Members
  • Total Members: 12818
  • Latest: martin
Stats
  • Total Posts: 28534
  • Total Topics: 8240
  • Online Today: 1027
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Secure USB Drives Not So Secure (SanDisk, Kingston, Verbatim - AES 256-bit )  (Read 4432 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


Several hardware-encrypted USB memory sticks are now part of a worldwide recall and require security updates because they contain a flaw which could allow hackers to easily gain access to the sensitive information contained on the device.

When USB maker SanDisk first received news of the problem last month, the vendor issued a security bulletin that warned customers its Cruzer Enterprise series of USB flash drives contained a vulnerability in the access control mechanism: http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009
SanDisk offered a product update online to address the issue and made sure to note the problem only applied to the application running on the host, not the device hardware or firmware.

Now USB vendor Kingston has jumped in with a similar warning, probably because their drives utilize the same code from SanDisk: http://www.csoonline.com/article/512577
Kingston's alert informs customers that "a skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data contained" on the drives. The company has issued a recall on the devices and urged customers to return them. A warning has also been issued by USB vendor Verbatim: http://www.verbatim.com/security/security-update.cfm

The drives impacted are equipped with AES 256-bit hardware encryption, which is designed to meet the stringent requirements of enterprise-level security. However, penetration testers with German security firm SySS uncovered a vulnerability that exploits the way the flash drives handle passwords. The exact nature of the flaw is not described on any of the vendor bulletins, but according to an article in security publication The H, "the main point of attack for accessing the plain text data stored on the drive is the password entry mechanism." SySS testers found a flaw that allowed them to write a tool that sent the same character string to unlock the drive, regardless of what password was entered.

The flaw may be contained in other drives as well and more recalls may be on the way, according to Graham Cluley, Senior Technology Consultant with Sophos.

"It's certainly a disturbing vulnerability, and may well lead to other hackers exploring the possibility of accessing what was previously considered 'securely encrypted' data," noted Cluley. "I don't know if other manufacturers also use SanDisk's code, but even if they don't they might be wise to examine their own products and think long and hard about whether they might be vulnerable to similar exploits. Although it's embarrassing to recall a product, it would be much worse to have a product on the market which is vulnerable to this kind of attack."

Cluley, who also blogged about the issue, called the problem "shameful" and said security managers need to be able to ensure proper encryption is used on USB sticks, which can carry a wealth of sensitive information: http://www.sophos.com/blogs/gc/
He also urged companies to put in place necessary measures to detect and block unauthorized use of removable storage devices.

(PCW)

Samker's Computer Forum - SCforum.info





 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising