Classifying Proprietary Firmware on a Solid State Drive Using Idle State Current Draw Measurements

Received December 22, 2019, accepted January 12, 2020, date of publication February 12, 2020, date of current version February 24, 2020.

Digital Object Identifier 10.1109/ACCESS.2020.2973605

T. OWENS WALKER, III 1, (Senior Member, IEEE), JUSTIN A. BLANCO 1, (Senior Member, IEEE), RYAN RAKVIC 1, ANN VANLEER1, DANE BROWN2, JAMES SHEY 1, GREGORY L. SINSLEY 1, HAU T. NGO1, AND ROBERT W. IVES1, (Senior Member, IEEE) 1Electrical and Computer Engineering Department, United States Naval Academy, Annapolis, MD 21402-5025, USA 2Cyber Science Department, United States Naval Academy, Annapolis, MD 21402-5025, USA Corresponding author: T. Owens Walker, III ([email protected])

ABSTRACT Solid state drives (SSDs) are coming under increased scrutiny as their popularity continues to grow. SSDs differ from their hard disk drive predecessors because they include an onboard layer of firmware to perform required maintenance tasks related to data location mapping, write performance, and drive lifetime management. This firmware layer is transparent to the user and can be difficult to characterize despite its clear potential to impact drive behavior. Flaws and vulnerabilities in this firmware layer have become increasingly common. In this work, we propose and analyze a technique to classify different versions of proprietary firmware on an SSD through the use of current draw measurements. We demonstrate that major groupings of firmware can be classified using current draw measurements not only from explicitly active drive states such as read and write but also from the low power idle state. We achieve pairwise classifications rates near 100% between firmware examples in these different major groupings. Coupling these results with firmware release information, we are able to infer major updates in the firmware timeline for the SSD we examined. We also develop an anomaly detector and achieve detection rates of 100% for samples that reside outside of the reference grouping.

INDEX TERMS Solid state drive, SSD, current draw, power consumption, ﬁrmware, security.

I. INTRODUCTION While bugs, vulnerabilities, and malware are nothing new Flaws and vulnerabilities continue to plague the growing in the cyber security field, they can be difficult to detect solid state drive (SSD) market. In 2009, Intel halted ship- when they reside in the firmware of a commercial SSD. Users ments on its X25M and X-18M SSDs due to the presence have little visibility on the functionality of this proprietary of a bug that corrupted user data [1] and researchers warned firmware that is needed to map logical memory to physical of vulnerabilities present in manufacturer supply chains [2]. flash memory and limit physical wear on the transistors. In 2013, KingFast inadvertently shipped a counterfeit SSD To expose these hidden vulnerabilities, our group has recently with fake NAND memory to a reviewer [3]. More recently demonstrated the use of current draw measurements to pro- in 2019, researchers found flaws in Crucial and Samsung vide insight into this functionality [6]–[9]. In the security con- SSDs that allow the encryption to be bypassed [4] and Intel text of malware detection, forensic analysis, and consumer was forced to release a patch to correct a privilege escalation protection, Shey et al. [6] developed an automatic classifier vulnerability in some of its enterprise SSDs [5]. capable of identifying the clearing of physical data locations while Brown et al. [7] has proposed the use of these measure- The associate editor coordinating the review of this manuscript and ments to detect firmware modification in open-source SSDs. approving it for publication was Leandros Maglaras . It has also been shown that current draw measurements can

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see http://creativecommons.org/licenses/by/4.0/ VOLUME 8, 2020 31869 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

be used to infer the resident file system type [8] as well as the overcome by Meijer and Gastel who demonstrated the ability presence of read and write operations [9]. to compromise proprietary, closed-source firmware on both Leveraging this prior work on side-channel current draw Crucial and Samsung SSDs using techniques that included analysis, the primary contributions of this article are as physical access and code injection [4]. In other related work, follows: the firmware of SSDs has also been modified to detect and 1) Demonstrates a technique for classifying firmware recover from ransomware attacks [12]. Our work builds on revisions in a family of proprietary firmware versions these vulnerability studies by proposing and analyzing a tech- on a commercial solid state drive using non-intrusive nique to assist investigators in distinguishing between differ- current draw measurements. ent versions of firmware that may be resident on a commercial 2) Demonstrates the use of this classification technique SSD. This would be particularly useful in scenarios in which coupled with firmware release information to infer the resident firmware is not known or the SSD is suspected major firmware revisions in the examined firmware to have been tampered with. timeline. Power-related measurements including current draw and 3) Demonstrates that classification can be accomplished associated side-channel attacks have been used extensively using current draw measurements not only from explic- in the context of both security and performance. Of note, itly active drive states (i.e., read and write) but also power analysis has been used to characterize as well as disas- from the low power idle state. semble processor instructions [13], [14], detect malware on 4) Develops an anomaly detector designed to identify programmable logic controllers [15], and classify attacks on firmware versions that differ from a reference firmware a Raspberry Pi [16]. It has also been used as part of larger or firmware grouping. side-channel analysis-based toolboxes such as SASEBO [17] and RamDPA [18]. In direct application to SSDs, current To our knowledge, this is the first examination of side channel draw measurements have been used to characterize write leakage for a family of proprietary firmware versions using performance on the Intel X25M and the Samsung MXP SSD power-related metrics and the first work to perform classifi- families [19]. cation based solely on idle state current draw measurements. The work presented here follows a recent string of advance- In practical application, the techniques provided here would ments in the use of current draw to infer SSD operations and allow a researcher or security analyst to infer whether or characterize SSD parameters. Current draw measurements not the firmware installed on the SSD was a member of have been used to infer TRIM operations [6] as well as the reference firmware grouping without the need to reverse read and write operations [9]. They have also been used engineer it. to characterize the file system in use on the SSD [20] and This article is organized as follows. Related work is dis- the encryption algorithm present [21]. Most recently, current cussed in SectionII while Section III details the relevant draw measurements have been proposed to detect modifica- firmware versions and identifies the four observed modes tions of firmware on an open-source SSD [7]. While this work of operation for the firmware. The experimental setup is evolved from these earlier findings, it is the first to demon- described in SectionIV and the accompanying analysis is strate the ability to characterize SSDs using the low power presented in Section V. Section VI presents the results and idle state and it is the first to classify a family of proprietary, the article finishes with conclusions and future work in closed-source firmware versions on a commercial, off-the- Section VII. shelf SSD. This article builds upon a set of initial findings presented II. RELATED WORK in [22]. This earlier work demonstrated the ability to distin- As their popularity grows, the security of SSDs has come guish between two firmware versions using read and write under increased scrutiny by researchers in the past several operations on files of different sizes. In the current work, several years. In this section, we review the relevant exist- we have demonstrated the ability to classify firmware ver- ing literature. We begin with a brief discussion of other sions using the idle state only and have extended the analysis firmware-focused security research being conducted on SSDs to the family of firmware versions available for the SSD under and then provide a discussion of power-related side channel examination. This has led to important insights, particularly analysis both as it relates to computer systems and processors in terms of recognizing major updates within this examined in general as well as SSDs specifically. firmware family. We also assess the potential effectiveness of Like their hard disk drive predecessors [10], the firmware an anomaly detector based on this technique. on SSDs is vulnerable to compromise regardless of whether it is open- or closed-source. Representative of the former, III. FIRMWARE SPECIFICATIONS AND Bogaard and Bruijn demonstrated the feasibility of insert- OPERATING MODES ing a functioning backdoor into open-source SSD firmware The Crucial m4 SSD, released in 2011, was selected for [11] but recognized that this would be significantly more this work because a substantial number of firmware release difficult on proprietary firmware where access was restricted versions are publicly available for it and the associated by the manufacturer. This latter challenge has recently been firmware upgrade utility provides the ability to both upgrade

31870 VOLUME 8, 2020 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

and downgrade the firmware. (Specifications for the Crucial TABLE 2. Host computer specifications and configuration. m4 SSD utilized in this work are provided in Table1.) In this section, we provide an overview of the firmware versions available for the Crucial m4 and discuss the four observed operating modes.

A. FIRMWARE SPECIFICATIONS Seven ﬁrmware revisions have been released for the Cru- cial m4 SSD: 0002 on 8 June 2011 [23], 0009 on 25 August 2011 [23], 0309 on 13 January 2012 [24], [25], 000F on 5 April 2012 [26], [27], 010G on 25 September 2012 [28],

[29], 040H on 4 December 2012 [30], [31], and 070H on TABLE 3. Current probe specifications. 2 April 2013 [32], [33]. This firmware timeline is summarized in Fig.1. We have also indicated the Windows 8 release date in this figure because, as will be seen later in this work, there is a clear delineation before and after Windows 8 enhancements were introduced in firmware version 010G.

TABLE 1. Crucial m4 SSD specifications.

TABLE 4. Data recorder specifications and configuration.

largely addressed performance-related issues associated with power-up and recovery. FIGURE 1. Firmware version timeline for the Crucial m4 solid state drive. Additional details for each of the seven firmware versions are included in the Appendix. The first two firmware updates (0002 and 0009) were released prior to a subsequent fix in update 0309 that cor- B. OBSERVED MODES OF OPERATION rected a ‘‘blue screen of death’’ error that occurred after In this work, four distinct modes of SSD operation were 5,184 hours of ‘‘on time’’ [34]. We begin our work with observed and investigated: (1) an off state, (2) a low power version 0309. Version 000F followed 0309 and introduced idle state, (3) a read state, and (4) a write state. The off some modest performance improvements. state is essentially defined as the state in which no current Version 010G represented an important milestone in the draw from the SSD is present. In practice, it was observed update history of the m4 firmware family as it was the that this off state can be entered by either turning the host first update to provide a number of performance enhance- computer off or putting the host computer in its low power ments targeted specifically at Windows 8 systems. These sleep state. For the results presented in this work, the off state improvements were apparently based on Windows 8 pre- was entered by putting the host computer to sleep. The read release versions made available to Crucial as the official state or write state are entered by issuing read or write file version of the new operating system was released about a commands through the operating system, respectively, from month after firmware version 010G (as shown in Fig. 1). the host computer. We define the idle state as the state in Firmware versions 040H and 070H (the latter is the cur- which the SSD is not in one of the other three states (off, read, rent version of the firmware) followed shortly afterward and or write). This is consistent with literature from Crucial which

VOLUME 8, 2020 31871 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 2. Testbed used to collect current draw measurements from the Crucial m4 SSD. also notes that housekeeping tasks such as trim and garbage To collect the idle state data, the appropriate firmware was collection occur in the idle state [35]. installed and the computer rebooted, as before. After start-up was complete, the idle state was visually verified on the data recorder and and then 7 seconds of data were recorded. Idle IV. EXPERIMENTAL SETUP data files were approximately 55 MB in size. A. EQUIPMENT The read and write samples were collected based on The testbed for this work is comprised of a host computer, the techniques and accompanying Python script developed a current probe with accompanying amplifier, a data recorder, in [22]. For the write data, a set of files containing random and the SSD under test. The specifications for the host com- data were generated and written to the SSD. Triggers from the puter, the current probe, and the data recorder are provided host computer to the data recorder were used to start and stop in Tables2, 3, and 4, respectively. The testbed setup is shown the data recording before and after the write operation. The in Fig. 2. A current probe was selected as the primary mea- read samples were similarly collected by reading randomly surement device because it has been demonstrated to be as populated files that had been previously written to the SSD. effective as an intrusive, in-line resistor installation in related In both cases, the computer’s main cache was cleared between applications [6]. each collection. Read and write data files varied in size but were typically 150 MB ± 30 MB. Associated collection times B. DATA COLLECTION were approximately 20 to 30 seconds. In this subsection, we discuss the data collection techniques Representative time domain and spectral plots are provided used to gather current draw data on the SSD in each of the for each operating state in Fig. 3. These plots illustrate the four operating states: idle, off, read, and write. In all cases, typical ‘‘signature’’ for each operating state. While it is clear the current probe was attached to the 5V SATA power line and from Fig. 3 that all four operating states differ significantly the Gen3i Data Recorder was used to collect samples at a rate from each other in both the time and frequency domains, it is of 200 kSamples/sec (as noted in Table 4). The accompanying important to note that there is also some variability between Perception software suite was used to configure the Gen3i samples within the same operating state. This can be seen as well as convert and save the data in MATLAB readable in Fig. 4 which plots ten individual samples of each operating *.mat files. In each operating state, ten files were collected for state in the time domain (for firmware version 070H). These each firmware version based on a predetermined, randomly- differences will also be reflected in the corresponding spectral generated, collection order. Firmware versions were manu- plots. ally installed using the Firmware Update Guides provided by We can compare the current draw among the four states Crucial [25], [27], [29], [31], [33]. in Fig. 5 which plots root mean square (RMS) amplitudes The off state data were collected as follows. The appropri- as a function of firmware version for each state. These RMS ate firmware was installed onto the SSD and the host com- amplitudes for each of the four distinct modes of SSD oper- puter was rebooted. After start-up and login was complete, ation were calculated from a 2.5 second segment during the computer was put into sleep mode. The off state was the operational state for each recorded file. The ‘‘active’’ visually verified using the data recorder and then 7 seconds of nature of the read and write states can be clearly seen when data were recorded. Off data files were approximately 55 MB contrasted with the low power idle state with an amplitude in size. of less than half that of the active states. Variability among

31872 VOLUME 8, 2020 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 3. Representative time domain (left) and spectrogram (right) plots for the read, write, idle, and off SSD states, respectively (top to bottom). Data are from firmware version 070H (Values smaller than −115 dB in the spectrogram plots are thresholded to −115 dB to facilitate visualization by improving image contrast.). the different firmware versions for each individual operating Each 100 ms observation was transformed to the frequency state can also be seen in Fig. 5. This variability in RMS domain using Welch’s modified periodogram method [36] amplitudes will also manifest itself in the frequency domain (40 ms Hamming-windowed sub-segments with 20 ms of and will be captured in the frequency domain analysis and overlap; 8192-point discrete Fourier transforms) to estimate results presented in the remainder of this work. the power spectral density (PSD). The PSD estimate was integrated in non-overlapping frequency bins of 400 Hz width, spanning 0 to 100 kHz, and converted to the decibel scale, V. ANALYSIS yielding a 1 × 250 feature vector for each 40 ms observation. In this section, we discuss the analysis techniques we employ on the data collected during this work. The section opens by describing the features of the SSD current draw signal that B. CLASSIFICATION EXPERIMENTS are used to distinguish between firmware version groupings For each of the four SSD operating states (read, write, idle, and closes with a discussion of the classification algorithms and off), we conducted two sets of classification experiments. utilized. In the first set, we trained binary classifiers to discriminate between all 10 (5 choose 2) possible pairs of firmwares. In the second set, we trained classifiers to discriminate A. FREQUENCY DOMAIN FEATURE GENERATION between two firmware groupings {0309, 000F} and {010G, For each file, 40 raw observations were extracted by divid- 040H, 070H}. In all experiments, we compared the accu- ing seconds 2-6 of the recorded SSD current into 100 ms racies of three different supervised learning methods. The non-overlapping segments. Since the assumed current draw first method was logistic regression (LR), in which a linear signatures characterizing each drive state were not always class boundary is learned by assuming sigmoid models for present during the entire recording period (see e.g., Fig. 4b), the posterior probabilities of the classes and finding the model a fixed analysis window was used to eliminate the need to parameters that maximize the conditional likelihood function develop state-dependent current signature detectors prior to [37]. The second method was quadratic discriminant analysis feature extraction. The particular 4s window we used was (QDA) [37], which is capable of learning a curved class chosen after examining one held out recording from each boundary (a quadratic surface). In this method, test observa- of the four drive states, as a compromise that balanced the tions are assigned to the class with largest posterior probabil- desire for a large statistical sample against computation time ity assuming Gaussian class-conditional densities, and model for model training and testing while simultaneously capturing parameters are estimated via maximum likelihood. The third characteristic time-domain activity for each state. method of classification was the k nearest neighbors (k-NN)

VOLUME 8, 2020 31873 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 4. Ten individual samples of each operating state in the time domain (for firmware version 070H). algorithm [37], an in general still more flexible nonlinear dimensionality of the feature set. Specifically, we retained classifier that assigns class labels to test points according to the minimum number of principal components required to a plurality vote among the closest training points in feature account for at least 90% of the data variance. The reduced space. For k-NN, we used Euclidean distance as the measure feature set was used in training, and test data were mapped of proximity and 3 as the number of neighbors (k = 3). These to the principal component space of the training data before three classification approaches were selected because they are they were classified. representative state-of-the practice methods [37] that span the spectrum of model flexibility from linear methods with poten- VI. RESULTS tially high bias but low variance to highly non-linear methods This section presents the current draw-based classification with potentially low bias but high variance, and hence provide results for the proprietary firmware released for the Cru- an opportunity to optimize this tradeoff over the considered cial m4 SSD. It begins by examining pairwise classification models to improve generalization performance. results across the five firmware versions from which two Test set accuracy was estimated using 10-fold (for experi- distinct groupings can be seen to emerge. The first grouping ment set 1) or 20-fold (for experiment set 2), leave-one-file- includes firmware versions 0309 and 000F while the second set out cross validation, as described in [6]. In experiment 2, grouping includes firmware versions 010G, 040H, and 070H. this was achieved by using the 20 available files for the As noted in the firmware version discussion in Section III, first firmware grouping (10 from 0309 and 10 from 000F) these groupings point to the major firmware update 010G in conjunction with a randomly selected 7, 7, and 6 files, that introduced Windows 8 performance enhancements to the respectively, from firmwares 040H, 070H, and 010G, to give firmware family and pairwise classification based on these a total of 20 files in the second firmware grouping. Prior groupings is presented. We then demonstrate that it is possible to classifier training, inside the cross-validation loop, prin- to build an anomaly detector for applications in which trusted cipal components analysis (PCA) was applied to reduce the examples are available from a reference firmware group and

31874 VOLUME 8, 2020 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 5. RMS amplitudes as a function of firmware version for each operating state.

we confirm that the anomaly detector exhibits the behavior B. PAIRWISE CLASSIFICATION BY FIRMWARE that would be expected based on our binary classification GROUPINGS results. The section concludes by comparing classification Fig. 9 shows the result of a post-hoc analysis in which performance based on measurements taken in the idle state we group the firmware into two major groups based on to those taken in the read, write, and off states. whether they were released before or after the Windows 8 enhancements were introduced in 010G. It can be seen that, as expected, classifying across groups yields a classification A. PAIRWISE CLASSIFICATION BY INDIVIDUAL FIRMWARE rate of 100% while classifying within a group is much closer This section presents the pairwise classification results for to chance. all five firmware versions. For comparison, a baseline no information classifier (null) result is provided in each case by randomly permuting the data set labels. Error bars of +/− C. IDENTIFYING MAJOR UPDATES IN THE two standard errors are included to provide an approximate FIRMWARE FAMILY 95% confidence interval around the mean classification accu- The results of the previous section provide important insight racy over cross-validation folds. As can be see in Figs. 6 into the manufacturer-provided, closed-source firmware revi- and 7, all three classifiers (logistic regression (LR), quadratic sion timeline. In the case examined here, it appears from discriminant analysis (QDA), and 3-nearest neighbors Fig. 8 that firmware version 010G potentially represents (3-NN)) perform similarly across all pairwise sets. a major update in the Crucial m4 firmware family. This In Fig. 6, it can be seen that the classification is near conclusion arises from the ability to distinguish firmware 100% for all firmware pairs that span across the two firmware version pairs that cross this major update boundary (i.e., groupings (e.g., {0309, 000F} and {010G, 040H, 070H}). 0309 vs. 040H and 000F vs. 010G) but not pairs that are However, in Fig. 7, we see that classification is close to strictly on one side or the other of the update boundary chance when we try to distinguish between firmware versions (i.e., 0309 vs. 000F and 010G vs. 070H). We can investigate within the same grouping. These pairwise results are summa- this conclusion further by examining the firmware updates rized in Fig. 8 for the QDA classifier in which the dividing in more detail. Referencing the revision notes provided by line between the two firmware groupings can be clearly seen. Crucial and discussed in Section III, version 010G is the first While not shown, similar plots can also be generated for the firmware version to introduce performance enhancements LR and 3-NN classifiers. specifically targeted at the Windows 8 operating system.

VOLUME 8, 2020 31875 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 6. Pairwise classification results across the firmware groupings using idle state collection.

In addition, Fig. 10 plots the size of the firmware image for Given that major firmware updates, which typically result each of the different firmware versions. It can be clearly seen in additional code, are often synchronized with new oper- that there is a significant increase in firmware image size ating system releases, this aligns with our findings based between 000F and 010G while 000F and 0309 (before the on the current measurements and indicate that firmware major update) and 010G, 040H, and 070H (after the major version 010G represents a major update in the firmware update) are relatively close in size to each other, respectively. timeline.

31876 VOLUME 8, 2020 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 7. Pairwise classification results within the firmware groupings using idle state collection.

FIGURE 8. Summary of pairwise binary comparison results for the QDA classifier in the idle state. The firmware boundary can be seen clearly FIGURE 9. Idle state classification results between the two major between firmware versions 000F and 010G. firmware groupings (e.g. {0309, 000F} vs. {010G, 040H, 070H}).

D. ANOMALY DETECTION how they were generated. In addition to the binary classi- In this section, we demonstrate that we can design an anomaly ﬁcation experiments described in Section V-B, for the idle detector and conﬁrm that it behaves as expected. Before state, we also trained Gaussian kernel one-class support vec- presenting and discussing our results, we begin by describing tor machines [38] for use as anomaly detectors. We used

VOLUME 8, 2020 31877 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

FIGURE 10. Firmware image size as a function of firmware version for the FIGURE 11. Pairwise classification results for the major firmware Crucial m4 firmware update family. groupings (i.e., {0309, 000F} vs. {010G, 040H, 070H}) for all three classifiers as a function of SSD operating state.

TABLE 5. Anomaly detection rates across individual firmware pairs. Dashed lines delineate the boundary between the two firmware firmware grouping in Table6 are high. These results sug- groupings. gest that, for example, a firmware anomaly detector can be successfully constructed provided the investigator is inter- ested in detecting the presence of firmware versions that pre-date a certain version that represents a major milestone in the firmware update sequence (in our case, firmware version 010G).

E. COMPARING CLASSIFICATION PERFORMANCE ACROSS SSD OPERATING STATES This section provides a comparison of classification rates using the four different identified operating states: read, TABLE 6. Anomaly detection rates across firmware groupings. write, idle, and off. The significant finding here is that classification can be accomplished using not only the active read and write states but also the low power idle state, as seen in Fig. 11. In this figure, classification rates based on data collected at idle are commensurate with classification rates in the two active states, read and write (at or near 100%). Unsurprisingly, classification rates are near chance when the SSD is in the off state and little to no current is flowing to it. an analytical framework that paralleled that described in Section V-B, with the following two differences: 1) when VII. CONCLUSION comparing any two groups, since one was treated as the In this paper, we characterized four SSD operating states reference group and the other as the anomalous (test) group, and demonstrated the ability to distinguish between major each pair of groups yielded two (asymmetric) comparisons; firmware groupings within the same proprietary firmware and 2) because the reference group in each experiment was family using current draw measurements in the low power constructed using all of the available training data for that idle state only. We achieved pairwise classification rates group, instead of using cross-validation, we used the propor- near 100% between firmware versions in different groupings tion of test observations correctly labeled as anomalies as the which led to the ability to infer major updates in the firmware performance metric. version timeline. We also developed an associated anomaly Anomaly detection both by individual firmware and by detector and demonstrated anomaly detection rates of 100% major firmware grouping follow as expected from our for firmware samples outside the reference grouping. pairwise classification results in Sections VI-A and VI-B. Follow-on work could potentially examine the accuracy As shown in Table 5, detection rates at or near 100% are of this approach across other manufacturer SSD firmware achieved when the firmware pair crosses the major version families or other memory technologies. The latter could update (as discussed in the previous section) while the results include non-volatile novel memory technologies such as are much poorer when the pair does not cross this major Intel’s phase change memory [39]. The use of other classi- update boundary. Similarly, the anomaly detection rates by fication techniques as well as complex operations involving

31878 VOLUME 8, 2020 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

both reads and writes could also be explored to improve clas- Compatibility with SAS expanders and RAID cards was sification accuracy, particularly within the major firmware subsequently improved with update 000F [26], [27] which groupings. was released in April 2012. Modest performance gains were Another natural follow-on would be an investigation of realized by improving throughput stability in heavy load modified firmware. This could include manufacturer pro- scenarios and the update also improved data protection in the vided firmware versions that have been altered using the event of a power loss. findings of [4] or malware versions found in the ‘‘wild.’’ Firmware update 010G [28], [29] represented an impor- The modification of open-source SSD firmware or the tant milestone as it was the first firmware update to include reverse-engineering of proprietary firmware also provide modifications specifically targeting Windows 8 platforms. avenues for additional work as they could be used to further These Windows 8 improvements reduced trim time by more probe the nature of the detectable differences between various than 50% and some users reported seeing a reduction in firmware versions. file delete times [42]. Other Windows 8 changes reduced power-on times from cold start and resume times from low power (sleep) modes. In addition to these Windows APPENDIX 8 enhancements, the update also included power consumption ADDITIONAL DETAILS OF FIRMWARE SPECIFICATIONS improvements for some notebook computers. It is worth not- As noted in Section III and summarized in Fig.1, seven ing that a number of users reported that the host system was no firmware updates have been released for the Crucial m4 SSD. longer able to recognize the SSD following the update [43]. While the work presented here focused on the latter five The next update, firmware version 040H [30], [31], was updates, all seven are discussed in detail in this appendix. released in December 2012 and improved wear leveling algo- The first update to the baseline firmware (0001) rithms. It also provided better recovery from unexpected included with the Crucial m4 SSD was 0002 released on power losses, corrected reporting errors in the SMART Drive 8 June 2011 [23]. This update provided additional margin Self Test, and improved the firmware update process for for electromagnetic interference regulatory tests and perfor- Windows 8. mance improvements with Link Power Management (LPM) Finally, the current firmware version for the Crucial m4 is enabled. The latter was designed to alleviate pauses and hes- 070H [32], [33], released in April 2013. Recommended for itations that were being experienced with some host systems. anyone using earlier firmware releases, it resolved a timing While this update was optional, it was highly recommended issue that could result in the host system hanging during for users experiencing performance issues with LPM enabled. power-up or resuming from sleep. At the time of release, The second firmware update was 0009 on 25 August 2011 Crucial considered this precautionary as no related failures [23]. It provided a number of improvements including had been reported by users. (directly from [23]): • Improved throughput performance, REFERENCES • Increase in PCMark Vantage benchmark score, resulting [1] L. Mearian, ‘‘Intel confirms data corruption bug in new SSDs, halts shipments,’’ Computerworld, Aug. 2009. [Online]. Available: in improved user experience in most operating systems, https://www.computerworld.com/article/2526707/intelconfirms-data- • Improved write latency for better performance under corruption-bug-in-new-ssds–halts-shipments.html heavy write workloads, [2] A. P. Barroso, V. H. Machado, and V. Cruz Machado, ‘‘Identifying vulnerabilities in the supply chain,’’ in Proc. IEEE Int. Conf. Ind. Eng. Eng. • Faster boot up times, Manage., Dec. 2009, pp. 1444–1448. • Improved compatibility with latest chipsets, [3] L. Tokar, ‘‘Kingfast unknowingly sends counterfeit SSD with fake memory • Compensation for SATA speed negotiation issues for review,’’ SSD Rev., Feb. 2013. [Online]. Available: http://www. thessdreview.com/daily-news/latest-buzz/manufacturershipped-review- between some SATA-II chipsets and the SATA-III sample-ssd-contains-fake-nand-flash-memory/ device, and [4] C. Meijer and B. Van Gastel, ‘‘Self-encrypting deception: Weaknesses in • Improvement for intermittent failures in cold boot up the encryption of solid state drives,’’ in Proc. IEEE Symp. Secur. Privacy related to some specific host systems. (SP), May 2019, pp. 72–87. [5] J. E. Dunn. (Jul. 2019). Intel patches SSD firmware and microprocessor This update received substantial news coverage as it increased diagnostic tool. Naked Security by SOPHOS. [Online]. Available: https://nakedsecurity.sophos.com/2019/07/11/intel-patches-ssd-firmware- the read speed of the drive by as much as 20% and introduced and-microprocessor-diagnostic-tool/ marginal improvements in write speed as well [40], [41]. [6] J. Shey, J. A. Blanco, O. Walker, T. W. Tedesso, H. T. Ngo, R. Rakvic, and Firmware update 0309 [24], [25] is the first of the five K. D. Fairbanks, ‘‘Monitoring device current to characterize trim operations of solid-state drives,’’ IEEE Trans. Inf. Forensics Security, vol. 14, updates examined in this work. It was released on 13 Jan- no. 5, pp. 1296–1306, May 2019. uary 2012 and fixed a critical drive error that caused a Blue [7] D. Brown, O. Walker, R. Rakvic, R. W. Ives, H. Ngo, J. Shey, and J. Blanco, Screen of Death (BSOD) after 5,184 hours of ‘‘on time’’ [34]. ‘‘Towards detection of modified firmware on solid state drives via side channel analysis,’’ in Proc. Int. Symp. Memory Syst. (MEMSYS), New York, The reoccurring failure (every hour after initial occurrence) NY, USA, 2018, pp. 315–320, doi: 10.1145/3240302.3285860. was due to an incorrect response to a SMART counter. While [8] J. Melton, R. Rakvic, J. Shey, H. Ngo, O. Walker, J. Blanco, D. Brown, the update was strongly recommended for most users, it was L. Mcdowell, and K. D. Fairbanks, ‘‘Inferring File System of Solid State Drives based on Current Consumption,’’ in Proc. IEEE 7th Annu. Int. incompatible with SAS expanders. The failure did not com- Conf. CYBER Technol. Autom., Control, Intell. Syst. (CYBER), Jul. 2017, promise user data on the drive. pp. 72–76.

VOLUME 8, 2020 31879 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

[9] J. Canclini, J. Mcmasters, J. Shey, O. Walker, R. Rakvic, H. Ngo, and [27] Crucial. (2012). Firmware Update Guide, Revision 000F. [Online]. Avail- K. D. Fairbanks, ‘‘Inferring read and write operations of solid-state drives able: https://web.archive.org/web/20141118124831/http://edge.crucial. based on energy consumption,’’ in Proc. IEEE 7th Annu. Ubiquitous Com- com:80/firmware/m4/000F/ProductFlyer-letter_m4-firmware000F_04- put., Electron. Mobile Commun. Conf. (UEMCON), Oct. 2016, pp. 1–6. 12.pdf [10] J. Zaddach, A. Kurmus, D. Balzarotti, E.-O. Blass, A. Francillon, [28] Crucial. (2012). Firmware Update 010G. [Online]. Available: T. Goodspeed, M. Gupta, and I. Koltsidas, ‘‘Implementation and implica- https://web.archive.org/web/20121101114039/http://edge.crucial.com/ tions of a stealth hard-drive backdoor,’’ in Proc. 29th Annu. Comput. Secur. firmware/m4/010G/crucial-m4-010G-01-00.zip Appl. Conf., 2013, pp. 279–288. [29] Crucial. (2012). Firmware Update Guide, Revision 010G. [Online]. Avail- [11] M. Bogaard and Y. de Bruijn, ‘‘The evil SSD project: When your stor- able: https://web.archive.org/web/20121020233648/http://edge.crucial. age has a mind of its own,’’ Dept. Syst. Netw. Eng., Univ. Amsterdam, com:80/firmware/m4/010G/CrucialFirmware_m42-5_010G.pdf The Netherlands, Tech. Rep. 5, 2015. [30] Crucial. (2012). Firmware Update 040H. [Online]. Available: [12] S. Baek, Y. Jung, A. Mohaisen, S. Lee, and D. Nyang, ‘‘SSD-insider: https://web.archive.org/web/20130516110842/http://edge.crucial. Internal defense of solid-state drive against ransomware with perfect data com/firmware/m4/040H/Crucial_m4_040H-04-00.zip recovery,’’ in Proc. IEEE 38th Int. Conf. Distrib. Comput. Syst. (ICDCS), [31] Crucial. (2012). Firmware Update Guide, Revision 040H. [Online]. Avail- Jul. 2018, pp. 875–884. able: https://web.archive.org/web/20121224120406/http://edge.crucial. com:80/firmware/m4/040H/Crucial_m4_Firmware_Update_040H.pdf [13] M. Wendt, M. Grumer, C. Steger, R. Weib, U. Neffe, and A. Muhlberger, [32] Crucial. (2013). Firmware Update 070H. [Online]. Available: https:// ‘‘Energy consumption measurement technique for automatic instruction www.crucial.com/usa/en/support-ssd-m4-25-inch set characterization of embedded processors,’’ in Proc. IEEE Instrum. [33] Crucial. (2013). Firmware Update Guide, Revision 070H. [Online]. Avail- Meas. Technol. Conf. (IMTC), May 2007, pp. 1–4. able: https://www.crucial.com/wcsstore/CrucialSAS/firmware/m4/070H/ [14] D. Strobel, F. Bache, D. Oswald, F. Schellenberg, and C. Paar, ‘‘SCAN- crucial-m4-firmware-update-070h-en.pdf DALee: A side-channel-based DisAssembLer using local electromagnetic [34] J. Parish, ‘‘Crucial m4 SSD firmware update fixes recurring BSOD,’’ emanations,’’ in Proc. Design, Autom. Test Eur. Conf. Exhib. (DATE), Verge, Jan. 2012. [Online]. Available: https://www.theverge.com/2012/1/ Mar. 2015, pp. 139–144. 17/2713178/crucial-m4-ssd-firmware-update-fixes-recurring-bsod [15] C. A. Gonzalez and A. Hinton, ‘‘Detecting malicious software execution [35] My SSD Used To Be So Much Faster But Has Recently Slowed Down. What in programmable logic controllers using power fingerprinting,’’ in Proc. Happened?. [Online]. Available: https://www.crucial.com/usa/en/ssd- Int. Conf. Crit. Infrastruct. Protection. Berlin, Germany: Springer, 2014, used-to-be-faster-but-has-slowed-down pp. 15–27. [36] P. Welch, ‘‘The use of fast Fourier transform for the estimation of power [16] Y. Shi, F. Li, W. Song, X.-Y. Li, and J. Ye, ‘‘Energy audition based cyber- spectra: A method based on time averaging over short, modified peri- physical attack detection system in IoT,’’ in Proc. ACM Turing Celebration odograms,’’ IEEE Trans. Audio Electroacoust., vol. 15, no. 2, pp. 70–73, Conf.-China (ACM TURC), New York, NY, USA, 2019, pp. 27:1–27:5, Jun. 1967. doi: 10.1145/3321408.3321588. [37] T. Hastie, R. Tibshirani, and J. Friedman, The Elements of Statistical [17] T. Katashita, Y. Hori, H. Sakane, and A. Satoh. (2011). Side-Channel Learning: Data Mining, Inference, and Prediction. Springer, 2009. Attack Standard Evaluation Board SASEBO-W for Smartcard Testing. [38] B. Schölkopf, J. C. Platt, J. C. Shawe-Taylor, A. J. Smola, and [Online]. Available: https://www.semanticscholar.org/paper/Side- R. C. Williamson, ‘‘Estimating the support of a high-dimensional dis- Channel-Attack-Standard-Evaluation-Board-for-Katashita-Hori/ tribution,’’ Neural Comput., vol. 13, no. 7, pp. 1443–1471, Jul. 2001, b0820057ac44f812a2b767f880f0ddf075c9c9b4 doi: 10.1162/089976601750264965. [18] A. F. Rodriguez, L. H. Encinas, A. M. Muñoz, and B. A. Alcazar, ‘‘A mod- [39] S. W. Fong, C. M. Neumann, and H.-S. P. Wong, ‘‘Phase-change ular and optimized toolbox for side-channel analysis,’’ IEEE Access, memory-towards a storage-class memory,’’ IEEE Trans. Electron Devices, vol. 7, pp. 21889–21903, 2019. [Online]. Available: http://www.ieee.org/ vol. 64, no. 11, pp. 4374–4385, Nov. 2017. [Online]. Available: publications_standards/publications/rights/index.htmlhttps://ieeexplore. http://ieeexplore.ieee.org/document/8048346/ ieee.org/document/8636501/ [40] L. Tokar, ‘‘Crucial M4 SSD firmware update (0009) posted—Tests display [19] B. Yoo, Y. Won, J. Choi, S. Yoon, S. Cho, and S. Kang, ‘‘SSD characteri- definite performance increase,’’ SSD Rev., Aug. 2011. [Online]. Available: zation: From energy consumption’s perspective,’’ in Proc. USENIX Conf. http://www.thessdreview.com/daily-news/latest-buzz/crucial-m4-ssd- Hot Topics Storage File Syst. (HotStorage), Portland, OR, USA, 2011, p. 3. firmware-update-0009-posted-tests-display-definite-performance- increase/ [20] J. Melton, R. Rakvic, J. Shey, H. Ngo, O. Walker, J. Blanco, D. Brown, [41] S. Qureshi, ‘‘Crucial m4 0009 firmware update increases SSD speeds by L. Mcdowell, and K. D. Fairbanks, ‘‘Inferring file system of solid state 20%,’’ Wcchtech, Aug. 2011. [Online]. Available: https://wccftech.com/ drives based on current consumption,’’ in Proc. IEEE 7th Annu. Int. crucial-m4-0009-firmware-update-increases-speeds-20/ Conf. CYBER Technol. Autom., Control, Intell. Syst. (CYBER), Jul. 2017, [42] (2012). Tom’s Hardware (Forums): Crucial m4 Firmware 010G. pp. 72–76. [Online]. Available: https://forums.tomshardware.com/threads/crucial- [21] R. S. Mcdowell, H. Ngo, R. Rakvic, O. Walker, R. W. Ives, and D. Brown, m4-firmware-010g.653952/ ‘‘Using current draw analysis to identify suspicious firmware behavior in [43] H. Hagedoorn, ‘‘What’s wrong with the Crucial m4 010G firmware solid state drives,’’ in Proc. IEEE Int. Conf. Comput. Sci. Eng. (CSE) IEEE and why hasn’t it been fixed?’’ Guru 3D, Oct. 2012. [Online]. Avail- Int. Conf. Embedded Ubiquitous Comput. (EUC), Aug. 2019, pp. 92–97. able: https://www.guru3d.com/news-story/whats-wrong-with-the-crucial- [22] Z. Johnson, A. Varon, J. Blanco, R. Rakvic, J. Shey, H. Ngo, D. Brown, m4-010g-firmware-and-why-hasnt-it-been-fixed.html and O. Walker, ‘‘Classifying solid state drive firmware via side-channel current draw analysis,’’ in Proc. IEEE 16th Int. Conf Dependable, Autonomic Secur. Comput., 16th Int. Conf Pervasive Intell. Comput., 4th Int. Conf Big Data Intell. Comput. Cyber Sci. Technol. Congr. (DASC/PiCom/DataCom/CyberSciTech), Aug. 2018, pp. 943–948. T. OWENS WALKER, III (Senior Member, IEEE) [23] Crucial. (2011). Firmware Updates 0002 and 0009. [Online]. Available: received the B.S. degree in electrical engineering https://web.archive.org/web/20110830134546/http://www.crucial. from Cornell University, in 1987, and the M.S. com/support/firmware.aspx and Ph.D. degrees in electrical engineering from [24] Crucial. (2012). Firmware Update 0309. [Online]. Available: the Naval Postgraduate School, Monterey, CA, https://web.archive.org/web/20120902074731/http://edge.crucial.com/ USA, in 1995 and 2009, respectively. He is cur- firmware/m4/0309/Crucialm4_0309.zip rently an Assistant Professor with the Electrical [25] Crucial. (2012). Firmware Update Guide, Revision 0309. [Online]. Avail- and Computer Engineering Department, United able: https://web.archive.org/web/20120131015811/http://edge.crucial. States Naval Academy. He has been instrumental com:80/firmware/m4/0309/ProductFlyer-letter_m4-firmware0309_01- in the development of networking and cybersecu- 12.pdf rity course offerings at the Naval Academy, and he leads the Computer [26] Crucial. (2012). Firmware Update 000F. [Online]. Available: Engineering and Cyber Security Research Team. His research interests https://web.archive.org/web/20120428203837/http://edge.crucial.com/ include wireless networking, wireless security, computer security, as well firmware/m4/000F/Crucialm4_000F.zip as light-based communications. He is a member of the Eta Kappa Nu.

31880 VOLUME 8, 2020 T. O. Walker et al.: Classifying Proprietary Firmware on a SSD Using Idle State Current Draw Measurements

JUSTIN A. BLANCO (Senior Member, IEEE) JAMES SHEY received the B.S. degree in elec- received the Sc.B. degree in neuroscience from trical engineering from the U.S. Naval Academy, Brown University, in 1999, the M.S. degree in in 2003, the M.S. degree in electrical engineer- mechanical engineering from Stanford University, ing from the University of Maryland, College in 2003, and the Ph.D. degree in bioengineer- Park, MA, USA, in 2008, and the MEM from ing from the University of Pennsylvania, in 2010. Old Dominion University, in 2008. He is cur- He was a Postdoctoral Research Associate at the rently pursuing the Ph.D. degree with the Univer- Translational Neuroengineering Laboratory, Uni- sity of Maryland, Baltimore County, MA. He was versity of Pennsylvania, from 2010 to 2011, before an Instructor at the U.S. Naval Academy, from joining the faculty at the United States Naval 2008 to 2010, and resumed these duties, in 2015. Academy, in 2011. Prior to his doctoral studies, he has served on the faculty Between these time periods, he has served in various assignments, both at Deerfield Academy, Deerfield, MA, USA, and was a Design Engineer at ashore and afloat as a Submarine Warfare Officer, trained in naval Medtronic. He is currently an Associate Professor with the Department of nuclear propulsion. His research interests include integrated circuit aging Electrical and Computer Engineering, United States Naval Academy, where effects, parallel programming, GPU acceleration, SSD security, and machine he heads the Signal Processing and Data Science Research Group. His areas learning. of research interests include biomedical signal analysis and statistical learning theory and applications in neurological diseases, implantable medical devices, and digital security.

RYAN RAKVIC received the B.S. degree in com- GREGORY L. SINSLEY received the B.S. degree puter engineering from the University of Michi- in electrical engineering from the Grove City Col- gan, and the M.S. and Ph.D. degrees with Carnegie lege, in 2005, and the Ph.D. degree in electrical Mellon University. He is currently in his 14th engineering from the Pennsylvania State Univer- year as a Professor with the Electrical and sity, in 2012. He was an Electrical Engineer with Computer Engineering Department, United States Applied Technology, Inc., from 2012 to 2016, and Naval Academy, Annapolis, MD, USA. Prior to an Electronics Engineer with the United States that, he spent five years at the Microarchitecture Naval Research Laboratory, from 2016 to 2018. Research Lab, Intel Corporation, Santa Clara, CA, He has been an Assistant Research Professor with USA. During his time at Intel, he invented creative the Electrical and Computer Engineering Depart- ways to increase the performance of microprocessors. At the Academy, ment, United States Naval Academy, since 2018. His research interests are in he has spent time exploring other areas of computer architecture, including optimization and control of power systems, multisensor data fusion, anomaly studying Field Programmable Gate Arrays (FPGAs), Graphics Processing detection in cyber-physical systems, and side-channel analysis. Engines (GPUs), and embedded smartphone designs in the context of not just performance but also energy efficiency. Most recently, he has branched out to the computer security field, where he is currently working at the crossroads of side-channel analysis and machine learning. HAU T. NGO received the B.S. and M.S. degrees ANN VANLEER received the B.S. degree in in computer engineering and the Ph.D. degree weapons and controls systems engineering from in electrical and computer engineering from Old the U.S. Naval Academy, in 1996, the M.S. degree Dominion University, in 2001, 2003, and 2007, in electrical engineering from the University of respectively. He is currently an Associate Profes- Washington, in 1997, and the Ph.D. degree in bio- sor with the Electrical and Computer Engineer- engineering from the University of Pennsylvania, ing Department, U.S. Naval Academy, Annapolis, in 2013. She was a Postdoctoral Research Asso- MD, USA. His research interests include biomet- ciate at the Translational Neuroengineering Labo- ric signal processing, power-delay-area efficient ratory, University of Pennsylvania, from 2013 to design methodologies for image and video pro- 2014, before joining the faculty at the United cessing systems, real-time signal processing on field-programmable gate States Naval Academy, in 2014. She has served as the Naval Surface Warfare arrays (FPGAs), hardware-software co-design of high-performance embed- Officer. Prior to her doctoral studies, she has served on the faculty at The ded systems, and digital forensics. Key School, Annapolis, MD, USA. She is currently an Assistant Professor with the Department of Electrical and Computer Engineering, United States Naval Academy. Her areas of research interests include biomedical signal analysis and machine learning. ROBERT W. IVES (Senior Member, IEEE) DANE BROWN received the B.S. degree in elec- received the B.S. degree in mathematics from the trical engineering from the U.S. Naval Academy, United States Naval Academy, the M.S. degree in in 2005, the M.S. degree in electrical engineering electrical engineering from the U.S. Naval Post- from the Naval Postgraduate School, Monterey, graduate School, and the Ph.D. degree in electrical CA, USA, in 2006, and the Ph.D. degree in com- engineering from the University of New Mexico. puter engineering from the Virginia Polytechnic He served 20 years and has retired from the Navy Institute and State University, in 2019. He began as a Nuclear Submarine Officer. One of his tours in his career as a Navy Submarine Warfare Officer the Navy was as a Military Research Associate at after graduating from the Navy Nuclear Power Sandia National Laboratories, Albuquerque, NM, School and the Navy Nuclear Power Training USA, where he was engaged in pattern recognition and image compression Command in Goose Creek, SC, USA. He is currently an Assistant Professor research. He is currently in his 17th year as a Professor with the Electrical and with the Cyber Science Department, U.S. Naval Academy. His research inter- Computer Engineering Department, United States Naval Academy, Annapo- ests include reverse engineering, vulnerability discovery, privacy and trust, lis, MD, USA. His research interests include image and video processing, instruction set architectures, communications protocols, digital forensics, pattern recognition, and machine vision. and education in cyber security and STEM fields.

VOLUME 8, 2020 31881