Cracking a Crypto Hard Drive Case 238
juct writes "A label on the box reading 'AES' does not ensure that your data are protected. heise examined a hard drive enclosure with an RFID key that is typical of many similar products. They found that the 128-bit AES hardware encryption claimed in advertisements was in fact a simple XOR encryption that they were able to break easily with a known plaintext attack." The manufacturer of the drive examined has announced that the product is being retooled and will be reintroduced later this year, presumably with actual AES encryption.
How about a software solution? (Score:5, Interesting)
Re:How about a software solution? (Score:5, Interesting)
Re:So what happens... (Score:5, Interesting)
Re:XOR encryption can be good (Score:5, Interesting)
The only exception I've read about is SEAL [wikipedia.org] but IIRC that's still patented by IBM.
This is nothing new (Score:4, Interesting)
Re:How about a software solution? (Score:5, Interesting)
That won't help you. You need to read Reflections of Trusting Trust by Ken Thompson: http://cm.bell-labs.com/who/ken/trust.html [bell-labs.com]
Re:So what happens... (Score:3, Interesting)
er wait, sorry. well some companies REALLY do rely on copyright for security. An example is the ASSA key and lock company. They make some really nice keys, but what makes them hard to copy? Copyrights on the "code" represented by the teeth on the keys.
This is totally different than a patent on a real cool key, it's a copyright on the "data" that essentially is the serial number for sales account, dealer, region, and country.
Their whole selling point is that no one can copy a key if it's copyrighted. I mean, shit...it worked for other industries... (:
Re:How about a software solution? (Score:3, Interesting)
The good thing about crypto in a hard drive case (Score:4, Interesting)
Re:Criminal prosecution? (Score:3, Interesting)
Stop suggesting software and give us viable (ie secure) hardware alternatives.
What are the not-so-cheap external enclosures?
Linux AES better or not? (Score:3, Interesting)
Re:How about a software solution? (Score:3, Interesting)
Why would they bother, except as a sort of read-only compatibility mode to recover Windows volumes?
Under Linux, you already have stable loopback device support. You can literally encrypt (or compress, or snoop, or whatever filter you can think of applying to block-device traffic) anything, without needing another tool to do it.
WTF? (Score:4, Interesting)
If I sell you a padlock, claiming that its made of steel, when actually its made of a Silly Putty and rubber bands, then I'm going have my day in court. Why Tech vendors seem TOTALLY immune to this kind of prosecution.
Puts me in mind of SecuLock (was that the name?), they were featured here a while back, they make "secure" USB memory sticks, they claimed AES encryption, killswitches and other bells and whistles, but if you were to have a quick look at one of the DLL's exports, you can see a an Unlock routine. You see, the user's password wasn't used as a key, Oh no, they had one global key and a simple IF to check the passwords.
Though this is much, much worse, it beggars the question; how can we berate employees for losing disks and laptops, when the vendors are happy to look us in the eye and lie to us, about standards that I was able to implement when I was about 16.
It's either government interferance (remember, the USA's law forcing vendors to embed backdoors for them), or its just plain lazy, either way, it's got to stop.
Re:Criminal prosecution? (Score:3, Interesting)
Freecom equally bad (Score:5, Interesting)
Agreed. This is exactly what freecom did when they sold me a usb bluetooth adaptor with an antenna. I dropped it one day, and the little case popped open. OK, that happens; no big deal. What WAS a big deal though, was the antenna -- it was simply a bit of plastic, swinging from a hole in the case. There were no wires attached to this, nothing else near it that even suggested it might have accidentally been shipped with a "placeholder" or something like that. It was simple, unadultered fraud. The antenna might as well have been made by Tomy, which is a shame, as otherwise, it worked fine, and the antenna probably was unnecessary after all (I bought that model FOR it's antenna figuring it wouldn't hurt, and might help).
What do freecom gain from this? Something like $5, I'd guess, after the store etc. take their cuts.
What do they lose? Me, as a an IT industry purchaser, ever buying their products again. Me telling other IT people on slashdot what I think of Freecom.
What could they have done instead, to compete with manufacturer X's? "We're confident in our product's reception/transmission, and have no need for gimmicks like the antennas manufacturer X uses." I probably would have bought a lot more of their stuff after that.
Dumbasses.
Jump the train! Get into IT-Sec! (Score:3, Interesting)
How do you know? Well, companies finally realize that yes, we want some sort of security. They usually have no idea about it (how should they, their administrators are usually some goons hired from the street who know how to use a mouse, what makes them administrators is that they know that TCP/IP ain't the Chinese secret service. MAYBE they can build a VPN tunnel). But encryption?
You know what the brass level says in this case: "Ain't there some product we can buy?" And in comes stuff like this. Stuff that promises security. Nobody can verify it (in the average company), but their admin might even have heard of AES, knows it's decent and thus buys the product. Why? Hey, it says "AES encryption" on the box!
We'll see a lot more products like this in the near future. Then, in about 2 years, companies will realize that they will have to spend money on people to get real security. It's just like it was with the advent of networking and later when "the internet" came into companies. First, they tried to buy products (which were just as shoddy as this one, promising "easy installation" wonders only to work
It will be the same with security. Today you have the "buying the wonders" phase. Give it two years and companies will start to train or hire security people. Yes, many will stick with the goons with better fast-talking skills than IT skills, but some will go for good security people.
So, personally, I'd start digging into that sector. We'll see more of that soon.