Overprovisioning SSD - Windows 11

DigitalGoat · Jan 2, 2022

The worrying thing is that these researchers tend to inform the manufacturers of their findings first, some manufacturers even have a bounty system in place for these circumstances, but if the manufacturers refuse to accept the evidence, or that it could be an issue (meaning they refuse to pay a bounty as well) the researchers will publish their findings publicly in an attempt to at least force the manufacturers into putting anti vulnerability measures into place.
Not saying that is what has happened here, it is possible fixes are on the way which is why the story can be reported now, well we can hope. :)

PerpetualCycle · Jan 2, 2022

You don't know the full circumstances. These researchers have unfettered access to a system. Hackers have more hurdles to jump through. I am not concerned, though I don't over-provision because it isn't really necessary.

I just scanned the article. They mention an over provisioning partition in which they can inject code. There has to be a partition for them to be able to do that. But you do not need an unused partition to over provision, you can just not allocate space on the drive, or shrink a partition to free provide unallocated space. This would provide another hurdle - requiring creating a new partition without your detection.

DigitalGoat · Jan 3, 2022

I believe the article refers to the over provisioned space the manufacturers build into the drive, this is beyond the ability for either users or the OS to see. It is used by the drives firmware for wear levelling and other built in features, it is nothing to do with standard over provisioning or partitioning.
This is why it is of particular interest to researchers and possibly malware authors as any OS based anti malware currently in use would be completely powerless against such an attack vector.
And yes it would be extremely difficult to take advantage of initially, but we have already seen high resource intensive "hacking" methods become easier to reproduce and trickle down the hill in shorter time than would at first be believed.

cereberus · Jan 3, 2022

DigitalGoat said:
I believe the article refers to the over provisioned space the manufacturers build into the drive, this is beyond the ability for either users or the OS to see. It is used by the drives firmware for wear levelling and other built in features, it is nothing to do with standard over provisioning or partitioning.
This is why it is of particular interest to researchers and possibly malware authors as any OS based anti malware currently in use would be completely powerless against such an attack vector.
And yes it would be extremely difficult to take advantage of initially, but we have already seen high resource intensive "hacking" methods become easier to reproduce and trickle down the hill in shorter time than would at first be believed.

I question the motives of authors of this and similar articles as they highlight an issue and publicise weaknessea informing hackers of possible new methods they can attack pc. If they had not published, the hackers would be unaware of such an issue.

Why do they publicise details - is it to shame the SSD vendors into action, or is it to publicise how great they are (to generate more work).

Even if the authors were being altruistic and believe the issue should be publicised, they should ask themselves if they could create more damage than they solve.

DigitalGoat · Jan 3, 2022

The article does not really go into enough detail to know, usually the attack vector is reported to the manufacturers for validation and closing long before the details are made public. Occasionally the story may be leaked early, which is bad news or published because manufacturers fail to act for whatever reason, with a view to forcing action since it is now in the public domain.
There is no reason to believe that such attack vectors are not being found by malware authors, maybe starting with state funded groups, I would prefer if the altruistic researchers found the weaknesses before those groups, after all prevention is better than fixing the potential mess these sort of exploits could cause.

tinmar49 · Jan 4, 2022

It's good to know that there are plenty of helpful hackers about, they are needed to fight those darstardly NC's, R's and C's.

Search

Overprovisioning SSD - Windows 11

DigitalGoat

Well-known member

My Computer

At a glance

PerpetualCycle

Syzygy

My Computers

At a glance

At a glance

DigitalGoat

Well-known member

My Computer

At a glance

cereberus

Well-known member

My Computer

At a glance

DigitalGoat

Well-known member

My Computer

At a glance

tinmar49

Well-known member

My Computers

At a glance

At a glance

Similar threads

Latest Support Threads

Latest Tutorials

Overprovisioning SSD - Windows 11

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers