Researchers Discover SSD NAND Flash Vulnerability That Forces Data Corruption

There might not be a storage medium that's definitively indestructible, or perfectly reliable, but solid-state storage would rank near the top. A hard drive, for example, might be able to house a large amount of data, but if it's dropped to the ground, or its host PC is bumped hard enough, all of that data could effectively be ruined in the blink of an eye.

Solid-state storage is a bit different. If it's jostled during operation, it won't be affected, and the same goes for experiencing a fall to the ground. But, despite its durability, it's still not indestructible or entirely reliable, and new research from Carnegie Mellon University, Seagate, and ETH Zürich highlights some new reason why.

It's important to note that this is just research, so there's no need for immediate alarm. However, what the research shows is that if someone was nefarious enough (and there is no shortage of such folk unfortunately), our devices or PCs could be exploited to corrupt that precious NAND in our SSDs.

The research revolves around MLC NAND, which stores 2 bits per cell, and doesn't affect SLC (1 bpc), and likely doesn't affect TLC (3 bpc), as it's not referenced. The potential attack is being compared to the Row hammer attack which thrashes a storage device with read or write operations so as to corrupt nearby bits which store legitimate data.

In one attack, software would write a specific data pattern that causes the device's programming logic to create many more errors than usual. Errors would be one thing, but in this case these errors are tied into genuine corruption of data. In another attack, called "read disturb", software could inundate an SSD with read requests, potentially causing pages partially-programmed and those yet-to-be programmed to be corrupted, and in effect, lost.

While the threat of such attacks right now is minimal, realities like this should act as fuel to inspire more people to make sure that their data is being safely backed up. Storing data on a network share (eg: NAS), external media, or even a cloud service could make attacks like these more of an annoyance than a disaster. Since it's a common misconception, it's worth noting that RAID is not a backup, because if data is corrupted on one SSD, it's going to be instantly reflected on the other. In cases like these, the only safe solution is making the data redundant outside of that PC.