Are the updates signed? Or can anyone make a piece of software to do this?
3
-
4Does this answer your question? Is it possible for the firmware of an SSD be infected by malware/malicious rootkits via the internet?, Has there ever seen a recorded case of a M.2 infected SSD firmware?, What are the dangers of a firmware malware in 2021 and is it possible? ...– Steffen UllrichSep 10, 2022 at 5:46
-
@SteffenUllrich I think this mean it is possible but not for M.2 drives. I knew it was possible, but I was not aware M.2 was a limitation.– CoderxyzSep 10, 2022 at 9:44
-
@SteffenUllrich I saw that before. In the link posted there they physically install a chip on the drive. I have not yet though seen any data on whether this is possible through just software means. You could potentially do it, but it would be much harder if the updates are cryptographically signed and the drive checks for it (which I can't find if they are or aren't).– HormozSep 10, 2022 at 16:16
Add a comment
|
1 Answer
I believe the update process for firmware is specific for the manufacturer or even model. While one would expect these updates to be cryptographically signed in this times, there is no guarantee that it actually is done properly (or even at all) nor that the signatures are validated properly nor that there is a working downgrade protection. It is too easy to make bugs in this area, as shown in Flaws in self-encrypting SSDs let attackers bypass disk encryption a few years ago.
Apart from that, even if the signature is properly done and verified this still leaves the problem that the key used for the signature might get compromised and the attacker might be able to create a new firmware. While this is less likely for "normal" criminal attackers it probably is in a range of what government agencies can do - especially government agencies from the same country as the manufacturer.
In other words: don't fully rely on the manufacturer. The risk of broken firmware or broken firmware update process can be mitigated with adding encryption and integrity checks in software outside the disk and by doing backups.
answered Sep 10, 2022 at 16:32
