Patent Application
20060112277
A. Field of the Invention
The present invention relates to computer memory devices and, more specifically, to mechanisms for identifying passwords protecting those memory devices.
B. Description of Related Art
For the sake of clarity the following discussion will concern IDE computer long-term memory devices, such as hard drives and flash memory. One skilled in the art will appreciate that the method and systems disclosed here are applicable to other types of drives and our current invention is not limited to IDE devices.
There are two components to modern long-term storage devices; 1. a physical media which holds data and 2. a drive controller which reads and writes data on the physical media, when given instructions from a host. The drive controller may require a password before reading or writing data. As an additional security measure, the drive controller may lock-up after a certain number of incorrect password attempts, typically 5 tries. Once a drive controller is locked up, it will not accept any commands from a host until it is reset.
If the proper password is known, there is no problem, and no need for our current invention. However, criminals of all sorts have a desire to password protect their data while police and security officers have an obvious need to defeat this password protection. Our current invention submits potential passwords to a drive controller until one is accepted or a user intervenes. After typically five unsuccessful attempts the drive controller locks up. Our current invention unlocks (resets) the drive controller in as little as 50 Milliseconds, and continues to submit potential passwords. This process is called password “attacking” and/or “cracking” a drive.
A conventional software method of attacking computer long-term memory devices is by connecting a long-term memory device to a working standard computer (PC) operating system and running specialized software to attack the device. There are a number of potential problems with this approach. First, an expensive PC must be taken from productive service, along with the desk space needed to support its keyboard, monitor and mouse. Second, a trained user must attach the target drive to the host machine. During this process, the host machine must be shut down, the target drive properly installed, and configured with a valid address or master/slave status, and finally the host machine rebooted. This can be a time consuming process requiring a trained user. Finally, there is a potential system problem. Most PCs are not designed for hard drives being swapped in an out on a regular basis. A static charge or cable failure while installing a target drive can damage not only the target drive but also the host machine.
The above-mentioned system has the potential for changing long-term memory. The simple act of connecting a hard drive to a computer may cause the computer to write information to the drive, thus altering it. In computer forensic, legal and security applications, a hard drive may not be altered at all.
Perhaps the biggest problem with using a PC to attack a drive is the amount of time it takes. After a drive controller locks up due to unsuccessful password attempts the PC must be rebooted, a process that can take minutes. As the process of attacking a drive may take thousands or even millions of attempts, rebooting a PC after every five attempts is extremely time intensive.
Accordingly, there is a need in the art to more efficiently password attack long-term memory devices such as hard drives.
Systems and methods consistent with the principles of this invention provide for an easy to use and portable high-speed password attack device.
One aspect of the invention is directed to a device for conducting high-speed password attacks on a long-term memory component. The device includes an interface for connecting the device to the long-term memory component and a control circuit configured to present potential passwords to the long-term memory component through the interface and to reset the long-term memory component controller as necessary. A user controllable switch, when actuated by a user, causes the control circuit to commence an attack on the long-term memory component. The device includes a communication interface configured to display the results of this attack to a user.
A method consistent with aspects of the invention includes connecting a power supply to a password attack device, connecting a cable associated with the attacking device to a long-term memory component in a computer, and powering-up the computer. The method further includes activating the attacking device via a switch attached to the attacking device, presenting potential passwords to the long-term memory component and resetting the device controller as necessary, signaling completion of password attack, and communicating this information.
Another method consistent with aspects of the invention includes connecting a power supply to a password attacking device, connecting a cable associated with the password attacking device to a long-term memory component, and connecting a power cable attached to the password attacking device to the long-term memory component. The method further includes activating the attacking device via a switch attached to the attacking device, presenting potential password to the long-term memory component and resetting its controller as necessary, signaling completion of the password attack, and communicating this information.
Yet another aspect of the invention is directed to a device for presenting potential passwords a long-term memory component, and resetting its controller as necessary. The device includes LEDs configured to provide feedback relating to an operational status of the device to a user, a user settable switch, a communication interface to display the retrieved identification information to a user, and a long-term memory interface for connecting to a long-term memory component. The device further includes circuitry coupled to the LEDs, the user settable switch, the communication interface, and the long-term memory interface, the circuitry configured, when the switch is actuated by the user, to present potential passwords to a long-term memory component through the interface and reset the long-term memory components controller as necessary, and to communicate the results of this operation to a user through the communication interface. The circuitry is enclosed in a portable casing and the LEDs, the user controllable switch, the communication interface and the long-term memory interface are mounted on an external portion of the casing.
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate the invention and, together with the description, explain the invention. In the drawings,
The following detailed description of the invention refers to the accompanying drawings. The same reference numbers in different drawings identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents.
A password attacking device for presenting potential passwords to long-term memory devices, such as hard drives, and resetting their controllers as necessary, includes a host circuit that performs operations on a target drive to return information to the host circuit. The password attacking device is physically compact, is relatively simple to operate, and is operating system independent.
Storage devices discussed herein may be any type of long-term non-volatile memory device. For example, the storage device may be a hard disk drive or compact flash memory. In one implementation, the storage device uses an Integrated Drive Electronics (IDE) interface. An IDE interface is a well-known electronic interface that is frequently used to connect a computer's motherboard and disk drive.
Although concepts consistent with the present invention are primarily described herein in relation to an IDE magnetic hard disk drive, these concepts may be implemented with other types of IDE media, such as flash memory with an IDE interface. Flash memories are a special type of semiconductor random access memory that retains its data after power has been removed from the system. Other types of media useable with an IDE interface include magnetic tape. In addition to the IDE interface, concepts consistent with the invention may be applied in a straightforward manner to other types of high level storage interfaces, such as the well known Small Computer System Interface (SCSI) standard or a hard drive connected through an IEEE 1394 (Firewire) connection.
For the sake of clarity the remaining description herein will be described with reference to an IDE magnetic hard disk drive, although, as mentioned above, the concepts of the invention are not limited to such drives. One skilled in the art would appreciate that other modern long-term storage device interfaces share similar functionality that could be incorporated into the concepts described herein.
A hard disk drive or compact flash drive (target drive) attaches to interface connector 140. As will be described in more detail below, control circuitry 120 submits instructions (potential passwords) to the target drive and resets it as necessary. In other words, the target drive is “attacked” by password attacking device 100. Interface circuitry 130 passes instructions through connector 140 to the target device. Power supply 110 provides power to both control circuitry 120 and interface circuitry 130.
Printer communication circuitry 150 allows password attacking device 100 to communicate with a host computer, such as a personal computer. Communication interface 170 may be a serial interface that may be connected to a personal computer. Printer communication circuitry 150 may then handle the serial communication protocols between the personal computer and attacking device 100. Additionally instead of connecting to a personal computer, printer communication interface 170 may be used to interface directly to a stand-alone printer, through which information may be output. Printer communication interface 170 is optional. In one implementation, query device is implemented as a stand-alone device with an LCD panel, or built-in printer used to communicate to a user rather than using a separate computer or printer.
Communication circuitry 160 allows password attacking device 100 to communicate with a host computer, such as a personal computer. Communication interface 180 may be a serial interface that may be connected to a personal computer. Communication circuitry 160 may then handle the serial communication protocols between the personal computer and attacking device 100. A personal computer may be used in this iteration to pass potential passwords to the attacking device. Additionally, instead of connecting to a personal computer, communication interface 180 may be used to interface directly to a stand-alone printer, through which status information may be output. Communication circuitry 160 and communication interface 180 are optional. In one implementation, attacking device is implemented as a stand-alone device that may be used to query hard drives without using a separate computer. In another iteration, interface 160 may be used to start and/or stop password attack procedures.
Password attacking device 100 may be designed as a relatively small, lightweight, and easily portable device. In one implementation, attacking device 300 is embodied in a case approximately 5″×7″×1.3″.
Power cables allow power to be supplied to the target disk drive through power connector 190. This allows attacking device 100 to process a target drive whether or not the target drive is still connected to a working computer or similar device (host).
Microprocessor 205 may control external devices, such as LED status indicators 210. Through LED status indicators 210, microprocessor 205 may provide easily understandable feedback to a user. For example, one of LEDs 210 may be a green LED that is powered by microprocessor 205 when it finishes attacking a drive. Alternatively, microprocessor 205 may cause an audible sound to be produced when it finishes attacking a drive.
Interface 140 may include a hard drive interface 240. Drive interface 240 may be a standard IDE drive interface that connects attacking device 100 to the target drive. Interface 140 may also include a compact flash interface 245 which, in a similar manner, allows attacking device 100 to connect to and interrogate compact flash memory devices.
In addition to connecting to the target drive through interface circuitry 140, microprocessor 205 may be connected to external devices via RS-232 port 255 and RS-232 transceiver 250. RS-232 port 255 may be a standard DB9 connector that allows connections using a standard DB9 male to female serial cable.
In addition to connecting to the target drive through interface circuitry 140, microprocessor 205 may be connected to external devices, such as printers or other display devices, via RS-232 port 265 and RS-232 transceiver 260. RS-232 port 265 may be a standard DB9 connector that allows connections using a standard DB9 male to female serial cable.
One of ordinary skill in the art will recognize that the components shown in
Buffering and signal conditioning for the target disk drive is provided by drive buffers 370, which form the drive interface with the target disk drive. Buffering and signal conditioning for compact flash is provided by drive buffers 380, which form the interface with the compact flash. Through the bus drivers 340, the microprocessor 205 can directly read and write to the drive interface associated with the target disk drive and compact flash.
Instead of directly communicating with drive buffers 370 and 380, bus drivers 340 may indirectly communicate with drive buffers 370 and 380 through dual ported RAM sector buffers 350 and 360. Sector buffer 350 provides an additional layer of buffering between the microprocessor 205 and the disk drive and/or compact flash. This allows the target drive to write one sector's worth of data to RAM at high speed, while the microprocessor 205 reads a previous sector's worth of data. By allowing the operations to overlap in this fashion, the microprocessor 205 is not restricted to running at the speed of the target drive or compact flash, and is free to handle other functions until it needs the data in the sector buffers 350 or 360.
Referring back to
Password attacking device 100 operates on a target drive inserted into interface connector 140 to submit potential passwords and reset the controller as necessary.
Once the results of the IDENTIFY_DEVICE command indicates the drive is capable of receiving another password, Attacking device submits a potential password to the drive 803. If the password is correct 804, the newly discovered password is formatted for display to the user 805. The formatted results are displayed, printed, or sent to a PC 806, depending on the device configuration. If the password is incorrect, control passes back to 801 in order to determine whether the drive is ready for another password attempt or needs to be reset.
As previously mentioned, password attacking device 100 may be constructed in a relatively small case, such as a case as small or smaller than 5″×7″×1.3″.
As shown in
A user begins by connecting attacking device 100 to a power supply (Act 501) and ensuring that switch 404 is set to the “off” state (Act 502). In one implementation, this may involve plugging socket plug 401 into a wall power outlet. The user plugs a display device, such as a printer, into the standard serial DP9 connector (Act 503). The user also ensures that the computer system with the target disk drive is powered down (Act 504). The user may then remove any IDE cables that are in the target drive (Act 505). This may involve removing the cover of the host computer and removing the IDE drive connector that connects the host computer and the drive. The user may then connect IDE drive cable 402 to the drive, turn power on to the host computer, and turn switch 404 to the “on” position (Acts 506, 507, and 508). In response, attacking device 100 will power on and attack the target drive to determine its password. The attack may proceed as previously discussed with reference to
As shown in
A user begins by plugging socket plug 601 into a power supply (Act 701) and ensuring that switch 605 is set to the “off” state (Act 702). The user plugs a display device, such as a printer, into the standard serial DB9 connector (Act 703). The target drive is then placed on the anti-static cushion 607, the IDE drive cable 603 plugged into the target drive, and the drive power cord 604 plugged into the target drive (Acts 704 and 705). The user may then turn switch 605 to the “on” position (Act 706). In response, password attacking device 100 will power on and attack the drive in a manner similar to that described above with respect to
As can be appreciated, the operation of password attacking device 100, from the prospective of the user, is relatively simple. Accordingly, attacking device 100 can be operated by only moderately trained technicians. Additionally, the operation simplicity of attacking device 100 makes it unlikely that a user will improperly use the attacking device in a manner that damages a disk drive.
In the implementations described above, password attacking device 100 signals its operational status to a user through LEDs 405 or 606. For example, LEDs may be used to signal that: (1) attacking device 100 is performing operations on a target device, (2) attacking device 100 has finished attacking the target device, and (3) an error was encountered.
In alternate embodiments, attacking device 100 may include additional display devices such as a LCD graphical display, to communicate device status. With these output devices, additional status information such as number of password attempts, and information about the target device may be displayed.
In the implementations described above, password device 100 has its method of selecting potential passwords set in hardware. In an alternative embodiment, attacking device 100 may include an interface that a user can set to vary the method potential passwords are selected, such as random, dictionary look-up, or special algorithm.
In yet another implementation, attacking device 100 could have a network interface to communicate with a display device. This network interface could in addition be used to allow a network pc to set what information method potential passwords are selected, as discussed in the above paragraph.
In yet another implementation, attacking device 100 could have a long-term memory storage device, such as a hard drive, to store dictionaries and other such lists to add in choosing potential passwords. In a similar fashion, attacking device 100 could have a removable memory, such as a flash drive, to enable a user additional input into choosing potential passwords.
In another implementation, attacking device 100 could include non-volatile and/or non-volatile removable memory. This memory could be used to store for storing the results of a password attack.
Although the attacking device discussed above was primarily described as attacking an IDE device, in other implementations, long-term storage devices having other interfaces, such as FireWire, USB, USB2, or SCSI could be attacked using concepts similar to those discussed herein.
As described above, a password attacking device submits potential passwords to a target long-term memory device, and resets it as necessary. The attacking device is portable, provides easy to understand user feedback, has a simple user interface and could thus be effectively used by non-technical people.
The password attacking device has a number of advantages. It is operating system independent. The attacking device can operate while the target device is still physically located in the host computer system or when it has been removed from the host computer system. It is a stand alone device that can replace more complicated and more expensive devices or systems. Additionally, the attacking device does not require that the operator have any particular knowledge of the target device.
Additionally, the password attacking device can use different methods of selecting potential passwords. The attacking device provides feedback to a user that it has either performed operations correctly or has run into an error.
It will be apparent to one of ordinary skill in the art that the embodiments as described above may be implemented in many different forms of software, firmware, and hardware in the implementations illustrated in the figures. The actual software code or specialized control hardware used to implement aspects consistent with the present invention is not limiting of the present invention. Thus, the operation and behavior of the embodiments were described without specific reference to the specific software code, it being understood that a person of ordinary skill in the art would be able to design software and control hardware to implement the embodiments based on the description herein.
The foregoing description of preferred embodiments of the present invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. Moreover, while a series of acts have been presented with respect to
No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where only one item is intended, the term “one” or similar language is used.
The scope of the invention is defined by the claims and their equivalents.
