Recently Discovered SSD Vulnerabilities Could Cripple Global Markets with Data Corruption if Exploited by Attackers

[Batu69]

Recently discovered multi-level cell (MLC) solid-state drive (SSD) vulnerabilities by researchers from Carnegie Mellon University, Seagate, and the Swiss Federal Institute of Technology in Zurich, reveal the first-ever security weakness of its kind against MLC SSDs that store much of the world’s data. Two different types of malicious attacks are reported to corrupt data, leaving much of the world’s data currently exposed while organizations search for answers.

If security experts and data protection experts didn’t have enough to worry about already, the latest discovery from Carnegie Mellon University has set off brand new alarms that could be far more crippling than the recent WannaCry virus or any ransomware attack. In this case, data is not infected or held hostage, but is lost entirely - not even the host SSD hardware can be salvaged after such an attack. This is not simply alarming to organizations that stand the most to lose like financial institutions, but we’re talking about real lives here if patient care is compromised as we saw earlier this month at hospitals across the UK.

In a recently published report by researchers from Carnegie Mellon University, Seagate, and the Swiss Federal Institute of Technology in Zurich, there are two types of malicious attacks that can corrupt data and shorten the lifespan of MLC SSDs – a write attack (“program interference”) and a read attack (“read disturb”). Both attacks inundate the SSD with a large number of operations over a short period of time, which can corrupt data, shorten lifespan, and render an SSD useless to store data in a reliable manner into the future. However, both attacks rely upon native read and write operations from the operating system to the solid-state drive, which is circumvented by Condusiv^® I/O reduction software on Windows systems (V-locity^®, SSDkeeper^®, Diskeeper^® 16).

The only reason this story has been covered lightly by the media and not sensationalized across headlines is because no one has died yet or lost a billion dollars. This is a new and very different kind of vulnerability. Protection from this kind of an attack is not something that can be addressed by traditional lines of defense like anti-virus software, firmware upgrades, or OS patches. Since it is cost prohibitive for organizations to “rip-and-replace” multi-cell SSDs with single-cell SSDs, they are forced to rely on data sets that have been “backed-up.” However, what good is restoring data to hardware that can no longer reliably store data?

By acting as the “gatekeeper” between the Windows OS and the underlying SSD device, Condusiv I/O reduction software solutions perform inline optimizations at the OS-level before data is physically written or read from the solid-state drive. As a result, Condusiv’s patented technology is the only known solution that can disrupt “program interference” write operation attacks as well as “read disturb” read operation attacks that would attempt to exploit SSD vulnerabilities and corrupt data. While most known for boosting performance of applications running on Windows systems while extending the longevity of SSDs, Condusiv solutions go a step further as the only line of defense against these malicious attacks.

Condusiv’s patented write optimization engine (IntelliWrite®) mitigates the first vulnerability, “program interference,” by disrupting the write pattern that would otherwise generate errors and corrupt data. IntelliWrite eliminates excessively small writes and subsequent reads by ensuring large, clean contiguous writes from Windows so write operations to solid-state devices are performed in the most efficient manner possible on Windows servers and PCs. An attack could only be successful in the rare instance of limited free space or zero free space on a volume that results in writes occurring natively, circumventing the benefit of IntelliWrite.

Condusiv’s second patented engine (IntelliMemory®) disrupts the second vulnerability, “read disturb,” by establishing a tier-0 caching strategy that leverages idle, available memory to serve hot reads. This renders the “read disturb” attack useless since the storage target for hot reads becomes memory instead of the SSD device. A “read disturb” attack could only be successful in the rare instance that a Windows system is memory constrained and has no idle, available memory to be leveraged for cache.

While organizations use Condusiv software on Windows systems to maintain peak performance and extend the longevity of their SSDs, they can trust Condusiv to protect against malicious attacks that would otherwise corrupt user data and bring great harm to their business and service to customers.

 

Article source

[stylemessiah]

Marketing bullshit by Conclusiv

 

Ignore and get on with life

 

As Trumps calls it "fake news"

[tao]

2 hours ago, stylemessiah said:

Marketing bullshit by Conclusiv

Ignore and get on with life

As Trumps calls it "fake news"

Nah, brother.

Forums Staff, by definition, do not pollute their own forum -- knowingly.

Easily said, "ignore," than to do.

One person's "fake news" is "good news" of another.  

(yet, whosoever has the stick has the water buffalo.)    

[straycat19]

1 hour ago, adi said:

Nah, brother.

Forums Staff, by definition, do not pollute their own forum -- knowingly.

Easily said, "ignore," than to do.

One person's "fake news" is "good news" of another.  

(yet, whosoever has the stick has the water buffalo.)    

 

Or as Chicken Little said, "The sky is falling, the sky is falling!"  Well it hasn't fallen yet and 99.99% of all the articles written about vulnerabilities with computers and operating systems only work in lab situations.  The so-called 'Perfect Storm' for computers is reported as 'The sky is falling.'  I don't know about anyone else but after so many years of this crap I really get tired of reading about it.  Forum posters report it because someone is going to post it because people who don't know any better are petrified that someone can do something to their computer.  If you really want to be secure then throw away the computer and get a paper tablet and pencil.  Then the only thing you have to worry about is someone stealing the paper or pencil or both, erasing your writing with the pencil, tearing your writing up, or breaking your pencil.  "The sky is falling!"

[Bausch]

Thanks for the article!

 

Without all the heads ups that many complain about, even more serious damage could have been done. Knowledge is power, and people should be prepared.

[steven36]

19 hours ago, straycat19 said:

 Well it hasn't fallen yet

This research  came out back in May  and some of the research was done by seagate themselves

https://www.techspot.com/news/69429-security-flaw-found-solid-state-drive-design.html

Quote

More details about this research are available in the paper entitled Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques, authored by six researchers from Carnegie Mellon University, Seagate, and the Swiss Federal Institute of Technology in Zurich.

 

Download PDF

https://people.inf.ethz.ch/omutlu/pub/flash-memory-programming-vulnerabilities_hpca17.pdf

You may not be concerned now but if a bunch of drives start failing you own or you are responsible for you will be eating crow..  i think it's funny because if the research is right old type Hard Drives are still better and they sure are cheaper i dont even invest in no SSD  yet.
 

Quote

 

The price of SSDs has continued to decline over time (24 cents per gb as of 2017),consumer-grade SSDs are (as of 2017) still roughly four times more expensive per unit of storage than consumer-grade HDDs

 

 

The drive I'm using  with windows 8.1 is old as dirt It came in a PC with xp new in 2010 and it still in excellent shape now that's real proof of  something not messing up . I used it on the 1st PC it was in  with Windows XP and Windows 7 the 2nd PC i put it in it had Linux , Windows 10 and now Windows 8.1 on it. 

 

Here is my Proof

 

 

19 hours ago, straycat19 said:

of all the articles written about vulnerabilities with computers and operating systems only work in lab situations.

Talk is cheap were is you're proof?  They proved it works in a  lab now you need proof that it want work in real time for me too believe you ..It's many experts word against yours and i see no proof just a user name ranting on a forum! See you when and if you can prove a  SSD last  longer in about 5 years then talk too me.. Newer is not always better they use too build stuff to last. In 5 years if this can be proved then they should be nice and cheap by then and i will buy one. I dont buy stuff just because it's the latest Technology. I have too have a good reason to buy.

 

. Always people want too deny that they payed 4 prices for a POS  ..Just like someone who bought a nice looking car that is a lemon  that runs faster than my car but there car stays in  the shop and my car just does what it needs too do and gets me were i need too go  ..  PC  Computers are some of the biggest waste of money they ever was . And Microsoft wonders why they can't  sell them when we already have 4 towers and 2 laptops .  everybody already has one or five or they use a smart phone instead.

[pc71520]

On 7/7/2017 at 1:11 PM, Batu69 said:

Condusiv’s patented write optimization engine (IntelliWrite®)

 

On 7/7/2017 at 1:11 PM, Batu69 said:

Condusiv’s second patented engine (IntelliMemory®)

 

On 7/7/2017 at 1:11 PM, Batu69 said:

While organizations use Condusiv software on Windows systems to maintain peak performance and extend the longevity of their SSDs,

they can trust Condusiv to protect against malicious attacks that would otherwise corrupt user data and bring great harm to their business

and service to customers.

Condusiv has been a pioneer.

[DKT27]

The company seems rather late in reporting this. Though, not entirely false.

 

What they are not talking about is one of the main things, the fix for it. From the article posted by steven above:

 

Quote

Resolving the problem is a more straightforward affair. Manufacturers would simply have to run data through the flash controller instead, just like with SLC. However, this increases latency by about 5 percent, which somewhat defeats one of the main advantages MLC has over SLC drives.

 

I'm sure there might be some method to circumvent this problem in them.

[steven36]

Too me latency means a lot , If they have too make them have high latency and they dont run no faster  there is no use in me buying a SSD ..Same reason I use Windows too  do high CPU task , in Linux you have too use a Low latency kernel to do high CPU task and it's not  good too use it for normal task by the time I reboot into a Low latency kernel i can reboot into windows and I have my programs i always use  and I dont have too fool with a Low latency kernel. I can encode a video full movie in x264 in about 60 min in Windows and that's good enough for my old hardware from 2012  It still faster than my newer computer from 2015 is. I even have another PC that's even older with Windows 7 it can encode a movie in about  1hour and a half  ..And sometimes i just  use it instead  because i have it setup just for offline task .

 

Darn HEVC  you need one of the newest processors  they make if you want too have any speed at doing it  because the tech  for it is still progressing so most of it you see online is done trough the cloud were it can be done really fast . Skylake dont have but a little 8 bit support Kabylake is better but still it's not been optimized to work as fast as x264 does.  Once the tech is fast enough and in all PCs and  is in AMD i may splurge for a new PC  . I was impressed by the way they got better support in Linux than they do in Windows for older hardware now for drivers .  Too me Intel has longer support but cost more too get the same speeds you can get with AMD . They has too be a reason for me too buy a major breakthrough . But telling me there going have too make something slower is not good news too me they need too figure out a better way.

 

And i'm no fanboy  of Condusiv products  i dont use there defrager since  the early 2000s  (they use too make a great retail version a long time ago) other than testing some cracks for it back when uploading witch i retired from testing stuff I don't use in 2011 ive not used it at all since AGAIN cracked it, now its  Demoware and people seem too love chasing a fix I installed it once in 2016 too see what the fuss was about and i didn't like it,so i uninstalled it.  .I just wanted too point out that it was researched  by others than just them, I do think some of  it PR because Defrag companies  like Condusiv  have took a big loss because of SSD and free alternatives  . I'm a Raxco PerfectDisk man myself but i still use old type hard drives .

 

In this poll at neowin forums  Diskeeper (Condusiv Technologies) got 0 %  most use just Free Microsoft built in version and PerfectDisk came in 2nd .

https://www.neowin.net/forum/topic/1327812-which-defragmentation-software-do-you-use-2017/

 

[stylemessiah]

13 hours ago, pc71520 said:

 

 

Condusiv has been a pioneer.

 

Youre exactly the kind of person they hope to win over with their bs...

 

Yup they were pioneers, even as Diskeeper, were pioneers in making people think they need their software....

Read any analysis of Diskeeper back in the day, and you will quickly realise it was snake oil...free MyDefrag (which i still use to defrag spinning disks because its been shown to be the most effective defrag tool ever) did far more than Diskeeper ever did

[pc71520]

3 hours ago, stylemessiah said:

You're exactly the kind of person they hope to win over with their bs...

-You are the kind of person who did NOT realize that I was SARCASTIC. 

-You got it All Wrong, dude!

3 hours ago, stylemessiah said:

free MyDefrag (which i still use to defrag spinning disks because its been shown

to be the most effective defrag tool ever) did far more than Diskeeper ever did.

And I use the Windows 10 Built-in Defragmentation Tool, because I saw no significant performance gain

while trying all these 3^rd party defrag tools; including your precious MyDefrag!

 

So, stop bragging about an obsolete software (MyDefrag) that has been an Abandon-ware since 2010!

It has been no significantly better that the rest of these Defragmentation Tools.

[tao]

7 hours ago, pc71520 said:

-You are the kind of person who did NOT realize that I was SARCASTIC. 

-You got it All Wrong, dude!

 

We (at nsane and other fora) are the the type of persons known for our quick draw. 

 

And about being wrong, eh, (wrong/right) ---> ((∞-1000)/(0+1000))!.  

[Pequi]

11 hours ago, stylemessiah said:

Yup they were pioneers, even as Diskeeper, were pioneers in making people think they need their software....

Read any analysis of Diskeeper back in the day, and you will quickly realise it was snake oil...free MyDefrag (which i still use to defrag spinning disks because its been shown to be the most effective defrag tool ever) did far more than Diskeeper ever did

 

IAWTP

http://www.hofmannc.de/en/windows-7-defragmenter-test/

 

Probably one of the most thorough tests ever done with defraggers. They guy obviously was not promoting payware.

NOT valid for SSDs

HTH

 

[pc71520]

15 hours ago, adi said:

We (at nsane and other fora) are the the type of persons known for our quick draw. 

Especially, some "wise" guys who Not only miss-understood things, but they also point a finger at others...

[pc71520]

14 hours ago, Pequi said:

http://www.hofmannc.de/en/windows-7-defragmenter-test/

Released on 05/21/2014

 

-Here, it is an older test:  The Great Defrag Shootout: The Winners

Released on 09/13/2007

 

Frankly, I haven't seen such a Performance gain that I tempted to keep any of these 3^rd party Defrag tools.

 

 

[tao]

5 hours ago, pc71520 said:

Especially, some "wise" guys who Not only miss-understood things, but they also point a finger at others...

The first part may be so. 

 

Have not enough fingers to point.  Also one of the fingers, if being pointed, is mine pointing at me. 

 

And, please lead the way; I'll follow! 

[pc71520]

@adi

 

I never implied something about you, dear friend.

My remarks were for someone else...

[DKT27]

On 9/7/2017 at 7:57 PM, Pequi said:

 

IAWTP

http://www.hofmannc.de/en/windows-7-defragmenter-test/

 

Probably one of the most thorough tests ever done with defraggers. They guy obviously was not promoting payware.

NOT valid for SSDs

HTH

 

 

Outstanding this.

 

I wonder if anyone has tried warpdisk or has any experience of it.

 

I must mention, if a disk gets arranged folder wise, then it's going to give the best performance and least disk wear I think.