Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Protected Memory Stick Easily Cracked

Posted by kdawson on Fri Apr 13, 2007 07:55 AM
from the not-that-hard-a-hack dept.
Security Data Storage Hardware
Martin_Sturm writes "A $175 1GB USB stick designed to protect your data turns out to be a very insecure. According to the distributer of the Secustick, the safety of the data is ensured: 'Due to its unique technology it has the ability to destroy itself once an incorrect password is entered.' The Secustick is used by various European governments and organizations to secure data on USB sticks. Tweakers.net shows how easy it is to break the protection of the stick. Quoting: 'It should be clear that the stick's security is quite useless: a simple program can be used to fool the Secustick into sending its unlock command without knowing the password. Besides, the password.exe application can be adapted so that it accepts arbitrary passwords.' The manufacturer got the message and took the Secustick website offline. The site give a message (translated from Dutch): 'Dear visitor, this site is currently unavailable due to security issues of the Secustick. We are currently working on an improved version of the Secustick.'"
+ -
story

Related Stories

[+] Entertainment: Encrypted USB Key With TOR, Firefox 170 comments
An anonymous reader writes "Gizmodo has a writeup on the new IronKey — a self-destructing, hardware-encrypted and -authenticated USB flash drive with on-board secure Firefox, high-speed TOR network, password manager, and online encrypted backup. Here is the demo page. $79 for a 1GB, $149 for 4GB." Ironkey works on XP and Vista only. Let's hope its self-destruct feature works better than Secustick's.
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Protected Memory Stick Easily Cracked 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Well they could have been like other companies (Score:5, Insightful)

    by insanemime (985459) on Friday April 13 2007, @07:57AM (#18717041)
    At least they had the balls to admit that something was wrong and try to take steps to fix it. It will be intresting to see if they recall the ones already sold.

    • Re:Well they could have been like other companies (Score:4, Interesting)

      by tritonman (998572) on Friday April 13 2007, @08:07AM (#18717157)
      Destroying the contents on a bad password attempt is crazy. Especially when you use very cryptic passwords. People tend to type wrong, hold the shift key down too long, not hold the shift key down when necessary. Sometimes I have to type my passwords two or three times before getting it right. Destroying important sensitive information because I accidentally typed it wrong is just plain stupid. These kind of technologies will only be a pain for people using them legitimately, and anyone who wants to hack to get the information will generally be able to find some way to get it, thus it is only extends the problems and provides no solutions.
      • ...where N could be set on first initializing the stick. And I assume you could change this later provided you had already given the correct password, but the article doesn't go into that.

        So it's not a case of typing it wrong once and *poof* goes the data (note that they didn't find any physical evidence of things in there capable of physical destruction either). If you set it to 3 times, and you get it wrong 3 times yourself - oh well. Maybe you *could* set it to only once, though.. but if you do that,

      • Depends on how much trouble you'll get in if law enforcement agents manage to get at the data... seeing as how that's the only *possible* use I can imagine these things would ever be put to.

            • It is unlikely that the only copy of sensitive data would be on the USB stick. If it is destroyed, you still have the original copy somewhere more secure than your pocket. If it's destroyed accidentally, it could be a lot less of a problem than if it fell into the wrong hands.

              There are a lot of situations where having a local copy of the data is a convenience, rather than a necessity, and this would allow the convenience without the risk of it being stolen. If it's accidentally destroyed, then it's an inconvenience, not a disaster.

      • I don't know about you, but I don't keep original copies of data on a USB key. I use it to transfer files from one computer to another, so wiping the data after unsuccessful attempts, in this context, strikes me as a good idea.

    • Re:Well they could have been like other companies (Score:5, Insightful)

      by antime (739998) on Friday April 13 2007, @08:12AM (#18717217)
      What they admitted is that they have no idea what they are doing and have no idea what they are selling. You would have to be an idiot to buy anything security-related from a company like that.

      • Re: (Score:3, Insightful)

        by rucs_hack (784150)
        it's not that silly. They saw a way to make money from the current delusion that data can be unbreakably secured.

        The only way to secure data is to make it so absolutely no-one but the authorised people have access to it. You can keep data secure physically if you isolate it from any form of access. However information does not work well if isolated like that, information has to be shareable to be useful, otherwise its just dead data, worthless bits.

        I have several pieces of information that are unhackable. T

        • it's not that silly.
          I contend it is not only silly, but sufficently bad to warrent legal action, because whoever built it must have known how badly it was designed to start with.

          It appears that the system doesn't use a form of encyption unlocked by a key (entered by the user) to store the data - and that instead it simply requires use of a single instruction to the USB device indicate the data ought to be accessible or not. That just sounds ludicrous.

          If it had been developed in good faith, and this were a bug (rather than part of the design) and/or the result of a sphosticated exploit that it would have been hard to predict, I would be sympathetic. As I would if they had clearly indicated it's limitations (which they could have, but if they've taken the website down now, I'm guessing not).

          What's particularly telling for me is, while the company were quite happy to tout the supposed virtues of the product, they are clearly worried about it now they have been found out. That repesents a staggering failure by the designers of the software, their managers, the marketing and product design teams, the HR department who hired all these people of clearly very dubious virtue and the senior management involved.

          Either they are crooks (because they were complicit in touting such a crummy product that didn't really do what it claimed to do in a reasonable way) or are they are all, really, really dumb (and none of them asked pertinent questions of the other parties at any stage of product development).
      • You would have to be an idiot to buy anything security-related from a company like that.

        Which is a shame for this company, because idiots are in such short supply these days...

    • Re:Well they could have been like other companies (Score:5, Interesting)

      by Lazerf4rt (969888) on Friday April 13 2007, @08:24AM (#18717355)

      Well, not completely. A spokesperson for the product is reported saying:

      Our customers are happy with the level of protection that our product offers. Normally, the amount of security is sufficient, not everyone has the technical expertise that you have.

      This is quite a different statement from the one made near the start of the article.

      The stick was commissioned by the French government and - according to the company's press release - the result is revolutionary, ultra safe and approved by the French intelligence service.

      Funny part is, all they did was run the program in a debugger, put a breakpoint after the clearly labelled "VerifyPassWord" function, and change the return value from 0 to 1. Pretty embarassing. But the article went pretty easy on them after that. Really good read by the way.

      • Re: (Score:3, Insightful)

        by Opportunist (166417)
        If you're satisfied with a level of security that was proven to be broken easily, you prove that you don't need any security altogether.

        If people don't bother breaking your security, they aren't that interested in your information in the first place.
        If people who are interested in your secrets are able to do so trivially, you can just as well abstain from encryption altogether to save you the hassle.

          • Re: (Score:3, Insightful)

            by Opportunist (166417)
            Not that bad, but it's just as good as leaving it lying around in plain view. The only difference is that you don't have to jump through hoops to get to your information.

            I'm usually amazed how many people would add more and more layers of "security" to their door, ignoring that the walls are made of paper. Sure, you, as the authorized user, have to go through time consuming hassle to get to your data, but the attacker, who doesn't care about damage, has it easy to circumvent your security. He might leave yo
      • I love the part where it is "approved by the French intelligence service". Of course it is, since it's so easy to break. Of course it's not approved for their own use, they just want everybody else to use it.

      • Funny part is, all they did was run the program in a debugger, put a breakpoint after the clearly labelled "VerifyPassWord" function


        Wait. The executable was compiled with debug symbols turned on? With functions with easy-to-understand names? I mean, I know it's only security-through-obscurity, but c'mon! At least up the ante a little bit ... many programmers are not skilled enough to disassemble a program with no symbol table. And the ones that are ... *shrug* rely on the security of your methods, not on the obscurity of your code. IOW, they should have used encryption, even with the self-destruct mechanism.
          • Ah, didn't see that part I guess. But still, with DLL functions you can name your function something like zxgvflqrt() or something.

            Still, there's no reason why one has to use DLLs, either. You can put everything into one .exe file if you like.

            • Re: (Score:3, Insightful)

              by Viol8 (599362)
              "You can put everything into one .exe file if you like."

              That would be the sensible way to go since its unlikely any other app would ever use that .dll. But sensible isn't something that generally applies to Windows programs these days as the amount of .dll splatter from even the simplest apps testifies.

      • Our customers are happy with the level of protection that our product offers.

        Duh.

        Does that remind anyone else of "Most people don't even know what a rootkit is, so why should they care?"

        Oh my god, some people are really projecting their own dumbness at their customers. Such marketroids should really be sacrificed to the war against terror. Or cluebatted.

  • Nice one! (Score:5, Interesting)

    by Anonymous Coward on Friday April 13 2007, @08:00AM (#18717075)
    At least the manufacturer is doing the right thing and eating crow over this. Here in the US the company would probably have just sued the hackers under DMCA while continuing to sell the defective product.

  • Just put - (Score:5, Informative)

    by ditoa (952847) on Friday April 13 2007, @08:04AM (#18717115)
    TrueCrypt on a memory stick with an encrypted volume file with a good passphrase and your data will be secure from pretty much anything. I have not heard of TrueCrypt being cracked yet.

          • Re: (Score:3, Informative)

            by jawtheshark (198669) *

            Once Truecrypt is installed on a machine (by Administrator) every Limited User can use it without problems. I have it set up that way at home.

            Running Truecrypt requires a driver and inserting that in the operating system requires Admin, once it's there, using it is allowed by everyone

  • password.exe seems to me that it would be a Win32 application. So, what if I put this in a Linux PC? Surely it's encrypted somehow? Maybe I need to read the article again, but I didn't see any mention of encryption.
    • ... as far as the article details.

      The password.exe does, however, address a controller chip. Without the correct password, the controller chip will simply refuse to provide further access to the flash memory.

      So if you're really wondering - I would imagine that the entire thing won't work with Linux, period.

      • Re: (Score:3, Insightful)

        by AJWM (19027)
        Without the correct password, the controller chip will simply refuse to provide further access to the flash memory.

        So even if the password control worked (which it doesn't), you could get at the contents by desoldering the flash chip and putting it in a reader. (Something hobbyists have been doing with HD-DVD drives to reverse engineer/modify the firmware.) And this is a supposedly intelligence-service recommended device for government use? Right, go on, pull the other one.

  • TrueCrypt (Score:5, Informative)

    by Teckla (630646) on Friday April 13 2007, @08:05AM (#18717131)

    Most Slashdotters know you should not trust the built in security on these devices.

    The solution for real security on these devices is to use TrueCrypt [truecrypt.org].

    It's not hard to use, though the more technical among us may need to help out the less technically inclined to get things rolling. Once it's setup, though, it's secure and easy to use.

    • Re:TrueCrypt (Score:5, Insightful)

      by Rob T Firefly (844560) on Friday April 13 2007, @08:12AM (#18717215) Homepage Journal
      The type of people who have got the wherewithal to set up TrueCrpyt are not the market this was aiming for. This seems like a product made for the techno-clueless PHB types who just want to buy something off the shelf they can stick in their magic computer box and have it "just work," and who see that high a price on a simple 1-gig USB stick not as an obvious ripoff, but as a measure of how much good computer magic it must surely contain.

      • The type of people who have got the wherewithal to set up TrueCrpyt are not the market this was aiming for. This seems like a product made for the techno-clueless PHB types who just want to buy something off the shelf they can stick in their magic computer box and have it "just work," and who see that high a price on a simple 1-gig USB stick not as an obvious ripoff, but as a measure of how much good computer magic it must surely contain.

        So they designed a flawed product. Slashdot folks tend to complain about how companies keep coming out with crummy products. Is it realistic to expect one billion MS Windows (tm) users to get a CS degree so they understand its shortcomings and are able to recognize these crummy products. Maybe it is time to switch to Apple products so you don't have to worry about trojan horse AUTORUN.EXE flaws in Windows. Corporate IT professionals were hired to help free users from the burden of maintaining their PCs muc

    • BTW, what is in this device that disallows me to dd if=/dev/sdb1 of=usb_bckp? I think the basic concept is flawed, there is no true security in a portable device that someone else can physically take away.
    • unless the idiot executive uses his SOCIAL SECURITY NUMBER as his passphrase.

      biggest problem with non technical people like CEO's CFO's CTO's and the like is they can not understand what you mean when you say "use a secure passphrase." they think their SSN is secure, it takes a amateur 20 minutes and $30.00 to get someones SSN from one of the big databases by having a name and address or phone number. Most executives info is based off of name + business name in these DB's.

      They can not understand that the

  • This begs the question...... (Score:5, Interesting)

    by 8127972 (73495) on Friday April 13 2007, @08:07AM (#18717161)
    ...... Since there are a ton of these products out there. Does any third party verifiy that they are secure as they are claimed to be? Or are we truly at the mercy of the marketing spin that these companies put out?
  • Even if it had great security, why pay that much when software encryption is Free (and apparently a whole lot more reliable)?

  • Dumb design (Score:4, Interesting)

    by binaryDigit (557647) on Friday April 13 2007, @08:09AM (#18717181)
    The whole thing is just stupid. Oh where to start ...

    - self destruct, great, so if you want to destroy someones data, just grab their memory stick and intentional use bogus passwords. Now that's brilliant. A MS with a builtin self DOS.

    - No security support in hardware, just desolder the actual memory and stick it into your favourite $15 MS. Brilliant.

    - So smug in their design they don't even encrypt the data. Outstanding.

    - Software designed apparently by a 12 yo. Oh wait, a 12yo probably wouldn't have made it so dumb. Maybe it was a 6yo, were there identifiers named after Spongebob characters?

    Actually, the bigger problem is that so many govt agencies approved of this thing, apparently, without it going through any type of remotely rigorous testing and verification. As much as our US govt agencies get ripped for doing stupid stuff, it's clear that they don't have the market cornered on such activity.

    Hey, I have a secure self destructing bridge to sell to ....

    • A MS with a builtin self DOS.
      MS-DOS? Now that would explain a few things...

    • It should have been obvious (Score:4, Insightful)

      by hey! (33014) on Friday April 13 2007, @08:41AM (#18717545) Homepage Journal
      When they are harping on the device's unique technology.

      Unique and secure are mutually exclusive.

      It is not possible, through a feat of sheer genius, to make something that is both novel and demonstrably secure. It turns out that genius isn't a particularly rare commodity. With 6.5 billion people in the world, there are 6,500 people who are walking around with one-in-a-million levels of intellect. Any one of those people, on a good day, can beat any other person on earth in a battle of wits. Any one of of the millions of people with one-in-a-thousand intellects probably can, too.

      Security is the one aspect of technology where state of the art is better than something which advances state of the art. State of the art means nobody has yet, even on the best day they've ever had, been able to beat it. We've seen some recent examples where very narrow vulnerabilities have been found in hashing algorithms, which has forced the state of the art to change slightly to favor drop in replacements. But by in large the state of the art has been remarkably stable over a long, long time. Anybody who claims to have something nobody else has probably has something worthless, if he has anything at all.

      This is why product security is so bad. It's not possible to differentiate yourself based on security, without affecting other areas such as usability. There is considerable irony in this fact: a product that is carefully thought out and implemented using widely known techniques would have a good chance of being unique. The problem is selling the product. Lotus Notes is a good example. It has its strengths and weaknesses, but as of the early 90s it was the most secure email system in the world. In fact it still would be. But it wasn't the easiest to use or administer. Unfortunately their attempts to make the system more attractive were failures. It's never been more attractive than Exchange. But it's always been more secure.

  • There's Your Problem (Score:3, Funny)

    by organgtool (966989) on Friday April 13 2007, @08:14AM (#18717239)
    The developers of the Secustick are looking into the problem and they think that the issue is with their algorithm that encrypts the data into ASCII.

    • Re:There's Your Problem (Score:5, Interesting)

      by vidarh (309115) <vidar@hokstad.com> on Friday April 13 2007, @08:28AM (#18717423) Homepage Journal
      I worked for a company years ago where several of the engineers were seriously impressed when I showed them I could "break" their "base64 encryption" in realtime...

      They had added it to close a previous security problem I'd pointed out with their product that stored an internal customer id in a cookie to grant access to a web app - problem was, the customer id's were allocated sequentially, so anyone brute-forcing it would get access to all their customer data in minutes, including the adress books of the entire top management team.... base64 "encrypting" the customer id was supposed to prevent anyone from trying that trick again... I left that company pretty much as soon as I could..

  • Is the DRM built into SD/SDIO ("Secure Digital") HW already cracked?

  • A surprise and a non-surprise. (Score:5, Insightful)

    by eddy (18759) on Friday April 13 2007, @08:21AM (#18717319) Homepage Journal

    No surprise that the security is non-existant, but a nice surprise that tweakers.net[0] have people skilled enough to do a thorough technical review. Tip-of-the-Hat to the reviewers and keep the good work up. Anyone can run 3D benchmarks and make graphs against the previous generation, but this requires a different level of technical know-how. It's always been my hope that the future would feature this type of review, using reverse-engineering techniques for indepth technical reviews, as a norm not an exception.

    [0] No disrespect to the people of tweakers.net, I mean in the sense of 'any popular review site'.

  • What? They're not suing? (Score:3, Interesting)

    by Fantastic Lad (198284) on Friday April 13 2007, @08:57AM (#18717707)
    So. . , is Secustic a business filled with a large number of morally-abled people, or does Tweakers.net simply hold enough clout to swing the public perception balance between, "Lone Hacker Finds Flaw = Sue Him!" and, "Responsible News Agency Discovers Faulty Product = Retract Immediately While Covering Tracks With Slick PR Weasels!"?

    I am also curious. . . What does the law in the Netherlands say regarding corporate mandates? Are Dutch corps allowed to put other things ahead of generating profit for shareholders?


    -FL

  • Note this sentence in the second paragraph (Score:3, Interesting)

    by jimicus (737525) on Friday April 13 2007, @09:03AM (#18717777) Homepage
    the result is revolutionary, ultra safe and approved by the French intelligence service.

    I think that says quite a lot for the French intelligence service. Unless they wanted an insecure device to be marketed as secure.... black helicopters at the ready.

  • Stupid is as stupid does (Score:4, Insightful)

    by mlwmohawk (801821) on Friday April 13 2007, @09:06AM (#18717809)
    Like other posters, I am at a loss at where to start.

    (1) If you don't have encryption, GOOD ENCRYPTION, you can't protect squat.
    (2) "Self Destruct" is interesting, but unless you have a custom micro-controller on the ram stick, AND an independent power supply, AND the device potted in epoxy, it is all just a made for TV gimmick.
    (3) Password.exe? I didn't see this in the article, but what happens if one plugs it into a Mac, Linux, FreeBSD, etc? Does it just work or does it self destruct?
    (4) With reference to #2, since the article showed that one could make the device read-only, would self-destruct no longer work? If so, it MUST be potted in epoxy.
    (5) Does the "self destruct" operate on the PC or th ram stick? We all know if it runs on the PC, it is doomed to fail.

    If they want to REALLY do this:

    (1) before everything, encrypt the data. This buys the device time to operate and basic security.
    (2) Install a PIC or something that MUST have an encoded heart beat with some sort of hard to reproduce calculated byte pattern.
    (3) Without a valid heart beat, the PIC will simply not enable the flash device.
    (4) With a valid heart beat, the system must pass a valid password hash string within a reasonable amount of time to the PIC, or the data will be destroyed.
    (5) After a number of failed attempts, the PIC will destroy the data.
    (6) When the heart beat stops, the PIC disables the flash. (It is presumed that the software clears he file system cache as well.)
    (7) Pot the damned device in epoxy.

    • Re: (Score:2, Insightful)

      by bcoff12 (584459)
      Yep, traveler mode + solid password + key files = oops I lost the USB stick with my password list on it, oh well.

    • Re: (Score:3, Informative)

      by am 2k (217885)

      Not shipping with debug symbols is important, looks like just that happened here. It also reduces the file size greatly.

      Those devs are very clueless.

    • Re: (Score:3, Informative)

      by mark0 (750639)
      Tell me again why we as Software Engineers are supposed to use descriptive method and variable names?

      So you can maintain the other SE's crappy code.

      But maybe we should look to the security through obscurity methodology as an additional layer of protection.

      That's what obfuscators are for.

    • Re: (Score:3, Insightful)

      by lexarius (560925)
      Shouldn't stripping the debugger symbols from the executable be sufficient? The problem is that people don't give up that easily. Having everything obviously labeled made the job quicker, but not having those won't stop a sufficiently skilled/bored hacker.

      • No (Score:3, Interesting)

        by Opportunist (166417)
        Very simply, no. It increases the bar, but it doesn't make it any less readable. I spend my days with assembler code written by someone else, figuring out how it works and how it does what it does. You get an 'eye' for certain things. You start seeing certain things, how functions run, what functions do what, not by reading the code, just by looking at it. You start being able to interpret the return values of functions, you can 'feel' the code.

        And those guys rarely leave any clues left in the code, often e

    • Re: (Score:3, Insightful)

      by Elladan (17598)
      And this is a great example of why most people shouldn't be allowed near a security product without training. Training which includes getting their head slapped when they say things like this.

      Repeat after me:
      If the debug symbols in your executable have ANY EFFECT WHATSOEVER on the security of your product, your product is insecure.

      Let's say that again:
      Debug symbols are a good thing. They allow people to analyze the behavior of your software better. If analyzing the behavior of your software leads them to

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.