🚀 go-pugleaf

Dnia Fri, 08 Jan 2010 19:12:07 +0100, Krzysztof Halasa napisał(a):

> Michal Kawecki <kkwinto@o2.px> writes:
> 
>> Specyfikacja tego maleństwa (patrz post wyżej) wygląda raczej
>> zachęcająco. Trudno z góry zakładać, że są to tylko iluzje.
> 
> Ale to nie definiuje mechanizmow, ktore sa wykorzystywany. Samo
> napisanie "AES" itp. nie gwarantuje dokladnie niczego.

Ale tu nie ma problemu z samym mechanizmem szyfrowania, tylko z
weryfikacją wpisanego hasła, która jest wykonywana w pamięci komputera
zamiast w USB penie. Co oczywiście bynajmniej nie umniejsza wagi
problemu.

"NIST-certified USB Flash drives with hardware encryption cracked 
 
Encrypting USB Flash memory from Kingston, SanDisk and Verbatim  
Kingston, SanDisk and Verbatim all sell quite similar USB Flash drives
with AES 256-bit hardware encryption that supposedly meet the highest
security standards. This is emphasised by the FIPS 140-2 Level 2
certificate issued by the US National Institute of Standards and
Technology (NIST), which validates the USB drives for use with sensitive
government data. Security firm SySS, however, has found that despite
this it is relatively easy to access the unencrypted data, even without
the required password.

The USB drives in question encrypt the stored data via the practically
uncrackable AES 256-bit hardware encryption system. Therefore, the main
point of attack for accessing the plain text data stored on the drive is
the password entry mechanism. When analysing the relevant Windows
program, the SySS security experts found a rather blatant flaw that has
quite obviously slipped through testers' nets. During a successful
authorisation procedure the program will, irrespective of the password,
always send the same character string to the drive after performing
various crypto operations – and this is the case for all USB Flash
drives of this type.

Cracking the drives is therefore quite simple. The SySS experts wrote a
small tool for the active password entry program's RAM which always made
sure that the appropriate string was sent to the drive, irrespective of
the password entered and as a result gained immediate access to all the
data on the drive. The vulnerable devices include the Kingston
DataTraveler BlackBox, the SanDisk Cruzer Enterprise FIPS Edition and
the Verbatim Corporate Secure FIPS Edition.

When notified by SySS about this worst case security scenario, the
respective vendors responded quite differently. Kingston started a
recall of the affected products; SanDisk and Verbatim issued woolly
security bulletins about a "potential vulnerability in the access
control application" and provided a software update. When asked by heise
Security, Verbatim Europe said that none of the affected drives have
been sold in Europe – and that none will be shipped before the hole has
been closed. 

The real question, however, remains unanswered – how could USB Flash
drives that exhibit such a serious security hole be given one of the
highest certificates for crypto devices? Even more importantly, perhaps
– what is the value of a certification that fails to detect such holes?"

Źródło:
http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html
-- 
M.   [Windows Desktop Experience MVP]
/odpowiadając na priv zmień px na pl/
https://mvp.support.microsoft.com/profile/Michal.Kawecki