Slashdot Mirror
How To Head Off ATA HDD Password Abuse
An anonymous reader submits "German c't magazine has a story about abusing the security features of ATA hard disks. The bottom line is that almost all ATA hard disks in desktop PCs can be password-protected. However, on most desktop PCs, the BIOS does not support locking this option -- so viruses or malware could set a random password, making any data unreadable unless recovered by professionals."
Why on earth would you want to password "protect" a hard drive? How would that be any better than properly encrypting your files?
Here is a website that shows how to unlock it, and you don't even have to be a professional!
http://www.rockbox.org/lock.html
but when was the last highly destructive virus you saw ?
virus writers/skripterz have long since learnt, if you kill the host it is of no use to you, you achieve nothing
99% of viruses today are trojans because you can use your fancy stealth infection/propogation routines AND make a profit if you keep the host alive, locking a HD would be pointless and contrary to opinion most Virus writers are not stupid, misguided perhaps but not stupid
The problem is that if BIOS doesn't disable the function, a "well"-(i.e. viciously)-positioned malware (early in the boot process) could lock the hard drive on first reboot even before any protective software can kick in.
How is this any worse than if a virus were to erase the hard drive?
What if someone encrypts all your data one night? You show up for work one morning only to find the latest worm has encrypted all your data and it forces you to recite the lyrics to ELOs Another Heart Breaks ("one, two, three," etc..) before you can get at your data again. Look, if it has enough access to reset the password on your ATA drive, you probably have bigger issues to worry about, like the gaping hole in your OS that allows user code direct access to your hardware.
I think you underestimate just how much I just dont care.
to the effect that we will program a demonstration of the damaging action and make it available to Apple
This seems to imply that it has not yet been done. Any hardware changes that I have done (Open Firmware changes, DVD region set) have needed an admin password.
However, in the article it basically says that the machine has to compromised PRIOR to startup (when the security extension loads). If someone already has access to your machine with an admin password, I really don't see the point in locking the drive. There are easier ways to pull a prank or cause damage.
"A DOS from a diskette boots suspiciously slowly"
When does a diskette ever boot not "suspiciously slowly"?
Digital Sailor
The article said the password was stored on the disk, not in flash memory on the board. Someone here claimed that it's stored in both. Remember, this is supposed to provide some security for your data if the disk is stolen. If swapping circuit boards "fixed" it that would be terrible security.
Looks pretty true to me.
Actually, the article states that the password is distributed across the platters, and a checksum is in the flash memory on the controller board. Therefore stripping out the controller board & replacing it is not going to make the drive work.
In fact the recovery company mentioned in the article reportedly didn't have to open the drive to recover the password... Probably there's a flaw in the logic that controls checking the password. I suspect the password is stored unencrypted on the disk and there's a way to issue the "retreive password for checking" command with a special device connected to an IO port on the controller board.
In general, these features don't seem coded to well. Here's a post I made to Bugtraq back in December of 2003.
The Dell BIOS allows users to set several different passwords to protect
their machines from unauthorised access. There is 1) a Setup Password,
which is required to enter the BIOS setup, as well as 2) a Hard Drive
Password, as per the ATA Security Feature Set Specification.
Unfortunately, once a Hard Drive Password is set which contains one or
more of the following characters,
, . ; : ' [ ] { }
it can not be later entered to access the machine. It appears as though
a bug in the BIOS code prevents those characters from being taken as
input when the user is asked for the password - however, the BIOS
incorrectly allows users to set passwords containing those characters.
This is not an incredibly serious problem as such, since a user can go
back into the BIOS setup and change the password there, provided the
BIOS Setup is not protected with an unknown password. Or, as a last
resort, Dell can be phoned to provide a master backdoor password, as
long as the user can prove herself the legal owner of the computer. Of
course, the prerequisite of physical access to the machine highly
mitigates this vulnerability.
It is however an interesting bug from the point of view of Dell's
practices. I have contacted them over two weeks ago, but their
'technical support' is unable to understand or resolve the problem. Two
of their representatives told me to reinstall Windows XP Chipset
drivers, even when I asked to be forwarded to people higher in the
technical support chain. Perhaps this post will encourage Dell to pay
more attention in the future.
Affected Systems: Dell Inspiron 2650 System BIOS, A11
(A11 is the current BIOS as of writing, and was released in late
September of this year)
Other BIOS/Dell models are perhaps vulnerable but have not been tested.
I've been doing more work with FPGA's recently:
:)
If this is the case, there are some IDE controller projects available on opencores. It shouldn't be a serious problem for someone to build a board that would allow you to mount the drive so you can copy data off of it - there are also open, well tested, PCI bridge modules freely available now.
http://www.opencores.org/browse.cgi/by_category
If it is indeed the serious concern that people indicate, and it can be broken by the means you suggest - I challenge someone with a few dollars to donate it to opencores with the objective of getting this done.
Indeed, the "sticking it to the man" factor is high enough that I am intrigued enough to have a more in depth look.
..don't panic
Viruses and spyware can simply erase your disk, in addition to changing the password. The solution? The same solution as for hardware failures, cats walking across the keyboard, or babies drooling on the disk: restore from a recent backup. If you don't have a recent backup, a virus that sets the ATA HDD password is the least of your problems.
but when was the last highly destructive virus you saw ?
What about the witty worm?
It spread in less than an hour and the proceded to destroy data on the hosts hard disks.
the way i understood it, there are two passwords: user password and administrator password.
Access to the harddrive will only be prevented if the user password is set, but the user password can only be set when the administrator password is known.
So if I only set the administrator password, then the drive can be accessed as usual, but the user password cannot be set by some software.
Correct? or did I misunderstand that?
There is no "administrator password". The "master password" is like a janitor's master key. It's a failsafe to let you unlock the drive if the user password was set.
The incredibly stupid thing is there doesn't seem to be a way to say "disable the password mechanism completely". IMHO, this should be the default state, and it should require physical access to the drive (say, with a jumper) as well as (of course, any passwords) to switch it from one state to another. A laptop could connect that jumper to an external "security" button that you hold down while the BIOS does its thing.
Variation of the swap logic boards trick...
Swap with one of your own design. Since the password is on the disk, the orginal logic board has to get it, right? That means the logic board can talk to the platters... You just need a logic board that retrieves the password for you. Then swap back and do whatever you want.
I bet that's how the data recovery outfits do it. They even stated in TFA that known models are no problem, unknown models may take awhile. Yup, designing a logic board to talk to someone else's drive might take a bit of time.