CAPEC-402: Bypassing ATA Password Security

Overview

CAPEC-402 (Bypassing ATA Password Security) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

Access to the system containing the ATA Drive so that the drive can be physically removed from the system.

How to mitigate it

Defenses that reduce the risk of CAPEC-402.

Avoid using ATA password security when possible.
Use full disk encryption to protect the entire contents of the drive or sensitive partitions on the drive.
Leverage third-party utilities that interface with self-encrypting drives (SEDs) to provide authentication, while relying on the SED itself for data encryption.

Examples

The A-FF Repair Station tool is a data recovery utility that can be used for ATA password removal (both High and Maximum level) and firmware area recovery. An adversary with access to this tool could reset the ATA password to bypass this security feature and unlock the hard drive. The adversary could then obtain any data contained within the drive. [REF-702]

An adversary gains physical access to the targeted hard drive and installs it into a system that does not support ATA security features. Once the drive is installed in the feature-lacking system, the adversary is able to reset the hard drive password via the BIOS. As a result, the adversary is able to bypass ATA password security and access content on the drive.

The CWE weaknesses that CAPEC-402 exploits.

CWE-285: Improper Authorization

How this attack relates to others in the CAPEC hierarchy.

Parent

CAPEC-401: Physically Hacking Hardware

Frequently asked questions

Common questions about CAPEC-402.

What is CAPEC-402?

An adversary exploits a weakness in ATA security on a drive to gain access to the information the drive contains without supplying the proper credentials. ATA Security is often employed to protect hard disk information from unauthorized access. The mechanism requires the user to type in a password before the BIOS is allowed access to drive contents. Some implementations of ATA security will accept the ATA command to update the password without the user having authenticated with the BIOS. This occurs because the security mechanism assumes the user has first authenticated via the BIOS prior to sending commands to the drive. Various methods exist for exploiting this flaw, the most common being installing the ATA protected drive into a system lacking ATA security features (a.k.a. hot swapping). Once the drive is installed into the new system the BIOS can be used to reset the drive password.

How do you prevent CAPEC-402?

Avoid using ATA password security when possible.

What weaknesses does CAPEC-402 target?

CAPEC-402 exploits 1 CWE weakness, including CWE-285 (Improper Authorization).

References

MITRE CAPEC definition (CAPEC-402) (opens in a new tab)

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.