Why it matters to you
Your SSDs might be fast, but they’re also designed in a way that opens you up to yet another kind of attack.
Solid-state disks (SSDs) offer some serious benefits over their older hard-disk drive (HDD) siblings. SSDs are faster by orders of magnitude than HDDs, and they’re fundamentally more reliable — particularly for mobile devices where moving parts can be affected by movement and drops.
As SSD pricing has dropped from being significantly more expensive than HDDs to only a little more expensive, the price-to-performance ratio has improved to where SSDs have become by far the preferred storage device. However, some new information suggests that SSDs aren’t perfect and bring a unique vulnerability to particular kinds of attacks, as ExtremeTech reports.
The details are complex and require digging into the details of how SSDs are designed and how they work. Researchers at Carnegie Mellon University were the first to uncover the flaw, and their findings are covered in copious technical detail in a recently published paper.
In simpler terms, the vulnerability affects particular kinds of SSDs that are based on multilevel cell (MLC) technology, which make up the majority of those currently being sold and developed. The vulnerability in question does not affect older single-level cell (SLC) devices. The most advanced 3D NAND flash used in some SSDs are not affected yet but could be affected in future designs.
The vulnerability leverages a design quality of MLC-based SSDs that actually confers some benefits, including lower latency and better performance. The problem stems from the fact that data is written into a buffer directly from the individual flash cell that’s going to be written and not from the SSD’s flash controller.
Again, it’s all very technical, but basically, data can be corrupted by an attacker introducing interference and introducing errors during the programming process. That can result in corrupted data and actual damage to an SSD.
The solution would be to buffer data into the SSD flash controller and allow the controller to correct errors. The problem with this response is that it would also increase latency by around 5 percent and thus reduce performance — something that manufacturers might not be quick to do in the consumer market in particular given the important of raw speed to selling SSDs.
In any event, there’s something else to worry about to go along with the waves of malware and ransomware attacks we’ve seen lately. Our SSDs aren’t as safe as we thought they were, and that’s all we needed.