How secure is WD MyPassport lock

Question

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the way the hard drive is beeing locked.

Answer 1

What isn't documented, is not documented. All we can do is infer.

From the documentation, we see that the password must be re-entered in a number of conditions (drive unplugged, computer shut down, computer put to sleep...) which boil down to: the drive was not powered at some time. This hints at a security feature done on the drive itself, not in software on the host computer. Page 27, we also see that a locked drive can still be used on a machine where the WD software is not installed, provided that you still use the software for a one-time unlock operation (this application is shown by the hard drive to the computer as a virtual CD-ROM emulated by the USB firmware on the drive). This reinforces the idea that everything occurs on the drive.

The screenshot page 26 shows a warning to the effect that WD themselves won't be able to recover the data when a password is lost, so it is probable that:

• The locking uses encryption.
• The encryption uses a key which is derived more or less directly from the user password.

Since the user password can be changed (page 28) without implying a complete re-encryption of the disk (it would take some non-negligible time, e.g. one hour), one can surmise that the drive data is encrypted with a drive-specific key K, which never changes, and that key is stored somewhere on the disk (possibly in some EEPROM) encrypted with a password-derived key. When the disk is unlocked, K is decrypted with the password, and kept in some RAM on the disk (disks have RAM, several megabytes, if only for caching). This is lost when the power is cut. When the user changes his password, K is decrypted with the old password and re-encrypted with the new. When the password is removed, it is actually replaced with a convention password (i.e. the data is always encrypted with K).

This is about the amount of what can be deduced from the information. Then we can make some guesses:

• The encryption with K does not include checked integrity (i.e. no MAC). I assume this because a MAC requires some extra space (just a few bytes) which would destroy the nice powers-of-two sizes of individual sectors. Adding a MAC would likely increase development costs or decrease performance or both; since they don't boast about it, chances are that there is no MAC.

• The derivation from the password to the key which encrypts K is probably weak, because:

  • Strong derivation would use a random salt, which then requires a source of randomness, and there is no reason otherwise to have a dedicated chip for randomness on the drive. Economics being what they are, chances are that there is no random salt.

  • The hashing process cannot include many iterations because they would have to be computed by the CPU embedded in the drive, which is not nearly as efficient for number crunching as a basic PC (again, economics).

  • Despite repeated pedagogical efforts, nobody in the industry seems to be able to do password hashing properly. I shall soon have to resort to threats; they just don't want to learn.

• Encryption itself is probably based on AES, because there now are disks with flaunted AES-based encryption, so disk manufacturers have the dedicated chips and know-how. Using another encryption algorithm would just be more expensive for them, so chances are that they abstain (there, economics induce the vendors into doing the right thing).

  • But nothing guarantees that AES was used properly. Good hard disk encryption needs some specific encryption modes (the arguments against extra storage for a MAC and against the presence of a hardware RNG also apply here: encryption is probably not CBC with a random IV). If the manufacturer just used ECB (a really bad idea in this case), you would not know it.

Conclusion: the locking feature may be good, but there is a high probability that at least parts of the system are weak (probably the password derivation feature, and the encryption mode). You cannot build a reasonable security strategy on unknowns, so a cautious should prefer a software-based solution where the involved algorithms are known and are applied properly (e.g. TrueCrypt).

Also, note that the software used to unlock the drive does not appear to have a Linux version, so this may reduce interoperability.

Answer 2

Tom Leek seems quite prescient. It is now late 2015 and researchers have shone a spotlight on the Western Digital My Passport and My Book series in a paper titled:

got HW crypto? On the (in)security of a Self-Encrypting Drive series

This post to the Full Disclosure Mailing List holds the details: http://seclists.org/fulldisclosure/2015/Oct/79

From my amateur reading of it, the paper ( https://eprint.iacr.org/2015/1002.pdf ) supports most of Tom's inferences and can probably explain zed_the_shredder's observations (while not exactly supporting the conclusion).

---

Abstract

Self encrypting devices (SEDs) doing full disk encryption are getting more and more widespread. Hardware implemented AES encryption provides fast and transparent encryption of all user data on the storage medium, at all times. In this paper we will look into some models in a self encryption external hard drive series; the Western Digital My Passport series. We will describe the security model of these devices and show several security weaknesses like RAM leakage, weak key attacks and even backdoors on some of these devices, resulting in decrypted user data, without the knowledge of any user credentials.

Authors:

• Gunnar Alendal
• Christian Kison
• modg

Multiple vulnerabilities, including:

• Multiple authentication backdoors, bypassing password authentication
• AES factory key recovery attacks, exposing user data on all affected devices, regardless of user password
• Exposure of HW PRNGs used in cryptographic contexts
• Unauthorized patching of FW, facilitating badUSB/evil-maid attacks

Answer 3

By performing a large file (1GB) copy from C:\ to WD My Passport drive, before and after applying password, it can be seen that either encryption is always performed or NOT at all performed and only password flag is applied within disk. The copying speed was same.

I think I have wasted my money on this hardware encrypting drive. I think, the choice of simple external USB drive would be better along with using TrueCrypt system partition volume format.

Answer 4

Data is always encrypted on passport drive, using a master key 'K' which is probably sitting on a server somewhere at WD in case the courts need to subpoena your data. Removing the password simply makes the encryption transparent to the user.

Answer 5

I can't believe the length Tom Leek went to in his analysis of the Western Digital security lock but missed the mark by a staggering amount.

Here is my empirical evidence. Make of it what you will.

I own a 1Tb Western Digital external Passport series 2.5" hard drive. It's about 2-3 years old now and has been 100% reliable with respectable performance. From the on-set I have used the Western Digital security lock assuming it was effective as WD is a big company with a reputation to maintain. As time passed I felt even more secure as there were no reports or urgent updates from WD to patch defects in their security lock.

I recently needed more external 1Tb drives. The WD were 2x the price of another brand and I put that down to the fact that if you wanted security built-in then you have to pay a substantial premium for it. I opted for the inexpensive security less 1Tb drives.

For a variety of reasons while preparing my cheap drives I became annoyed each time I plugged in my WD. If it wasn't the WD virtual CD drive letter messing things up it was the need to type my WD password (25 characters) repeatedly. I decided to start by hiding the WD virtual drive that appears upon mounting the WD external drive.

There was so much wrong (and bad) advice at the WD knowledge base that removing the WD virtual drive looked to be impossible, even Googling a fair amount of time wasn't helpful. Nothing I read exposed any sort of flaws in the WD security lock scheme though. I did learn that placing the mechanicals of the WD drive into an Iomega housing or into a SATA based PC wouldn't work. Something about the starting sector being all wrong.

After a wasted day I decided to bite the bullet and wait the time required to decrypt my data after removing my WD password using the WD security tool. I figured it would take a day or so to decrypt 475Gb. Removing the password was easy. I followed the prompts and unplugged my WD drive and re=plugged it back in.

Two very interesting things happened. The WD virtual CD containing the program to enter my password to access the drive was gone. I sort of expected that.

The other thing was a complete surprise. All of my data, all 475Gb worth was completely accessible. There was no wait while it was unencrypted in place. I ran several tests just to be sure it was as I said. I plugged the WD into a computer it had never been attached to before. I appeared as an external drive of 931Gb capacity and all of my files were freely accessible to open, rename, copy or delete.

Conclusion. The data on a Western Digital drive is not encrypted at any time. Not when the drive is password protected or otherwise. In fact, IMO, for Western Digital to represent their drives as encrypted to AES or better standards is fraudulent in fact.

I'm going to take credit for this discovery because before my writing this I found no material in any form that uncovered the fact the data on a WD password protected "encrypted" drive is actually open and stored in native format.