CWE-1301 says the product's data removal process does not completely delete all data and potentially sensitive information within hardware components. It matters wherever a device changes hands, gets repaired, or is reset and resold.
How it happens
Physical properties of hardware can keep sensitive data alive after a removal process has run and the power is gone. MITRE lists the remanence of magnetic media, the residual charge of ROMs and RAMs, and screen burn-in as examples.
Recovering data after erasure or overwriting is possible because of data remanence. MITRE gives one example: if the same value is written repeatedly to a memory location, the memory cells can become physically altered to a degree that the data can still be recovered by characterizing the cells, even after it was erased.
The software view says the data is gone. The physical view says otherwise.
An observed example in the record is CVE-2019-8575. It is a firmware data deletion issue where a base station factory reset might not delete all user information. The new owner of a used device that has been factory-default reset, with a vulnerable firmware version, can still retrieve at least the previous owner's wireless network name and wireless security key such as WPA2. The issue was addressed with improved data deletion.
What an attacker gains
Confidentiality is the affected scope. The record lists reading memory and reading application data. There is no code execution here, only disclosure, but disclosure of whatever the device held.
How to find it
The record lists no detection methods. Practical checks:
- After a factory reset or wipe, try to recover data from the device with the tools a new owner or lab could use.
- Inspect every storage location, not only the main one. Caches, secondary memories and display memory count.
- Test after power loss as well as during operation.
How to fix it
MITRE lists two steps at the architecture and design stage and the implementation stage.
- Apply blinding or masking techniques to implementations of cryptographic algorithms.
- Alter the method of erasure, add protection of the media, or destroy the media to protect the data.
For sensitive material, the sturdiest answer may be to keep it from living in vulnerable storage for long, or to encrypt it so deletion only has to remove a small key. That is an engineering choice rather than a MITRE statement, so weigh it against your design.
Quick check
What is data remanence?
The ability to recover data from physical properties of memory or media after it has been erased or overwritten.
Who is at risk in the CVE-2019-8575 example?
Previous users of a used device, because a factory reset might not delete all their information.
