Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Data Storage Hardware

Protected Memory Stick Easily Cracked 220

Posted by kdawson from the not-that-hard-a-hack dept.
Martin_Sturm writes "A $175 1GB USB stick designed to protect your data turns out to be a very insecure. According to the distributer of the Secustick, the safety of the data is ensured: 'Due to its unique technology it has the ability to destroy itself once an incorrect password is entered.' The Secustick is used by various European governments and organizations to secure data on USB sticks. Tweakers.net shows how easy it is to break the protection of the stick. Quoting: 'It should be clear that the stick's security is quite useless: a simple program can be used to fool the Secustick into sending its unlock command without knowing the password. Besides, the password.exe application can be adapted so that it accepts arbitrary passwords.' The manufacturer got the message and took the Secustick website offline. The site give a message (translated from Dutch): 'Dear visitor, this site is currently unavailable due to security issues of the Secustick. We are currently working on an improved version of the Secustick.'"
This discussion has been archived. No new comments can be posted.

Protected Memory Stick Easily Cracked More

Protected Memory Stick Easily Cracked

Comments Filter:

  • Well they could have been like other companies (Score:5, Insightful)

    by insanemime ( 985459 ) on Friday April 13, 2007 @07:57AM (#18717041)
    At least they had the balls to admit that something was wrong and try to take steps to fix it. It will be intresting to see if they recall the ones already sold.

    • Re:Well they could have been like other companies (Score:4, Interesting)

      by tritonman ( 998572 ) on Friday April 13, 2007 @08:07AM (#18717157)
      Destroying the contents on a bad password attempt is crazy. Especially when you use very cryptic passwords. People tend to type wrong, hold the shift key down too long, not hold the shift key down when necessary. Sometimes I have to type my passwords two or three times before getting it right. Destroying important sensitive information because I accidentally typed it wrong is just plain stupid. These kind of technologies will only be a pain for people using them legitimately, and anyone who wants to hack to get the information will generally be able to find some way to get it, thus it is only extends the problems and provides no solutions.
      • ...where N could be set on first initializing the stick. And I assume you could change this later provided you had already given the correct password, but the article doesn't go into that.

        So it's not a case of typing it wrong once and *poof* goes the data (note that they didn't find any physical evidence of things in there capable of physical destruction either). If you set it to 3 times, and you get it wrong 3 times yourself - oh well. Maybe you *could* set it to only once, though.. but if you do that,

      • Re: (Score:3, Interesting)

        by computational super ( 740265 )

        Depends on how much trouble you'll get in if law enforcement agents manage to get at the data... seeing as how that's the only *possible* use I can imagine these things would ever be put to.

        • I sense a possible lack of imagination here. (is that a good enough flame for you?)

          Working from home, but needing to carry sensitive data.

          Or consultants that have to travel, and carry sensitive documents.

          Lots of legal reasons as well.

      • Re:Well they could have been like other companies (Score:5, Insightful)

        by FuzzyDaddy ( 584528 ) on Friday April 13, 2007 @08:33AM (#18717463) Journal
        I don't know about you, but I don't keep original copies of data on a USB key. I use it to transfer files from one computer to another, so wiping the data after unsuccessful attempts, in this context, strikes me as a good idea.

        • I don't know about you, but I don't keep original copies of data on a USB key.

          Quite - if the data is important enough to protect, it's important enough to backup. I've not had good experiences with reliability of USB sticks either - I've encountered two (in my limited experience) that had the habit of occasionally showing up as 'unformatted' when you plugged them into a PC. Mostly they worked, but sometimes they decided to vape themselves.

          But then, it's a bit like expecting hard drives to never die, I guess.

    • Re:Well they could have been like other companies (Score:5, Insightful)

      by antime ( 739998 ) on Friday April 13, 2007 @08:12AM (#18717217)
      What they admitted is that they have no idea what they are doing and have no idea what they are selling. You would have to be an idiot to buy anything security-related from a company like that.

      • Re: (Score:3, Insightful)

        by rucs_hack ( 784150 )
        it's not that silly. They saw a way to make money from the current delusion that data can be unbreakably secured.

        The only way to secure data is to make it so absolutely no-one but the authorised people have access to it. You can keep data secure physically if you isolate it from any form of access. However information does not work well if isolated like that, information has to be shareable to be useful, otherwise its just dead data, worthless bits.

        I have several pieces of information that are unhackable. T

        • Re:Well they could have been like other companies (Score:4, Insightful)

          by @madeus ( 24818 ) <slashdot_24818@mac.com> on Friday April 13, 2007 @09:01AM (#18717745)

          it's not that silly.
          I contend it is not only silly, but sufficently bad to warrent legal action, because whoever built it must have known how badly it was designed to start with.

          It appears that the system doesn't use a form of encyption unlocked by a key (entered by the user) to store the data - and that instead it simply requires use of a single instruction to the USB device indicate the data ought to be accessible or not. That just sounds ludicrous.

          If it had been developed in good faith, and this were a bug (rather than part of the design) and/or the result of a sphosticated exploit that it would have been hard to predict, I would be sympathetic. As I would if they had clearly indicated it's limitations (which they could have, but if they've taken the website down now, I'm guessing not).

          What's particularly telling for me is, while the company were quite happy to tout the supposed virtues of the product, they are clearly worried about it now they have been found out. That repesents a staggering failure by the designers of the software, their managers, the marketing and product design teams, the HR department who hired all these people of clearly very dubious virtue and the senior management involved.

          Either they are crooks (because they were complicit in touting such a crummy product that didn't really do what it claimed to do in a reasonable way) or are they are all, really, really dumb (and none of them asked pertinent questions of the other parties at any stage of product development).
        • You are as deluded as they are. Nothing, I repeat NOTHING can be 100% secure. As long as a single person can have access, knows where the data is, someone else can gain access. By luck, hacks, reasoning, cracking, torture, etc. It's always a question of TIME required to get access, but it's always possible. Modern forms of encryption almost exclusively repose on such a principle: publick-key cryptography stands on the difficulty of factoring very large numbers with the current computers and algorithms, whic
      • You would have to be an idiot to buy anything security-related from a company like that.

        Which is a shame for this company, because idiots are in such short supply these days...

      • Re: (Score:2)

        by neoform ( 551705 )
        well, on the upside.. at least breaking the security doesn't involve a sharpie..

    • Re:Well they could have been like other companies (Score:5, Interesting)

      by Lazerf4rt ( 969888 ) on Friday April 13, 2007 @08:24AM (#18717355)

      Well, not completely. A spokesperson for the product is reported saying:

      Our customers are happy with the level of protection that our product offers. Normally, the amount of security is sufficient, not everyone has the technical expertise that you have.

      This is quite a different statement from the one made near the start of the article.

      The stick was commissioned by the French government and - according to the company's press release - the result is revolutionary, ultra safe and approved by the French intelligence service.

      Funny part is, all they did was run the program in a debugger, put a breakpoint after the clearly labelled "VerifyPassWord" function, and change the return value from 0 to 1. Pretty embarassing. But the article went pretty easy on them after that. Really good read by the way.

      • Re: (Score:3, Insightful)

        by Opportunist ( 166417 )
        If you're satisfied with a level of security that was proven to be broken easily, you prove that you don't need any security altogether.

        If people don't bother breaking your security, they aren't that interested in your information in the first place.
        If people who are interested in your secrets are able to do so trivially, you can just as well abstain from encryption altogether to save you the hassle.
      • I love the part where it is "approved by the French intelligence service". Of course it is, since it's so easy to break. Of course it's not approved for their own use, they just want everybody else to use it.

      • Funny part is, all they did was run the program in a debugger, put a breakpoint after the clearly labelled "VerifyPassWord" function


        Wait. The executable was compiled with debug symbols turned on? With functions with easy-to-understand names? I mean, I know it's only security-through-obscurity, but c'mon! At least up the ante a little bit ... many programmers are not skilled enough to disassemble a program with no symbol table. And the ones that are ... *shrug* rely on the security of your methods, not on the obscurity of your code. IOW, they should have used encryption, even with the self-destruct mechanism.

        • Re: (Score:2, Informative)

          by Anonymous Coward
          Read the article again - nothing to do with debugging symbols. The function names mentioned are DLL function names. Read up on DLL to figure out why those are not obfuscated.

          • Re: (Score:3, Insightful)

            by morgan_greywolf ( 835522 ) *
            Ah, didn't see that part I guess. But still, with DLL functions you can name your function something like zxgvflqrt() or something.

            Still, there's no reason why one has to use DLLs, either. You can put everything into one .exe file if you like.

            • Re: (Score:3, Insightful)

              by Viol8 ( 599362 )
              "You can put everything into one .exe file if you like."

              That would be the sensible way to go since its unlikely any other app would ever use that .dll. But sensible isn't something that generally applies to Windows programs these days as the amount of .dll splatter from even the simplest apps testifies.

      • Our customers are happy with the level of protection that our product offers.

        Duh.

        Does that remind anyone else of "Most people don't even know what a rootkit is, so why should they care?"

        Oh my god, some people are really projecting their own dumbness at their customers. Such marketroids should really be sacrificed to the war against terror. Or cluebatted.

    • Re: (Score:2)

      by morcego ( 260031 )

      At least they had the balls to admit that something was wrong and try to take steps to fix it. It will be intresting to see if they recall the ones already sold.

      I was going to comment on that too.
      I find it very decent of them to not only assuming there is a problem, but also taking off their site, even if it means they might be loosing business.

      Keeping their clients' trust means much more than technical security, but also they can be trust to react correctly when an issue like this happens.

      I know we should

    • I agree, but I wonder how much of it has to do with liability. If they're selling them to governments, they probably have to guarantee that they're unbreakable.

  • Nice one! (Score:5, Interesting)

    by Anonymous Coward on Friday April 13, 2007 @08:00AM (#18717075)
    At least the manufacturer is doing the right thing and eating crow over this. Here in the US the company would probably have just sued the hackers under DMCA while continuing to sell the defective product.

  • Just put - (Score:5, Informative)

    by ditoa ( 952847 ) on Friday April 13, 2007 @08:04AM (#18717115)
    TrueCrypt on a memory stick with an encrypted volume file with a good passphrase and your data will be secure from pretty much anything. I have not heard of TrueCrypt being cracked yet.

    • TrueCrypt on a memory stick with an encrypted volume file with a good passphrase and your data will be secure from pretty much anything. I have not heard of TrueCrypt being cracked yet.

      I use an encrypted image generated by the Apple Disk utility which is capable of creating AES-128 encrypted DMG's. I don't know if aes-128 has been cracked yet but even if it has I rather doubt any thief will go to the trouble of trying to access my data. Of course I might be unlucky enough that my memory stick is stolen by a super Hacker who will go to the trouble of cracking my little DMG crypto image but that seems highly unlikely.

    • Sadly, they weren't smart enough to layer a self-destruct over an encrypt.

      • Re: (Score:2)

        by jimicus ( 737525 )
        I doubt the data was encrypted in the first place. If it was, they certainly didn't use the password as the key to encrypt it because a wrong password still gained access to the data.
  • password.exe seems to me that it would be a Win32 application. So, what if I put this in a Linux PC? Surely it's encrypted somehow? Maybe I need to read the article again, but I didn't see any mention of encryption.
    • ... as far as the article details.

      The password.exe does, however, address a controller chip. Without the correct password, the controller chip will simply refuse to provide further access to the flash memory.

      So if you're really wondering - I would imagine that the entire thing won't work with Linux, period.
      • ... but "It should be clear that the stick's security is quite useless: a simple program can be used to fool the Secustick into sending its unlock command without knowing the password."
        huzzah! a linux version should soon be in the works! ;)
      • ...unless someone sends the giveAccess()-command to the controller, which should be pretty easy.

      • Re: (Score:3, Insightful)

        by AJWM ( 19027 )
        Without the correct password, the controller chip will simply refuse to provide further access to the flash memory.

        So even if the password control worked (which it doesn't), you could get at the contents by desoldering the flash chip and putting it in a reader. (Something hobbyists have been doing with HD-DVD drives to reverse engineer/modify the firmware.) And this is a supposedly intelligence-service recommended device for government use? Right, go on, pull the other one.

  • TrueCrypt (Score:5, Informative)

    by Teckla ( 630646 ) on Friday April 13, 2007 @08:05AM (#18717131)

    Most Slashdotters know you should not trust the built in security on these devices.

    The solution for real security on these devices is to use TrueCrypt [truecrypt.org].

    It's not hard to use, though the more technical among us may need to help out the less technically inclined to get things rolling. Once it's setup, though, it's secure and easy to use.

    • Re:TrueCrypt (Score:5, Insightful)

      by Rob T Firefly ( 844560 ) on Friday April 13, 2007 @08:12AM (#18717215) Homepage Journal
      The type of people who have got the wherewithal to set up TrueCrpyt are not the market this was aiming for. This seems like a product made for the techno-clueless PHB types who just want to buy something off the shelf they can stick in their magic computer box and have it "just work," and who see that high a price on a simple 1-gig USB stick not as an obvious ripoff, but as a measure of how much good computer magic it must surely contain.
      • Funny and insightfull.

      • The type of people who have got the wherewithal to set up TrueCrpyt are not the market this was aiming for. This seems like a product made for the techno-clueless PHB types who just want to buy something off the shelf they can stick in their magic computer box and have it "just work," and who see that high a price on a simple 1-gig USB stick not as an obvious ripoff, but as a measure of how much good computer magic it must surely contain.

        So they designed a flawed product. Slashdot folks tend to complain about how companies keep coming out with crummy products. Is it realistic to expect one billion MS Windows (tm) users to get a CS degree so they understand its shortcomings and are able to recognize these crummy products. Maybe it is time to switch to Apple products so you don't have to worry about trojan horse AUTORUN.EXE flaws in Windows. Corporate IT professionals were hired to help free users from the burden of maintaining their PCs muc

      • Elsewhere in this thread, it's pointed out that you shouldn't have to be an expert in crash testing to be able to buy a car that's safe. I tend to agree. While I see your point about PHBs and throwing money at problems, I've also reached the stage in life where I have (some) money and little enough time to futz around with doing everything from scratch. When I was a kid, I personally, carefully, expertly assembled every round of ammunition I shot; nowadays I'm likely to grab a box off 9's at the sporting

        • Elsewhere in this thread, it's pointed out that you shouldn't have to be an expert in crash testing to be able to buy a car that's safe.

          But you don't have to be an expert to know the difference between buying a car from an established company with certificates on the windows, publicly available crash test ratings, and a legally mandated inspection every so often.. and buying a jumbled mass of bolts, pipes, wheels, and a barber's chair that some guy you've never heard of made in his garage and calls a "car

    • BTW, what is in this device that disallows me to dd if=/dev/sdb1 of=usb_bckp? I think the basic concept is flawed, there is no true security in a portable device that someone else can physically take away.

    • Re: (Score:2)

      by Lumpy ( 12016 )
      unless the idiot executive uses his SOCIAL SECURITY NUMBER as his passphrase.

      biggest problem with non technical people like CEO's CFO's CTO's and the like is they can not understand what you mean when you say "use a secure passphrase." they think their SSN is secure, it takes a amateur 20 minutes and $30.00 to get someones SSN from one of the big databases by having a name and address or phone number. Most executives info is based off of name + business name in these DB's.

      They can not understand that the
      • Security is always the minimum of the technical capabilities and the user capabilities. That's a given. Security is like a castle defending against an invader. It doesn't mean jack if one side is invincible if the other one is made out of plywood. All sides have to withstand the assault.

        I know that there are ways to improve the technical side to the point where it can be trusted to be Fort Knox. The human factor is the limit, and if I knew a way to improve the human side of security, I'd be traveling from c

      • Re: (Score:2)

        by Bandman ( 86149 )
        My last few passwords have been the last 6-10 characters of my /etc/shadow file's md5 sum. I memorize it, change the password, and it can't be recovered (at least without knowing the previous password, which was likely to be based on the previous md5sum...

        • Cute approach, but it does have one significant shortcoming. Namely, if someone ever does compromise your password and your method, they'll have continuous access to your system until you detect their presence. This makes password changes less useful. You're using the MD5 entropy as a substitute for true randomness and it doesn't quite work.

          Of course, in practice, unless you do something silly like posting your method on a publicly accessible message board, no one's likely to figure out where you're pull

        • Re: (Score:2)

          by ajs318 ( 655362 )
          You do realise that anyone with a boot disk can just slip it in the CD-ROM drive, reboot, mount your old / directory under (say) /mnt ; and then they only need to do # vi /mnt/etc/shadow and change the scrambled password for one they prepared earlier? If they are smart they will then change /bin/login for a hacked one which will accept a hardcoded default password, return your /etc/shadow to its former state, reboot from hard disk and come back later via the internet.
    • Don't you need Admin Priv's for Truecrypt to run under windows?
      Even the `portable` mode as far as i remember.

      • You say that like there's any manager in the world that doesn't insist in having admin privs on 'his' (company) PC...

  • This begs the question...... (Score:5, Interesting)

    by 8127972 ( 73495 ) on Friday April 13, 2007 @08:07AM (#18717161)
    ...... Since there are a ton of these products out there. Does any third party verifiy that they are secure as they are claimed to be? Or are we truly at the mercy of the marketing spin that these companies put out?

    • Re:This RAISES the question...... (Score:5, Informative)

      by Xanni ( 29201 ) on Friday April 13, 2007 @08:12AM (#18717227) Homepage
      http://begthequestion.info/ [begthequestion.info]

    • Re: (Score:2, Informative)

      by CowTipperGore ( 1081903 )
      First, it doesn't beg the question [wikipedia.org]. Please learn the proper use of the phrase.

      Since there are a ton of these products out there. Does any third party verifiy that they are secure as they are claimed to be? Or are we truly at the mercy of the marketing spin that these companies put out?

      According to TFA, the product was commissioned by the French government and is approved by the French intelligence service. It also is reportedly used in the defense and banking industries. One would hope that there would be some sort of verification by knowledgeable IT folks prior to approval by all these groups, but it appears that no one gave it a real examination.

    • Mod +1 erudite-sounding (Score:4, Funny)

      by jpellino ( 202698 ) on Friday April 13, 2007 @08:32AM (#18717453)
      mod -5 absent-the-day-they-covered-fallacies

    • There are actually such companies. But they have huge drawbacks that explain why so few makers of security devices go through the hassle.

      1. They don't simply hand out their seal of approval like it's a "Vista compatible" sticker. They actually DO test your stuff.
      2. They don't refrain from telling you if your product is actually flawed, and (what's worse), they don't even stay silent when you toss it on the market regardless.
      3. Managers don't know jack about them, they don't care about security seals and lis
  • Even if it had great security, why pay that much when software encryption is Free (and apparently a whole lot more reliable)?
    • Because decisions like that aren't made by your tech crew but by some managers who usually have 2 things in mind when making those decisions:

      1. This which doesn't cost anything has no value.
      2. If there is no company behind it, we cannot sue anyone if it breaks (because we all know MS is close to bankrupcy because of those horrible lawsuits that follow their blunders).

    • Re: (Score:2, Funny)

      by Falladir ( 1026636 )
      It's sexy to have a device that can actually self-destruct. This is the flash drive that James Bond would use.

  • Dumb design (Score:4, Interesting)

    by binaryDigit ( 557647 ) on Friday April 13, 2007 @08:09AM (#18717181)
    The whole thing is just stupid. Oh where to start ...

    - self destruct, great, so if you want to destroy someones data, just grab their memory stick and intentional use bogus passwords. Now that's brilliant. A MS with a builtin self DOS.

    - No security support in hardware, just desolder the actual memory and stick it into your favourite $15 MS. Brilliant.

    - So smug in their design they don't even encrypt the data. Outstanding.

    - Software designed apparently by a 12 yo. Oh wait, a 12yo probably wouldn't have made it so dumb. Maybe it was a 6yo, were there identifiers named after Spongebob characters?

    Actually, the bigger problem is that so many govt agencies approved of this thing, apparently, without it going through any type of remotely rigorous testing and verification. As much as our US govt agencies get ripped for doing stupid stuff, it's clear that they don't have the market cornered on such activity.

    Hey, I have a secure self destructing bridge to sell to ....

    • A MS with a builtin self DOS.
      MS-DOS? Now that would explain a few things...

    • It should have been obvious (Score:4, Insightful)

      by hey! ( 33014 ) on Friday April 13, 2007 @08:41AM (#18717545) Homepage Journal
      When they are harping on the device's unique technology.

      Unique and secure are mutually exclusive.

      It is not possible, through a feat of sheer genius, to make something that is both novel and demonstrably secure. It turns out that genius isn't a particularly rare commodity. With 6.5 billion people in the world, there are 6,500 people who are walking around with one-in-a-million levels of intellect. Any one of those people, on a good day, can beat any other person on earth in a battle of wits. Any one of of the millions of people with one-in-a-thousand intellects probably can, too.

      Security is the one aspect of technology where state of the art is better than something which advances state of the art. State of the art means nobody has yet, even on the best day they've ever had, been able to beat it. We've seen some recent examples where very narrow vulnerabilities have been found in hashing algorithms, which has forced the state of the art to change slightly to favor drop in replacements. But by in large the state of the art has been remarkably stable over a long, long time. Anybody who claims to have something nobody else has probably has something worthless, if he has anything at all.

      This is why product security is so bad. It's not possible to differentiate yourself based on security, without affecting other areas such as usability. There is considerable irony in this fact: a product that is carefully thought out and implemented using widely known techniques would have a good chance of being unique. The problem is selling the product. Lotus Notes is a good example. It has its strengths and weaknesses, but as of the early 90s it was the most secure email system in the world. In fact it still would be. But it wasn't the easiest to use or administer. Unfortunately their attempts to make the system more attractive were failures. It's never been more attractive than Exchange. But it's always been more secure.

  • There's Your Problem (Score:3, Funny)

    by organgtool ( 966989 ) on Friday April 13, 2007 @08:14AM (#18717239)
    The developers of the Secustick are looking into the problem and they think that the issue is with their algorithm that encrypts the data into ASCII.

    • Re:There's Your Problem (Score:5, Interesting)

      by vidarh ( 309115 ) <vidar@hokstad.com> on Friday April 13, 2007 @08:28AM (#18717423) Homepage Journal
      I worked for a company years ago where several of the engineers were seriously impressed when I showed them I could "break" their "base64 encryption" in realtime...

      They had added it to close a previous security problem I'd pointed out with their product that stored an internal customer id in a cookie to grant access to a web app - problem was, the customer id's were allocated sequentially, so anyone brute-forcing it would get access to all their customer data in minutes, including the adress books of the entire top management team.... base64 "encrypting" the customer id was supposed to prevent anyone from trying that trick again... I left that company pretty much as soon as I could..

  • Is the DRM built into SD/SDIO ("Secure Digital") HW already cracked?

  • A surprise and a non-surprise. (Score:5, Insightful)

    by eddy ( 18759 ) on Friday April 13, 2007 @08:21AM (#18717319) Homepage Journal

    No surprise that the security is non-existant, but a nice surprise that tweakers.net[0] have people skilled enough to do a thorough technical review. Tip-of-the-Hat to the reviewers and keep the good work up. Anyone can run 3D benchmarks and make graphs against the previous generation, but this requires a different level of technical know-how. It's always been my hope that the future would feature this type of review, using reverse-engineering techniques for indepth technical reviews, as a norm not an exception.

    [0] No disrespect to the people of tweakers.net, I mean in the sense of 'any popular review site'.

  • I trust exactly one encryption product: GnuPG. It's had it's pucker moments, such as the El Gamal signing key problem (IIRC - and I'm too lazy to look it up right now), but those problems get fixed and we move on. Given the choice of whether to trust a little hardware gimmick or a piece of Free Software that millions of people use, even if they don't realize it, I'll stick with the code. If/when problems arise, I believe that it's developers will look out for my interests and not their bottom line.

    Havi

  • So French intelligence really IS an oxymoron. Go figure.
  • to not trust closed-source software for anything security-related. And the EU as well.
  • Sorry, I don't have the time to research the device, but what kind of testing/validation of this product was done? If this was for a government originally, shouldn't it have to have demonstrated some kind of hacker proof level of security? What was on the package was it marketing hype ("Protects your data from targeted attacks" which means nothing) or an indication that some kind of testing was done (ie "Meets MIL-1234 requirements for data security")?

    It looks like that for $175, you get a 1GByte USB key,
    • This is the post I'll reply to.

      On other days, we discuss things like "Linux may be too hard for Average Joe". That's because we use a statistical example of {Total Users}*{Skill Level of 68% of Users}.

      This stick WILL be secure ... *against Average Joe!*.

      There's only one problem: That's the wrong audience. When you label something "Top Secret"... you are thundering a challenge for the whole world to take their best shot. The rules change.

      Maybe "The Best Hackers Money Can Buy" will always win. Fine.
      But at a m
  • The password wasn't even used as the base for the crypt key, it was just matched against the stored passphrase and the result set a bit, then checked and depending on the outcome the program decrypted the content by a predefined algo. Hello? That was outdated before I started learning Assembler! All it takes to break that is a kid with Olly lying 'round on his HD. Soldering? Why the hassle when you can rip the data far easier.

    Whether they fix that stick or not, after showing just how much clue they got abou
  • Lexar Discussion: http://www.securityfocus.com/bid/11162/discuss [securityfocus.com]
    This was also on slashdot: http://slashdot.org/article.pl?sid=04/09/14/185523 2 [slashdot.org]

    I wouldn't trust USB stick security unless there was a 3rd party assessment of the security from a reputable security firm and that assessment was published. Customers need to start demanding this. What track record do these companies have on security?

    The bad thing about hardware is how do you patch the security hole? All hardware these days should have the ability
    • The answer is simple:
      If you want a safe, don't start with a greenhouse. Start with a metal box. Adding a layer of security ontop of something insecure doesn't work well, as people can peel back layers. If you want something to REALLY be secure, start with something inherantly secure. If you constantly need to patch something for security holes your method was flawed from the start.

      If the flash chip can be removed on it's own, it can be put in something insecure. If you must use this scheme, make sure the in

    • I wouldn't trust USB stick security unless there was a 3rd party assessment of the security from a reputable security firm and that assessment was published.

      "USB stick security" seems to be something that is largely unnecessary in the first place. You don't need any special security on the stick, assuming you have reasonably strong encryption available on the computers you use the stick with: you encrypt data, give it to the stick, and decrypt it when you take it off. There are vanishingly few cases where

  • What? They're not suing? (Score:3, Interesting)

    by Fantastic Lad ( 198284 ) on Friday April 13, 2007 @08:57AM (#18717707)
    So. . , is Secustic a business filled with a large number of morally-abled people, or does Tweakers.net simply hold enough clout to swing the public perception balance between, "Lone Hacker Finds Flaw = Sue Him!" and, "Responsible News Agency Discovers Faulty Product = Retract Immediately While Covering Tracks With Slick PR Weasels!"?

    I am also curious. . . What does the law in the Netherlands say regarding corporate mandates? Are Dutch corps allowed to put other things ahead of generating profit for shareholders?


    -FL

  • Note this sentence in the second paragraph (Score:3, Interesting)

    by jimicus ( 737525 ) on Friday April 13, 2007 @09:03AM (#18717777)
    the result is revolutionary, ultra safe and approved by the French intelligence service.

    I think that says quite a lot for the French intelligence service. Unless they wanted an insecure device to be marketed as secure.... black helicopters at the ready.
  • Well this is unfortunate, but there are alternatives. The two that come to mind are the Lexar Secure II JumpDrive and the Kanguru MicroDrive. Both use AES for their encryption algorithm, but the Kanguru one has been FIPS 140-2 certified. I believe this was previously mentioned here on Slashdot (too lazy to look it up). Either one of these would probably be more than enough to replace the aforementioned drive.

    Someone also referenced above about @stake finding an issue with the way passwords were stored

  • Stupid is as stupid does (Score:4, Insightful)

    by mlwmohawk ( 801821 ) on Friday April 13, 2007 @09:06AM (#18717809)
    Like other posters, I am at a loss at where to start.

    (1) If you don't have encryption, GOOD ENCRYPTION, you can't protect squat.
    (2) "Self Destruct" is interesting, but unless you have a custom micro-controller on the ram stick, AND an independent power supply, AND the device potted in epoxy, it is all just a made for TV gimmick.
    (3) Password.exe? I didn't see this in the article, but what happens if one plugs it into a Mac, Linux, FreeBSD, etc? Does it just work or does it self destruct?
    (4) With reference to #2, since the article showed that one could make the device read-only, would self-destruct no longer work? If so, it MUST be potted in epoxy.
    (5) Does the "self destruct" operate on the PC or th ram stick? We all know if it runs on the PC, it is doomed to fail.

    If they want to REALLY do this:

    (1) before everything, encrypt the data. This buys the device time to operate and basic security.
    (2) Install a PIC or something that MUST have an encoded heart beat with some sort of hard to reproduce calculated byte pattern.
    (3) Without a valid heart beat, the PIC will simply not enable the flash device.
    (4) With a valid heart beat, the system must pass a valid password hash string within a reasonable amount of time to the PIC, or the data will be destroyed.
    (5) After a number of failed attempts, the PIC will destroy the data.
    (6) When the heart beat stops, the PIC disables the flash. (It is presumed that the software clears he file system cache as well.)
    (7) Pot the damned device in epoxy.

  • dd (Score:2)

    by bazorg ( 911295 )
    how many copies can one make of the contents of the USB drive in order to try different passwords on each copy?

Slashdot Top Deals

Some people manage by the book, even though they don't know who wrote the book or even what book.

Close