Bypassing Self-Encrypting Drives (SED) in Enterprise Environments

on YouTube ↗59m

" summary

Claims a widespread design gap: Opal / eDrive SEDs unlock on wake and stay unlocked until power‑cycled or an explicit lock command, so physical access while a machine is asleep or soft‑restarted yields plaintext. Demonstrated exploits include hot-plug/hot-unplug (remove drive, power it externally, swap SATA data), a force-restart via USB emulation (Facedancer/UMAP) to boot an external OS and copy files, and a proposed firmware/SATA sniffer key-capture. Demos use USB↔SATA adapters and caused Windows crashes; mitigation is forced power‑off/hibernate, BIOS lockdown, or vendor fixes (Lenovo eDrive behavior differs).

AI-written summary · about

" chapters (34)

1. 0:00Introduction
2. 0:24Daniels Background
3. 8:27Classical Full Disk Encryption
4. 9:00Advantages and Disadvantages
5. 11:25HardwareBased Encryption
6. 11:47HardwareBased Encryption Advantages
7. 13:35HardwareBased Encryption Overview
8. 17:24Opal Standard
9. 18:37Key Encryption
10. 19:30Custom Encrypted Drives
11. 20:18Open Technology
12. 20:57Previous Research
13. 23:43System Area
14. 25:02How Drives Work
15. 27:25Opel Standard
16. 29:00Previous Work
17. 31:36Demo
18. 37:06Miller Research
19. 38:08User Perspective
20. 39:23Forced Restart Attack
21. 39:52Soft Reset
22. 40:42Shorting Memory Pins
23. 41:15Triggering Crashes
24. 41:45Blue Screen of Death
25. 46:31Lenovo laptops
26. 47:02User options
27. 47:57Power cycle
28. 48:44SATA extension
29. 49:40Key capture attack
30. 50:21Have I been hacked
31. 51:06TCG disclosure
32. 51:27Vulnerability notes
33. 51:52Impact of vulnerabilities
34. 56:48Questions

" related talks

• 32mSelf-Encrypting Drive (SED) Standardization Proposal for NVDIMM-N DevicesSridhar Balasubramanian, Frederick Knight · Vault '19
• 27mProtecting Data In-Use from Firmware and Physical AttacksSteve Weis · Black Hat USA 2014
• 49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded ControllerAlex Matrosov, Alexandre Gazet · Black Hat USA 2019
• 50mMalware Buried Deep Down the SPI Flash: Sednit's First UEFI Rootkit Found in the WildJean-Ian Boutin, Frederic Vachon · Black Hat Europe 2018
• 57mExtreme Privilege Escalation on Windows 8/UEFI SystemsCorey Kallenberg, Xeno Kovah, Samuel Cornwell · Black Hat USA 2014
• 36mAikido: Turning EDRs to Malicious Wipers Using 0-day ExploitsOr Yair · RSA Conference 2023
• 33mAikido: Turning EDRs to Malicious Wipers Using 0-day ExploitsOr Yair · Black Hat Europe 2022
• 29mRendering Ransomware Detection and EDR Products BlindRene Kolga · BSidesSLC 2020