Recently discovered SSD vulnerabilities by researchers from Carnegie Mellon University, Seagate, and the Swiss Federal Institute of Technology in Zurich, reveal the first-ever security weakness of its kind against MLC SSDs that store much of the world’s data. Two different types of malicious attacks are reported to corrupt data, leaving much of the world’s data currently exposed while organizations search for answers.
BURBANK, Calif., June 01, 2017 (GLOBE NEWSWIRE) -- Condusiv® Technologies, the world leader in software-only storage performance solutions, today announced that recently discovered multi-level cell (MLC) solid-state drive (SSD) vulnerabilities that corrupt data could cripple global markets if exploited by malicious attackers, leaving much of the world’s data currently exposed except for its own customers.
“If security experts and data protection experts didn’t have enough to worry about already, the latest discovery from Carnegie Mellon University has set off brand new alarms that could be far more crippling than the recent WannaCry virus or any ransomware attack. In this case, data is not infected or held hostage, but is lost entirely - not even the host SSD hardware can be salvaged after such an attack. This is not simply alarming to organizations that stand the most to lose like financial institutions, but we’re talking about real lives here if patient care is compromised as we saw earlier this month at hospitals across the UK,” said Brian Morin, SVP, Sales and Marketing, Condusiv Technologies.
In a report recently published by researchers from Carnegie Mellon University, Seagate, and the Swiss Federal Institute of Technology in Zurich1, there are two types of malicious attacks that can corrupt data and shorten the lifespan of MLC SSDs – a write attack (“program interference”) and a read attack (“read disturb”). Both attacks inundate the SSD with a large number of operations over a short period of time, which can corrupt data, shorten lifespan, and render an SSD useless to store data in a reliable manner into the future. However, both attacks rely upon native read and write operations from the operating system to the solid-state drive, which is circumvented by Condusiv’s SSDkeeper® on Windows systems.
“The only reason this story was not sensationalized across headlines last week is because no one has died yet or lost a billion dollars. This is a new and very different kind of vulnerability. Protection from this kind of an attack is not something that can be addressed by traditional lines of defense like anti-virus software, firmware upgrades, or OS patches. Since it is cost prohibitive for organizations to “rip-and-replace” multi-cell SSDs with single-cell SSDs, they are forced to rely on data sets that have been “backed-up.” However, what good is restoring data to hardware that can no longer reliably store data? There is no known protection to keep MLC SSD data safe and no tech organization has responded to these challenges until today,” said Morin.
Morin continued, “By acting as the “gatekeeper” between the Windows OS and the underlying SSD device, Condusiv’s SSDkeeper performs inline optimizations at the OS-level before data is physically written or read from the solid-state drive. As a result, SSDkeeper’s patented technology is the only known solution that can disrupt “program interference” write operation attacks as well as “read disturb” read operation attacks that would attempt to exploit SSD vulnerabilities and corrupt data. While most known for boosting performance of Windows PCs and servers while extending the longevity of SSDs, SSDKeeper goes a step further as the only line of defense against these malicious attacks. We don’t have a solution for Linux users at this time which, unfortunately, leaves those organizations entirely exposed.”
Condusiv’s SSDkeeper patented write optimization engine (IntelliWrite®) mitigates the first vulnerability, “program interference,” by disrupting the write pattern that would otherwise generate errors and corrupt data. SSDkeeper eliminates excessively small writes and subsequent reads by ensuring large, clean contiguous writes from Windows so write operations to solid-state devices are performed in the most efficient manner possible on Windows servers and PCs. An attack could only be successful in the rare instance of limited free space or zero free space on a volume that results in writes occurring natively, circumventing the benefit of IntelliWrite.
SSDkeeper’s second patented engine (IntelliMemory®) disrupts the second vulnerability, “read disturb,” by establishing a tier-0 caching strategy that leverages idle, available memory to serve hot reads. This renders the “read disturb” attack useless since the storage target for hot reads becomes memory instead of the SSD device. A “read disturb” attack could only be successful in the rare instance that a Windows system is memory constrained and has no idle, available memory to be leveraged for cache by SSDkeeper.
Morin added, “Organizations use SSDkeeper site-wide on their Windows PCs and servers to maintain peak performance and extend the longevity of their SSDs. Now they can trust SSDkeeper to protect against malicious attacks that would otherwise corrupt user data and bring great harm to their business and service to customers.”
More information and a free 30-day software trial can be found at: http://www.condusiv.com/business/ssdkeeper/professional/
About Condusiv Technologies
Condusiv® Technologies is the world leader in software-only storage performance solutions for virtual and physical server environments, enabling systems to process more data in less time for faster application performance. Condusiv guarantees to solve the toughest application performance challenges with faster than new performance via V-locity® for virtual servers or Diskeeper® or SSDkeeper® for physical servers or PCs. With over 100 million licenses sold, Condusiv solutions are used by 90 percent of the Fortune 1000 and almost three-quarters of the Forbes Global 100 to increase business productivity and reduce datacenter costs while extending the life of existing hardware.
For more information, visit www.condusiv.com
Follow us on Twitter and Like Us on Facebook
© 2017 Condusiv Technologies Corporation. All rights reserved. Condusiv, the Condusiv Logo, V-locity, Diskeeper, SSDkeeper, IntelliWrite, IntelliMemory are registered trademarks or trademarks owned by Condusiv Technologies Corporation. All other trademarks and brand names are the property of the respective owners.
1 https://people.inf.ethz.ch/omutlu/pub/flash-memory-programming-vulnerabilities_hpca17.pdf