Malware Could Use SSD Over-Provisioning to Bypass Security Measures

Re:Malware Could Use SSD Over-Provisioning to Bypass Securit... by Arnavion on Thursday December 30, 2021 @07:51PM (#29743562)

Both. The paper isn't concerned with how the malware is executed, and malware is only one of the things it talks about storing in the OP area in the first place. The paper is just about the fact that there exist SSDs where the OP area can be made to grow and shrink dynamically through external factors, and thus can be used to store things that an unprivileged program won't find.

Basically, whether a program can read the data from the OP area directly doesn't really matter. The privilege needed for that is equal or greater than the privilege needed to resize the OP area anyway.

[ Parent | on HN ]

Re:Malware Could Use SSD Over-Provisioning to Bypass Securit... by feupan on Friday December 31, 2021 @12:35AM (#29745297)

I’m not sure I follow. While resizing such area seems excessive to even be possible by the owner, I don’t see how essentially writing on unreadable sectors is a concern. This is essentially piping to /dev/null if you can’t read from it.

[ Parent | on HN ]

Re:Malware Could Use SSD Over-Provisioning to Bypass Securit... by Arnavion on Friday December 31, 2021 @04:14AM (#29746264)

Growing the OP area == making previously accessible area inaccessible.

Shrinking the OP area == making previously inaccessible area accessible.

[ Parent | on HN ]