Encryption Cracked On NIST-Certified Flash Drives 252
An anonymous reader writes "USB Flash drives with hardware based AES 256-bit encryption manufactured by Kingston, SanDisk and Verbatim have reportedly been cracked by security firm SySS. These drives are advertised to meet security standards suitable for use with sensitive US Government data (unclassified, of course) as emphasized by the FIPS 140-2 Level 2 certificate issued by the US National Institute of Standards and Technology (NIST). It looks likes the Windows-based password entry program always sends the same character string to the drive after performing various crypto operations."
Re:How does this differ from Truecrypt? (Score:4, Informative)
These aren't disks, they're USB thumb drives. The folks who "cracked" it just figured out a way to bypass the password and send a specific string that ALL of these devices use to access the data on these USB thumb drives. This seems to be endemic to these things. The info isn't encrypted, it's just locked with a password.
Comment removed (Score:5, Informative)
Re:How does this differ from Truecrypt? (Score:3, Informative)
No, it's actually encrypted. The problem is that the command to unencrypt the data is always the same. In other words, a small little widget can sit between the password program and the encrypted disk, and just send the right command string, regardless of what password was entered. Instant decryption.
But still - why do something like try to reinvent crypto, when there's an open format? The license for Truecrypt even allows for commercial use.
Re:Not completely hardware based encryption then? (Score:3, Informative)
> Seems that they did in software what should have been done in the hardware.
Thereby shaving $.93 off their manufacturing costs.
Re:How does this differ from Truecrypt? (Score:5, Informative)
If you set up Truecrypt in portable-mode on a USB key so it acts like these off-the-shelf keys, then it needs administrator privileges to work. That's a big problem for a lot of people.
Re:Truecrypt (Score:5, Informative)
What I got from the article was the following scenario:
1. Drive asks for a password
2. User enters a password
3a. The password is incorrect -> "DO NOT OPEN" message is sent to the drive
3b. The password is correct -> "OPEN" message is sent to the drive
4. User gains access to the drive
The "crackers" simply bypassed steps 1 and 2 and went straight to 3b. You'd of course have to be a complete idiot to design an authenticating mechanism in this manner. TrueCrypt does not share this design.
Re:How does this differ from Truecrypt? (Score:3, Informative)
Assuming your last comment wasn't a rhetorical question, you already know the answer to this: Because the perceived value-add of selling an encrypted drive allows them to charge more than simply bundling TrueCrypt with a bog-standard USB drive. The public justification would be that their software is easier to use (and, if they're feeling particularly full of themselves, more secure).
Re:It's not just the algorithm (Score:5, Informative)
This has nothing whatsoever to do with Microsoft, you troll. RTFA.
The "password" software just sent the "it's OK, decrypt this" to the dongle.
Re:Shouldn't trust the host computer AT ALL (Score:4, Informative)
If you don't trust the host computer, why would you unlock the device at all?
Once its unlocked and mounted, anything on the computer can access it anyway.
Re:Truecrypt (Score:5, Informative)
If you were to check the flash drives partitioning, you'll see that it has two separate partitions. The section with encryption program is on the primary partition of the flash drive. When the program executes, you get access to the other partition.
Now I've mounted those drives under Linux by bypassing the login process. Instead of mounting sdc1 (assuming sdc is your encrypted flash drive), you mount sdc2. What I've learnt is that the drive isn't encrypted at all - nor password protected. If you can find a way to format the first partition, you pretty much kill the password protection that comes with the flash drive. The "protected" partition just becomes the default partition when the primary one is unavailable.
TrueCrypt or any other data encryption method is the right way to actually secure your data
Sigh, no (Score:3, Informative)
Correct stuff was already explained above by someone else:
http://it.slashdot.org/comments.pl?sid=1498504&cid=30658760 [slashdot.org]
The flaw is in the hardware, at least according to TFA. It works like this:
1) SW: OK, let's decrypt the drive, HW, you gives me dat0rz ... OK pass hashes to correct value
2) HW: not so fast SW, you have to confirm if I should give the dat0rz
3) SW: Oh, right silly me, you give me challenge hash then
4) HW: Here u go
5) SW: kthx
6) SW: User, I need pass to verify challenge hash
7) US: here's pass, now give me dat0rz!
8) SW: Working
9) SW: Hey, HW! Guess what? I got correct pass, so it's cool for you to give me dat0rz!
10) HW: cool, here u go!
What these guys did was just make some rogueware
1) RW: OK, let's decrypt the drive, HW, you gives me dat0rz
2) HW: not so fast SW, you have to confirm if I should give the dat0rz
3) RW: Hey, HW! Guess what? I got correct pass, so it's cool for you to give me dat0rz!
4) HW: cool, here u go!
So yes, the problem is that the hardware is not conducting the challenge itself, but depending on software to do it. Also mentioned above, some clueless people were saying that the data on the drive isn't hardware encrypted. No, I assure (again, according to TFA) you, the data is hardware encrypted. But if it's using this scheme, then it isn't encrypted with the hashed key of your password. Your password is only hashed and stored on the drive, but the data must use the same key(set) on all drives. Even without the crappy auth design, this would still be a problem because it dramatically reduces the keyspace if you have physical access. This is most definitely a hardware flaw.
Next class, we're going to go over substitution ciphers! Remember, you have a pop quiz tomorrow on SQL parameterization and validation!
Re:Standards urgently required.... (Score:1, Informative)
There is a standard way under Linux, its called LUKS + DM-Crypt
I use it everywhere I go, the kernel (Linux) and a ram disk allow me to boot my own OS on any computer as long as the computer is allowed to boot from a USB key. The OS's partitions are encrypted and so is everything else.
Insider (Score:3, Informative)
First and foremost the vulnerability described in this article is related to only the secure flash drives stated in TFA. There are several others available that do not have this vulnerability because instead of password matching in software, they match in Hardware of Firmware, run on the drive itself. Are there others within the industry that may be susceptible? Probably, but all secure flash drives certainly are not. Look to only use drives with password matching done on-chip (HW/FW).
How could a FIPS 140-2 certified flash drive have this vulnerability? Well FIPS is great to prove you use certified encryption algorithms, authentication methods, and so on, but FIPS does not certify the whole system. This is one of those very important security areas that fall outside of the FIPS umbrella. In the future look for additional certifications that will encompass the entire system rather than just the encryption like FIPS..
Why not just use TrueCrypt?? TrueCrypt is a great product, there is no doubt. But at its core, TrueCrypt is a software encryption container for your data. There are some inherent shortcomings with software encryption on USB flash drives.
1. Performance is sacrificed since your PC CPU needs to perform all security operations in software, rather than on the hardware of the flash drive.
2. Though it may work well for consumers that *want* to have their data secure, TrueCrypt would be a nightmare in an enterprise setting. Users could format the drive, or store files outside of the encrypted partition just to make things easier. This is not possible on secure flash drives with forced data encryption via hardware. with these drives an Admin knows that if he sees a drive by company X, that the data on it must be secure. Just to name a couple..
I hope this is helpful to some.
Re:Truecrypt (Score:3, Informative)
If you were to check the flash drives partitioning, you'll see that it has two separate partitions. The section with encryption program is on the primary partition of the flash drive. When the program executes, you get access to the other partition.
Now I've mounted those drives under Linux by bypassing the login process. Instead of mounting sdc1 (assuming sdc is your encrypted flash drive), you mount sdc2. What I've learnt is that the drive isn't encrypted at all - nor password protected. If you can find a way to format the first partition, you pretty much kill the password protection that comes with the flash drive. The "protected" partition just becomes the default partition when the primary one is unavailable.
TrueCrypt or any other data encryption method is the right way to actually secure your data
IF in fact what you've discovered is true across several vendors "FIPS certified" flash drives, then I'm not sure what is more disturbing; The idiot who designed this "encryption" scheme, or the idiot in charge of rubber stamping the FIPS certification on it.
I knew there was more than one reason I use TrueCrypt everywhere...
Re:IronKey? (Score:5, Informative)
Re:It's not just the algorithm (Score:3, Informative)
I used to do FIPS, Common Criteria and Interac certifications.
For starts we were paid by the manufacturer of the device so every device passed. There was one case where a product was so obviously flawed we decided not to take the money and they device was certified by another certification shop.
Second, the cost for the certification is fairly competitive and the competition has driven the price down to the point where the money paid just barely covers doing the paper work. The actual investigation of the devices or software is only hours.
Third, NIST is extremely sloppy in checking up on the certification houses. They are even sloppy about verifying their own tools for doing known answer tests for well know algorithms.
Re:How does this differ from Truecrypt? (Score:3, Informative)
No, Traveler Mode (running on a machine without TrueCrypt installed) requires admin privileges.
If TrueCrypt was installed by someone with admin privs, non-admins can then mount TrueCrypt volumes.
Re:Shouldn't trust the host computer AT ALL (Score:3, Informative)
Re:Who cares? (Score:1, Informative)
I found your mom's hole last night. And fucked it hard.