Dark Mode
Capec-402 Detail
Bypassing ATA Password Security
Detailed Supply Chain Physical Security Hardware
Parents: 401
Threats: T68
An adversary exploits a weakness in ATA security on a drive to gain access to the information the drive contains without supplying the proper credentials. ATA Security is often employed to protect hard disk information from unauthorized access. The mechanism requires the user to type in a password before the BIOS is allowed access to drive contents. Some implementations of ATA security will accept the ATA command to update the password without the user having authenticated with the BIOS. This occurs because the security mechanism assumes the user has first authenticated via the BIOS prior to sending commands to the drive. Various methods exist for exploiting this flaw, the most common being installing the ATA protected drive into a system lacking ATA security features (a.k.a. hot swapping). Once the drive is installed into the new system the BIOS can be used to reset the drive password.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-402 | capec | https://capec.mitre.org/data/definitions/402.html | |
| CWE-285 | cwe | http://cwe.mitre.org/data/definitions/285.html | |
| REF-33 | reference_from_CAPEC | Stuart McClure, Joel Scambray, George Kurtz, Hacking Exposed: Network Security Secrets & Solutions (6th Edition), 2009, McGraw Hill | |
| REF-701 | reference_from_CAPEC | https://www.admin-magazine.com/Archive/2014/19/Using-the-ATA-security-features-of-modern-hard-disks-and-SSDs | Oliver Tennert, Using the ATA security features of modern hard disks and SSDs, 2014, Admin Magazine |
| REF-702 | reference_from_CAPEC | https://security.utexas.edu/education-outreach/BreakingATA | Breaking ATA Password Security, The University of Texas at Austin Information Security Office |
Not present
- Access to the system containing the ATA Drive so that the drive can be physically removed from the system.
Not present
Not present
Not present
- The A-FF Repair Station tool is a data recovery utility that can be used for ATA password removal (both High and Maximum level) and firmware area recovery. An adversary with access to this tool could reset the ATA password to bypass this security feature and unlock the hard drive. The adversary could then obtain any data contained within the drive. [REF-702]
- An adversary gains physical access to the targeted hard drive and installs it into a system that does not support ATA security features. Once the drive is installed in the feature-lacking system, the adversary is able to reset the hard drive password via the BIOS. As a result, the adversary is able to bypass ATA password security and access content on the drive.