Close

Wear leveling as an attack

A project log for Orthrus

SD card secure RAID USB storage

nick-sayerNick Sayer 04/14/2017 at 19:380 Comments

Wear leveling is a technique to spread the writes around a flash storage volume. Reading flash memory causes no reduction in lifespan, but flash memory can tolerate a non-infinite number of writes before it stops working. Since filesystems tend to make write "hotspots" around the filesystem metadata, wear leveling is a technique by which each write of the same block is translated to a different location within the flash array. Where wear leveling becomes an attack is in two ways:

  1. If you can obtain direct access to the flash array, bypassing the controller that does the wear leveling, you could conceivably read previous "versions" of a block, providing the chip knew that it could use "deallocated" blocks as replacements that didn't need their content preserved.
  2. If the controller was "lazy" and allowed reading remapped "deallocated" blocks (at their mapped locations) rather than always returning a fixed value for a read on deallocated blocks.

If either of these happen, then it's conceivable that a re-keying of an Orthrus volume would leave behind an accessible copy of the previous key block.

Orthrus itself doesn't support TRIM operations (I honestly don't know if it's supported generally on SD media), but in principle, by doing enough writing onto a volume without using TRIM, you could eventually cause all blocks to be marked as used, which would mean that the controller would be unable to be "lazy" about moving blocks without swapping them.

If you're particularly paranoid, then the thing to do is to treat an Orthrus card the same way you'd treat an ordinary hard disk that had the secret on it. The only protection Orthrus offers is that if someone has only one card, they don't have the key material that's on the other card, and therefore can't get at any of the data. If you re-key cards, then because of wear leveling, you can't be absolutely sure that that destroyed all traces of the previous key material. If your threat model is that powerful, then you should be destroying the cards when you're done with them.

Discussions