Hardware-based full disk encryption: Difference between revisions

Revision as of 04:44, 17 October 2020

Revision as of 00:25, 23 October 2020

Line 61:

When a computer with a self-encrypting drive is put into [[sleep mode]], the drive is powered down, but the encryption password is retained in memory so that the drive can be quickly resumed without requesting the password. An attacker can take advantage of this to gain easier physical access to the drive, for instance, by inserting extension cables.<ref name="sed-attacks" />

The firmware of the drive may be compromised<ref>{{cite web | url = https://www.wired.com/2015/02/nsa-firmware-hacking/ | title = How the NSA’sNSA's Firmware Hacking Works and Why It’sIt's So Unsettling | first = Kim | last = Zetter | date = 2015-02-22 | work = Wired }}</ref><ref>{{cite web | url = https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/ | title = Your hard drives were RIDDLED with NSA SPYWARE for YEARS | first = Darren | last = Pauli | date = 2015-02-17 | work = The Register }}</ref> and so any data that is sent to it may be at risk. Even if the data is encrypted on the physical medium of the drive, the fact that the firmware is controlled by a malicious third-party means that it can be decrypted by that third-party. If data is encrypted by the operating system, and it is sent in a scrambled form to the drive, then it would not matter if the firmware is malicious or not.

=== Criticism ===