A team of South Korean and American researchers have developed an SSD-based data protection system that rescues from ransomware attacks and allows data to be restored immediately. SSD-Insider ++ lets you “undo” unexpected encryption attempts within seconds.
According to the researchers, the very technology of NAND memory makes it easy to recover data due to its nature of “delayed deletion” of information. The SSD-Insider ++ concept provides for the assessment of drive activity patterns in the event of ransomware attacks used by cybercriminals to extort funds in exchange for a key to decrypt data. Instead of software protection, the system relies directly on the device itself – protection is carried out even at the controller level using special firmware. According to the researchers, the idea of firmware-level protection came about because most users don’t bother installing anti-ransomware software. So SSDs will literally go about self-defense.
As soon as the activity of the ransomware is registered, the data input / output is suspended, and during this time the user can cancel the encryption process. In this case, already encrypted data is restored within a few seconds.
As a result of the tests, the technology coped with 100% of laboratory and real samples of ransomware, and information was restored within a maximum of 10 seconds from the moment the encryption began. The price of such functionality is an increase in work delays by 12.8-17.3%, which is more than offset by a high level of security.
The main distinguishing feature of the technology is precisely its use at the firmware level – in other words, in theory, the corresponding functionality can be added even to the already used SSD without modifying the hardware itself. However, some additional functions require more processing power.
At the same time, the idea of reliable protection against ransomware at the expense of a relatively small decrease in performance did not inspire enthusiasm among vendors. According to scientists, offers have been made to several companies in South Korea, but none of them has expressed a willingness to use the technology.
Although SSD-Insider ++ was designed specifically for SSDs, its variations can potentially be used for other types of drives, with the exception of traditional HDDs. At the same time, it is possible to use SMR-type (Shingled Magnetic Recording) recording with relatively new HDDs.
If you notice an error, select it with the mouse and press CTRL + ENTER.