Classifying Proprietary Firmware on a Solid State Drive Using Idle State Current Draw Measurements

IEEE Access

Dane Brown¹  Robert W. Ives²  James Shey²  T. Owens Walker²  Ann Vanleer²  Hau T. Ngo²  Justin A. Blanco²  Gregory L. Sinsley²  Ryan Rakvic² 

[1] Cyber Science Department, United States Naval Academy, Annapolis, MD, USA;Electrical and Computer Engineering Department, United States Naval Academy, Annapolis, MD, USA;

关键词: Solid state drive;    SSD;    current draw;    power consumption;    firmware;    security;   

DOI  :  10.1109/ACCESS.2020.2973605

来源: DOAJ

【 摘 要 】

Solid state drives (SSDs) are coming under increased scrutiny as their popularity continues to grow. SSDs differ from their hard disk drive predecessors because they include an onboard layer of firmware to perform required maintenance tasks related to data location mapping, write performance, and drive lifetime management. This firmware layer is transparent to the user and can be difficult to characterize despite its clear potential to impact drive behavior. Flaws and vulnerabilities in this firmware layer have become increasingly common. In this work, we propose and analyze a technique to classify different versions of proprietary firmware on an SSD through the use of current draw measurements. We demonstrate that major groupings of firmware can be classified using current draw measurements not only from explicitly active drive states such as read and write but also from the low power idle state. We achieve pairwise classifications rates near 100% between firmware examples in these different major groupings. Coupling these results with firmware release information, we are able to infer major updates in the firmware timeline for the SSD we examined. We also develop an anomaly detector and achieve detection rates of 100% for samples that reside outside of the reference grouping.

【 授权许可】

Unknown