Suppose the firmware of an SSD or HDD has been compromised by rogue actors either through "interdiction" (interception) or via the internet. They are able to exfiltrate data and conduct surveillance at will without my knowledge.

Can I mitigate the effects of the compromise by having the entire disk encrypted using tools such as Linux's Luks or Microsoft Windows Bitlocker? Or would installing Qubes-Whonix be a better option than LUKS and Bitlocker?

  • 2
    If the firmware is infected, you cannot trust firmware-based encryption. If the firmware is infected, then it does not matter what technology to stack on top of it: the data is exposed.
    – schroeder
    Oct 29, 2018 at 13:19
  • 2
    @schroeder It sounds like OP is talking about software encryption.
    – forest
    Oct 29, 2018 at 23:32
  • @forest Yes, you are right. I am talking about using software encryption to mitigate against a compromised firmware of an SSD or HDD. If I understand the reply by schroeder correctly, it seems that even software encryption such as LUKS will not help mitigate against a compromised firmware. Oct 30, 2018 at 1:23

1 Answer 1


Partially. Full disk encryption, when done through software (e.g. LUKS), means that a compromised storage device will only ever see encrypted data, never decrypted data. It will never have access to the key. However, it would still be able to tamper with data by exploiting the malleability of non-authenticated modes which could potentially be abused to compromise the operating system (for example, the storage device could randomize any 16 byte block in XTS by toggling a single bit in the ciphertext, which can be very bad in some situations), or by exploiting weaknesses in XTS when snapshots are available to an attacker over time to leak information. Additionally, if you are booting from the drive, then a malicious MBR could be sent to the computer from the drive, loading a bootkit. Another issue is the capabilities of the storage device interface. SATA, for example, should not make a DMA attack possible, but a drive connected directly over PCIe might be able to write to system memory.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .