You have an external hard drive that was left in a public place. The data is encrypted.

  1. What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts it?
  2. is it possible to find out if the hard drive's software or hardware was modified with those vulnerabilities and is safe to use?

closed as too broad by multithr3at3d, Jacco, Tobi Nary, Teun Vink, ThoriumBR Feb 26 at 18:43

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Is this a homework question? – schroeder Feb 24 at 15:49
  • You will have to be more specific because each brand of external bay/controller has it's own set of vulnerabilities. – Overmind Feb 25 at 8:08

These are good questions to be asking. Unfortunately, the answer is pretty much “???” to both.

To the first question, individual vulnerabilities vary by drive. As with all technology, vulnerabilities exist out of mistakes in implementation or design, so there are no universal rules for knowing what something might be vulnerable to. To illustrate this, using an appsec example (I specialize in appsec, so it’s always on my mind) - just because something is a login form doesn’t mean it’s vulnerable to cred stuffing attacks. Sure, that’s a good vector for cred stuffing, but the form might be rate-limited, use sophisticated banning techniques, etc. You can’t know simply based on the fact it’s a login form.

Similarly, just because something is an external hard drive doesn’t mean that its encryption is or is not compromised. To get more information over this, you’ll need to research the drive you plan on using more. As a result, without knowing the tech and its vulnerabilities, the answer to your second point is even more unknown.

However, as a rule, the safest bet is to assume that anything left unattended in public is fully compromised. This level of paranoia/caution might be unwarranted (i.e., leaving an encrypted drive for 5 minutes while you turned your back at the library seems probably fine), but if you want maximum security, that’s the best way to go. This is especially true in a higher-risk situation - such as if the drive is old and therefore maybe less secure, if it was in an environment with more resources (the library is probably less likely to have compromise than, say, in custody with law enforcement), etc. If it really really matters, assume it’s toast and act accordingly.

I’m going to add the caveat this is just Internet Thoughts. Have common sense and don’t make decisions based off of this, knowing this answer is written from the perspective of broad generic guidelines.

Not the answer you're looking for? Browse other questions tagged or ask your own question.