Another great write-up, thanks for posting.
Analyzing and breaking an externally encrypted HDD
11–16 of 16 posts
Re: Analyzing and breaking an externally encrypted HDD
#12LOL. This is about as secure as the spin dials on luggage. The hardware contains the pin # in memory that (presumably) decrypts the key, just like any mechanical lock contains the combination (in its physical configuration) that unlocks it. And if the pin implementation is this hackneyed, I have a feeling that the so-called encryption is anything but.
Clearly, a company advertising encrypted drives could and should do better than this. Good on this researcher for calling out shoddy workmanship and posting about it. This is a warning to people with access to highly sensitive data. But for everyday stuff, you do need to keep the value of your data in perspective. It took a security researcher 40 hours to crack this thing. Should you store state secrets on this? No,…
> Clearly, a company advertising encrypted drives could and should do better than this. Good on this researcher for calling out shoddy workmanship and posting about it.
I'm not even convinced these companies can implement the core functions of their firmware properly. Why would anyone trust their proprietary cryptography solution? It's just insane.
Re: Analyzing and breaking an externally encrypted HDD
#13Earlier quoted context omitted.
Clearly, a company advertising encrypted drives could and should do better than this. Good on this researcher for calling out shoddy workmanship and posting about it. This is a warning to people with access to highly sensitive data. But for everyday stuff, you do need to keep the value of your data in perspective. It took a security researcher 40 hours to crack this thing. Should you store state secrets on this? No,…
What is even the point of encrypted drives over just using filesystem encryption managed by the OS? I'm guessing some minor portability benefit across OSs but is this really worth trusting the OEM over?
Performance
Re: Analyzing and breaking an externally encrypted HDD
#14Earlier quoted context omitted.
What is even the point of encrypted drives over just using filesystem encryption managed by the OS? I'm guessing some minor portability benefit across OSs but is this really worth trusting the OEM over?
Performance
This is a USB hard drive though. Even a cheap laptop can encrypt data faster than you can transfer over USB.
Maybe I might understand if this was some kind of server SSD but even then im not sure it would make sense.
Re: Analyzing and breaking an externally encrypted HDD
#15Earlier quoted context omitted.
Clearly, a company advertising encrypted drives could and should do better than this. Good on this researcher for calling out shoddy workmanship and posting about it. This is a warning to people with access to highly sensitive data. But for everyday stuff, you do need to keep the value of your data in perspective. It took a security researcher 40 hours to crack this thing. Should you store state secrets on this? No,…
What is even the point of encrypted drives over just using filesystem encryption managed by the OS? I'm guessing some minor portability benefit across OSs but is this really worth trusting the OEM over?
There is no truly portable FS encryption managed by OS. I've not seen OS encryption which will allow mount the same drive e. g. in Windows and in FreeBSD. Or even to connect an encrypted drive to a Smart TV (which likely is Linux bused, but would not allow to install unsigned firmware).
Re: Analyzing and breaking an externally encrypted HDD
#16Earlier quoted context omitted.
Performance
This is a USB hard drive though. Even a cheap laptop can encrypt data faster than you can transfer over USB. Maybe I might understand if this was some kind of server SSD but even then im not sure it would make sense.
That is true today. It hasn't always been true.
In fact Microsoft's own BitLocker dropped reliance on hardware encryption to workaround this same problem. And now that the performance impact is minimal it makes sense to default to software.