Perimeter

1/4/2010
06:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Secure USB Flaw Exposed

USBs go under the microscope as vulnerability discovered in SanDisk secure USB leads to recall of Kingston USBs and updates to SanDisk, Verbatim USBs

A newly discovered flaw in USB vendor SanDisk's secure USB technology leaves the devices vulnerable to attack and has led to the recall and patching of multiple vendors' secure USB drive products.

A flaw resides in the password-handling process of SanDisk's Cruzer Enterprise USBs. SanDisk issued a security alert and update last month for multiple models of the Cruzer Enterprise drives that fixes the bug in the access-control features. The USB vendor emphasized in the alert that the flaw was not in the device hardware or firmware, but in the application that runs on the host system.

Meanwhile, secure USB vendor Kingston Technologies, which security experts say uses SanDisk software in its products, has recalled three of its secure USB drives, warning its customers that data on the encrypted drives could be accessed by seasoned attackers. Kingston recommended the drives be physically returned for updates.

The vulnerability, which was discovered by researchers at German penetration testing firm SySS, would basically let an unauthorized person access data on the drives by exploiting a weakness in the way the software handles passwords. Vulnerability finds for secure USB drives have been rare, with the biggest threats to these devices historically being physical loss or theft, or for becoming infected with malware. But secure USB experts say the newly discovered password-handling flaw in the SanDisk and Kingston USB drives is only the tip of the iceberg when it comes to potential bugs that could be found in secure USBs that rely on software.

SanDisk's Cruzer Enterprise USB flash drive, CZ22; CZ32; Cruzer Enterprise with McAfee USB flash drive, CZ38; and Cruzer Enterprise FIPS Edition with McAfee USB flash drive CZ46 are all affected by the flaw. Kingston's DataTraveler BlackBox (DTBB), DataTraveler Secure"Privacy Edition (DTSP), and DataTraveler Elite"Privacy Edition (DTEP) contain the vulnerability.

"It has recently been brought to our attention that a skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data contained on [them]," according to a notice on Kingston's Website.

Verbatim, which also uses SanDisk technology, has issued an update alert on some of its USB products, as well.

Software-based password validation technology is a model that security experts say leaves the door open for trouble. And any software element is bound to be subject to some flaws.

"Any time you write software, whether as an interface to an encryption algorithm or business software, there will be vulnerabilities," says Jon Oltsik, principal analyst with Enterprise Strategy Group. "The question is, how do you manage these and do you catch them on time and fix them on time?"

David Jevans, CEO at IronKey, which makes ultra-secure USB devices, says what makes this vulnerability so significant is that it affects multiple vendors' products.

"The thing that's scary about this one is that it [affects] a bunch of products," he says. "It just proved that these companies are memory vendors making fundamental errors that mean every device has the same password ... We're going to see more security [research] companies attacking these things" and finding weaknesses, he says.

The problem lays in how the devices check passwords: They do so in software and all rely on the same underlying password, he says. "They are relying on software on a computer to check if a password is correct -- a security company would never do that," Jevans says. "You've got to check passwords in hardware. You can't rely on software."

All it takes is for a tool that unlocks these devices, which the German research team SySS did, he says. "Having the same magic word [that] unlocks it [is not secure]," he says. Authentication flaws basically defeat the purpose of the encryption in the USB devices, he says.

With USBs getting smarter, more software-laden, and being used as virtual machines, for instance, they are, in turn, becoming more attractive targets. IronKey's Jevans says the firmware on some of these devices could also be targeted: "An attacker could easily replace the firmware on it to unlock it or score a password or even modify software on the device to add malicious code so that when you plug it in, it infects the network," he says. "That's a vulnerability area that's going to get explored."

But Oltsik says secure USBs won't usurp easier targets. These devices will be victims of more targeted attacks or insider jobs, he says. "You have to either know something valuable is there and have the knowledge to hack it, or have something you're specifically going after," he says.

Oltsik recommends enterprises assess what data their users are saving to USB sticks. "If it's their own personal productivity files and there's no risk if those files are exposed, it's OK not doing anything" security-wise with them, he says. "But if people are saving things, like private or regulated data, you should have some port-blocking so they can only use USB sticks certified by your company."

And the USB stick should authenticate to the system using strong passwords or other forms of authentication. "And you want the USB to be encrypted as well so if it's lost or stolen the data is not exposed," Oltsik says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4035
PUBLISHED: 2019-03-22
IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X...
CVE-2019-4052
PUBLISHED: 2019-03-22
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVE-2019-9648
PUBLISHED: 2019-03-22
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
CVE-2019-9923
PUBLISHED: 2019-03-22
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
CVE-2019-9924
PUBLISHED: 2019-03-22
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.