sense. Smallpox and plague are viruses, which are parasites. A parasite is a lifeform that lives by feeding off a host, and not helping the host in any way (usually harming it).

The bacteria in your gut aren't parasites; they're symbiotes. (Yes, just like the creatures in Stargate.) We rely on them to survive, just as they rely on us. Without those bacteria, we wouldn't survive.

Re:The most successful ones don't kill the host

[Anonymous Coward]

Smallpox is a virus, Bubonic Plague is bacteria.

We're still not clear whether viruses can be considered "alive", let alone a parasite, regardless of the fact that our genes are full of virus DNA that have probably made us a better (or at least more survivable) species over the years. At best I'd call a virus an agent for disease.

I do agree on your take of our digestive bacteria. They give us gas, though. *pffft* :D

Re:The most successful ones don't kill the host

[AJWM]

Smallpox and plague are viruses

Nope. Smallpox is, but plague is a bacillus, Yersinia pestis (formerly Pasteurella pestis).

Re:The most successful ones don't kill the host

[Grishnakh]

Whoops, you're correct about this.

Regardless, the bacteria that cause plague are parasitic in nature, whereas the gut bacteria are symbiotic.

Still readable after locking

[KasKyt]

From my understanding as long as the Locked HD is on the MoBo where it was locked it still works fine, it only when it attached to another MoBo its unreadble (My experience if from the Xbox)

Re:Still readable after locking

[Anonymous Coward]

No, you are wrong.

Another hint...

[Anonymous Coward]

It appears in the printed edition 8/05. The april fools day joke appears in 7/05. And the editor wrote explicitly in the forum of heise online, it was *no* joke. So nice hint, but a little bit misleading

Mod Parent up...

[Anonymous Coward]

This is appsolutely correct. It should always be possible to read the data from the connection lines...at least until trusted computing hardware starts to hit the market.

Disk-Jacking to put hard drives At Your Disservice

[D4C5CE]

you forgot that data is regularly backed up if you have half a brain and knocking out a major system in your network could cripple it and cost a great deal of money

If you manage to backup every system in and out of your offices every few hours... congratulations, please let us know your storage solution...

And then if you can tell us how you put these backups back onto thousands of locked hard drives that you don't even have write access to anymore (otherwise all you'd need are spare hard drives for every machine), you'd only need the staff to service all of these computers before a few days of lost business have bankrupted your company.

Or wait a minute, sounds like a plan:

1. Ask management for a 1:1 ratio of workstations per technician (i.e. each user gets his or her own personal tech wizard&admin - hey, once implemented that might also instantly solve most geeks' dating or mating problems ;-))
2. Wait for the "super worm" to bite your company badly
3. In management, the survivors of 2. (if any) sign hiring orders for your request at 1.
4. ...(personal) profit?!

ATA? I'm glad I use SCSI...

[Anonymous Coward]

... or is there something similar for SCSI hard drives?

CT is the best computer magazine

[Anonymous Coward]

I'm not affiliated with them, but I just wanted to say that CT is in my opinion the best computer magazine today.

Dell BIOS HD Flaws

[__aaijsn7246]

In general, these features don't seem coded to well. Here's a post I made to Bugtraq back in December of 2003.

The Dell BIOS allows users to set several different passwords to protect
their machines from unauthorised access. There is 1) a Setup Password,
which is required to enter the BIOS setup, as well as 2) a Hard Drive
Password, as per the ATA Security Feature Set Specification.

Unfortunately, once a Hard Drive Password is set which contains one or
more of the following characters,

, . ; : ' [ ] { }

it can not be later entered to access the machine. It appears as though
a bug in the BIOS code prevents those characters from being taken as
input when the user is asked for the password - however, the BIOS
incorrectly allows users to set passwords containing those characters.

This is not an incredibly serious problem as such, since a user can go
back into the BIOS setup and change the password there, provided the
BIOS Setup is not protected with an unknown password. Or, as a last
resort, Dell can be phoned to provide a master backdoor password, as
long as the user can prove herself the legal owner of the computer. Of
course, the prerequisite of physical access to the machine highly
mitigates this vulnerability.

It is however an interesting bug from the point of view of Dell's
practices. I have contacted them over two weeks ago, but their
'technical support' is unable to understand or resolve the problem. Two
of their representatives told me to reinstall Windows XP Chipset
drivers, even when I asked to be forwarded to people higher in the
technical support chain. Perhaps this post will encourage Dell to pay
more attention in the future.

Affected Systems: Dell Inspiron 2650 System BIOS, A11
(A11 is the current BIOS as of writing, and was released in late
September of this year)
Other BIOS/Dell models are perhaps vulnerable but have not been tested.

Re:Dell BIOS HD Flaws

[danielsfca2]

Perhaps this post will encourage Dell to pay more attention in the future.

keen, Dell appreciates your constructive criticism. Your Slashdot post has inspired a full-scale probe, from Bombay to New Delhi, into our technical support practices, and we plan to roll out new training methods to avoid situations like yours from happening again.

However, are you sure you have installed the latest Internet Explorer Hotfix? The version number is 6.1.2800.3.43.xpsp2.93.9.

Sincerely,
Michael Dell
--
Michael Dell
CEO and Founder (and avid Slashdot reader!)
Dell Computers Inc.

Re:Dell BIOS HD Flaws

[__aaijsn7246]

Well, after posting that to Bugtraq, a senior Dell technician contacted me within a few hours.. and they finally did patch it as well.

Re:Dell BIOS HD Flaws

[Anonymous Coward]

Looks to me like A13 (release date 04/08/2004) is the latest BIOS for the 2650, so either you simply make a few typos or... well you know... are wrong.
Surely there are other non-alphanumeric characters that will serve you just as well in your pursuit of an unbreakable password to protect your oh so important data that nobody in the same hemisphere gives a damn about... surely there must be others.

Re:Dell BIOS HD Flaws

[__aaijsn7246]

Reread the first line of my post.
Also read the changelog of the bios file.
Thanks lamer :)

Re:Disk-Jacking to put hard drives At Your Disserv

[Anonymous Coward]

If you manage to backup every system in and out of your offices every few hours... congratulations, please let us know your storage solution...

Two words: Thin Clients

Disk-Jacking to put hard drives At Your Disservice

[D4C5CE]

If you manage to backup every system in and out of your offices every few hours... congratulations, please let us know your storage solution...

Two words: Thin Clients

Three more words: Still Very Rare

Simple FPGA interface?

[xtal]

I've been doing more work with FPGA's recently:

If this is the case, there are some IDE controller projects available on opencores. It shouldn't be a serious problem for someone to build a board that would allow you to mount the drive so you can copy data off of it - there are also open, well tested, PCI bridge modules freely available now.

http://www.opencores.org/browse.cgi/by_category

If it is indeed the serious concern that people indicate, and it can be broken by the means you suggest - I challenge someone with a few dollars to donate it to opencores with the objective of getting this done.

Indeed, the "sticking it to the man" factor is high enough that I am intrigued enough to have a more in depth look. :)

big deal

[idlake]

Viruses and spyware can simply erase your disk, in addition to changing the password. The solution? The same solution as for hardware failures, cats walking across the keyboard, or babies drooling on the disk: restore from a recent backup. If you don't have a recent backup, a virus that sets the ATA HDD password is the least of your problems.

Re:big deal

[jareds]

RTFA. If a password is set, the drive cannot even be erased without it. Setting a random password is thus different from erasing the drive even with a backup because, for all practical purposes, it physically destroys the drive.

Re:big deal

[idlake]

RTFA. If a password is set, the drive cannot even be erased without it.

You RTFA. If a password is set, you can still erase the drive with the master password.

Furthermore, even if you lose the drive (and viruses can probably destroy drives by other means), that's just a cheap piece of hardware. The data is what counts.

Re:big deal

[evilviper]

A cat walking across my keyboard doesn't make my nice new $200+ hard drive useless, and require sending it back to the manufacturer (data in-tact, which they can read).

Recent destructive worm

[Bunyip Redgum]

but when was the last highly destructive virus you saw ?
What about the witty worm?
It spread in less than an hour and the proceded to destroy data on the hosts hard disks.

Re:THE pope is DEAD! For real this time

[Anonymous Coward]

I've seen serious car accidents funnier than your statement.

easy prevention: only set administrator password?

[F�an�ro]

the way i understood it, there are two passwords: user password and administrator password.

Access to the harddrive will only be prevented if the user password is set, but the user password can only be set when the administrator password is known.

So if I only set the administrator password, then the drive can be accessed as usual, but the user password cannot be set by some software.

Correct? or did I misunderstand that?

Re:easy prevention: only set administrator passwor

[argent]

There is no "administrator password". The "master password" is like a janitor's master key. It's a failsafe to let you unlock the drive if the user password was set.

The incredibly stupid thing is there doesn't seem to be a way to say "disable the password mechanism completely". IMHO, this should be the default state, and it should require physical access to the drive (say, with a jumper) as well as (of course, any passwords) to switch it from one state to another. A laptop could connect that jumper to an external "security" button that you hold down while the BIOS does its thing.

works properly on IBM's

[Anonymous Coward]

I tried hdparm -I on my IBM ThinkPad T41p and IBM NetVista.
Both systems have two harddisks, and it is reporting for both the primary and secondary harddisks that the security feature is 'frozen'.

Also my dual CPU Opteron system with Phoenix bios reports both the primary and secondary harddisks as having the security feature 'frozen'.

So all my systems appear to be fine

I have a crystal ball

[KarmaBlackballed]

Hard drive password locking today, full system locking tomorrow. Once DRM supporting BIOSes ("trusted computing") hit a critical mass, we will surely see viruses that use that DRM itself to disable the entire hardware, not just one drive or two.

In a way, these "trusted computing" solutions will be more risky than the open systems we have today. A virus on such a system could disallow your hardware to boot from any device and run any software, so even removing an affected drive would not be enough. Users would have to kiss the motherboard goodbye or seek profe$$ional help.

Don't expect to hear anything about this from M$ or any other proponents of trusted computing.

Yahoo.

How does the BIOS prevent locking?

[Nom du Keyboard]

And just how does the BIOS prevent locking your harddrive. Yes it might not have the API call if you use the BIOS, but can't you call the drive outside of the BIOS code?

Re:How does the BIOS prevent locking?

[Lev_Arris]

The BIOS prevents locking your HDD by telling the HDD to freeze the security state. Once the HDD has received that command, it will not accept any other security commands (including the ones to lock it) until it gets reset.

OT: Word-wrapping of your post?

[192.168.0.1]

Why is it that the word-wrapping of your post seems a bit weird? I am seeing line breaks in the middle of sentences.

Who would do this.

[hubt]

The RIAA

Re:ive seen this before - NOT

[Anonymous Coward]

I dont think that the xbox HDD password has been 'broken'. The last time I checked the scheme used was to boot the drive with the xbox and then hot swap the cable to your computer. The xbox provides the password to unlock the drive. Can anyone post the password? I dont think so.

Another idea....

[Otis2222222]

Is the lockout stored on the HDD controller board or is it actually written to the disk? If it's stored in the controller board on the disk, there might be an alternative.

If that was the case, you could, in theory, buy a brand new, identical hard drive to the one that was "HAXX0R3D" and swap out the controller boards.

I did this a long time ago with an IBM 10 Gig drive when the controller board died on it. It's kind of a delicate procedure but if you are careful you should be able to unscrew the board and replace it with a new one.

I didn't see anything in the article that addressed this so I'm not sure if it would work, but it's worth a try!

Why would it?

[phorm]

As things which require encryption become more commonplace, hardware aimed at the optomizing the encryption process is becoming more common and well. remember, some software encryption may be hard on your standard CPU because the PC by nature is - while optomized in certain areas - aimed at being more versatile than specific.

There are boards that have chipsets aiming at supporting hardware-based encryption though (I know VIA has a few). Just like a sub-1Ghz GPU will kick your 3.2Mhz CPU's ass for 3d rendering, a lower-speed but optomized EPU (Encryption Processing Unit?) could manage to do the process without overhead on the rest of your system, and without a largely noticable bottleneck.

Storing data without encryption still involves very specific hardware that does processing on the drive itself, data doesn't just magically jump onto the platters without the driving knowing how to put it there.

Throwing an encryption chip on motherboards (or perhaps even better on the drives themselves) would allow for all this to happen without speed issues... it's all about optimization.

And as for the security issues with the motherboards... why not restrict setting sucks things to doing so within the BIOS menus themselves... if you're playing with drive encryption options you should know what you're doing anyhow, though having an option to *lock* the encryption/passwords is definately a smart idea (perhaps even in the form of a hardware setting via jumper/toggles).

Re:professional? - NOT

[Anonymous Coward]

Its not that simple.
The firmware on the HDD's board is only a first stage bootloader. It just gets more boot code from the drive and jumps into it. The password isnt stored on the drive in cleartext - its encrypted. You must supply a proper passowrd that yeilds the same result. Modern disk drives resemble DOS, 20-30 tables and programs are accesed before the drive will 'TALK' to you.

Software to remove the passwords: PC3000

[Anonymous Coward]

There is a HW/SW combo, that claims to be able to reset the passwords: http://www.pc3000pci.com/pc3000.htm

HTH
-t

Re:Disk-Jacking to put hard drives At Your Disserv

[Lars T.]

though you forgot that data is regularly backed up if you have half a brain and knocking out a major system in your network could cripple it and cost a great deal of money

How much good does a back-up do, when you can't access your hard-drive. Or hard-drives. Or your back-up servers hard-drives. You'll have to buy a new hard-drive to back-down your stuff.

Out of context.

[Anonymous Coward]

If you lock out the drive you aren't going to spread yourself very far.

Oh I don't know.. Once I was done with it, I'd say the platters would 'spread' pretty far after a 5 story fall.

Re:Or even worse [winhat]

[winhat4]

Data is information, especially that stored in a single row along the length of each chromosome. A chromosome is a mixture of chalk and clay used for filtering urine from the heart. I am certainly not a computer program that translates high level language code into machine language code.

32 bit password

[Twylite]

Haven't seen any conspiracy theorists so far pick up on the "32 bit password" bit. Assuming the drive doesn't delay or stop responding to access attempts after a number of tries, this could be cracked in a matter of hours.