Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 439 guests and 2 members online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Hardwarearrow CRACKED: SanDisk and Kingston encrypted flash drives share backdoor
EH-Net
May 20, 2013, 03:33:13 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: CRACKED: SanDisk and Kingston encrypted flash drives share backdoor  (Read 14717 times)
0 Members and 1 Guest are viewing this topic.
keyster
Newbie
*
Offline Offline

Posts: 3


View Profile
« on: January 05, 2010, 09:44:21 PM »

Security experts reveal, SanDisk, Kingston and Verbatim FIPS certified, hardware encrypted USB flash drives have a shared backdoor password.  You would think that they know better but that is what happens when a consumer memory companies bolt on a little security.

"SySS security experts found a rather blatant flaw that has quite obviously slipped through testers' nets. During a successful authorisation procedure the program will, irrespective of the password, always send the same character string to the drive after performing various crypto operations"

http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html
Logged
Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #1 on: January 06, 2010, 08:01:37 AM »

For EH-Netters concerned their new toy is broken, IronKey are claiming to not be vulnerable. Full write-up of the weakness and attack vector available from them here
Logged

jason
Hero Member
*****
Offline Offline

Posts: 1012



View Profile WWW
« Reply #2 on: January 06, 2010, 10:53:41 AM »

Thanks for the link. Wow that is a really terrible architectural decision. I have a Kingston BlackBox running around here somewhere, I'll have to give it a poke.
Logged
jason
Hero Member
*****
Offline Offline

Posts: 1012



View Profile WWW
« Reply #3 on: January 06, 2010, 11:10:42 AM »

So I called Kingston tech support, as recommended on their page about the vulnerability (http://www.kingston.com/driveupdate/) to see about the update. It's going to be a software patch, and won't be available for a couple weeks yet. He said that they do have one that they're testing now, but don't want to release it without testing it thoroughly.

From reading over the vulnerability, I'm not confident that a software patch will really fix things. I imagine that with all the attention that this has gotten, there will be some enterprising folks beating on the patched version as soon as it comes out.
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #4 on: January 06, 2010, 01:06:10 PM »

I agree with Jason, I think that this may be an architectural problem.  I am not sure how this method qualifies as hardware encryption, if the same "message" is always sent to to the hardware device.  I feel like I am missing something here.
Logged

~~~~~~~~~~~~~~
Ketchup
keyster
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #5 on: January 08, 2010, 12:56:57 AM »

Sandisk and Kingston provide hardware encryption but only the encryption algorithms are processed in hardware.

This is very different than hardware secured.

Hardware secured products should generate encryption keys in hardware using validated true random number generators.    The password key and counter should also protected by the hardware to prevent brute force password-guessing, patching and replay attacks.  In fact, the drive should not even mount until the password is verified in hardware. 

Verifying passwords in memory was the source of this vulnerability.

Logged
UNIX
Hero Member
*****
Offline Offline

Posts: 1234


View Profile
« Reply #6 on: January 08, 2010, 01:11:28 AM »

Would the software patch solve the problem of verifying passwords in memory? I could imagine, that it is hard to fix, as the hardware is already there and probably the fault is in the design, so hardly a possibility to change anything to really get it secure. Quite sure that the patch, as soon as it is available, will be reversed in order to see how to attack it again.
Logged
jason
Hero Member
*****
Offline Offline

Posts: 1012



View Profile WWW
« Reply #7 on: January 08, 2010, 12:07:42 PM »

My thoughts exactly. They can beef up the mechanism that sends the unlock key to the hardware to make it harder to crack, but it seems like changing to a different method entirely would not be feasible.
Logged
jason
Hero Member
*****
Offline Offline

Posts: 1012



View Profile WWW
« Reply #8 on: January 21, 2010, 02:13:28 PM »

So I got an email from Kingston this morning. Apparently, they must have come to the same conclusion that we did about the software update. According to the email "Kingston has decided that the best way to address this problem is to offer our customers replacement units that incorporate newer and stronger security architecture". It looks like the replacement from them will be this:

http://www.kingston.com/flash/dt5000.asp
Logged
UNIX
Hero Member
*****
Offline Offline

Posts: 1234


View Profile
« Reply #9 on: January 21, 2010, 02:35:21 PM »

Nice move, though a simple patch wouldn't have solved the problem anyway and again such news may have appeared soon. Let's see, if they did it better this time.
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #10 on: January 21, 2010, 03:27:43 PM »

Wow, I am surprised, honestly.  It's a pleasant surprise. 
Logged

~~~~~~~~~~~~~~
Ketchup
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.066 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.