Perimeter
1/4/2010
06:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Secure USB Flaw Exposed

USBs go under the microscope as vulnerability discovered in SanDisk secure USB leads to recall of Kingston USBs and updates to SanDisk, Verbatim USBs

A newly discovered flaw in USB vendor SanDisk's secure USB technology leaves the devices vulnerable to attack and has led to the recall and patching of multiple vendors' secure USB drive products.

A flaw resides in the password-handling process of SanDisk's Cruzer Enterprise USBs. SanDisk issued a security alert and update last month for multiple models of the Cruzer Enterprise drives that fixes the bug in the access-control features. The USB vendor emphasized in the alert that the flaw was not in the device hardware or firmware, but in the application that runs on the host system.

Meanwhile, secure USB vendor Kingston Technologies, which security experts say uses SanDisk software in its products, has recalled three of its secure USB drives, warning its customers that data on the encrypted drives could be accessed by seasoned attackers. Kingston recommended the drives be physically returned for updates.

The vulnerability, which was discovered by researchers at German penetration testing firm SySS, would basically let an unauthorized person access data on the drives by exploiting a weakness in the way the software handles passwords. Vulnerability finds for secure USB drives have been rare, with the biggest threats to these devices historically being physical loss or theft, or for becoming infected with malware. But secure USB experts say the newly discovered password-handling flaw in the SanDisk and Kingston USB drives is only the tip of the iceberg when it comes to potential bugs that could be found in secure USBs that rely on software.

SanDisk's Cruzer Enterprise USB flash drive, CZ22; CZ32; Cruzer Enterprise with McAfee USB flash drive, CZ38; and Cruzer Enterprise FIPS Edition with McAfee USB flash drive CZ46 are all affected by the flaw. Kingston's DataTraveler BlackBox (DTBB), DataTraveler Secure"Privacy Edition (DTSP), and DataTraveler Elite"Privacy Edition (DTEP) contain the vulnerability.

"It has recently been brought to our attention that a skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data contained on [them]," according to a notice on Kingston's Website.

Verbatim, which also uses SanDisk technology, has issued an update alert on some of its USB products, as well.

Software-based password validation technology is a model that security experts say leaves the door open for trouble. And any software element is bound to be subject to some flaws.

"Any time you write software, whether as an interface to an encryption algorithm or business software, there will be vulnerabilities," says Jon Oltsik, principal analyst with Enterprise Strategy Group. "The question is, how do you manage these and do you catch them on time and fix them on time?"

David Jevans, CEO at IronKey, which makes ultra-secure USB devices, says what makes this vulnerability so significant is that it affects multiple vendors' products.

"The thing that's scary about this one is that it [affects] a bunch of products," he says. "It just proved that these companies are memory vendors making fundamental errors that mean every device has the same password ... We're going to see more security [research] companies attacking these things" and finding weaknesses, he says.

The problem lays in how the devices check passwords: They do so in software and all rely on the same underlying password, he says. "They are relying on software on a computer to check if a password is correct -- a security company would never do that," Jevans says. "You've got to check passwords in hardware. You can't rely on software."

All it takes is for a tool that unlocks these devices, which the German research team SySS did, he says. "Having the same magic word [that] unlocks it [is not secure]," he says. Authentication flaws basically defeat the purpose of the encryption in the USB devices, he says.

With USBs getting smarter, more software-laden, and being used as virtual machines, for instance, they are, in turn, becoming more attractive targets. IronKey's Jevans says the firmware on some of these devices could also be targeted: "An attacker could easily replace the firmware on it to unlock it or score a password or even modify software on the device to add malicious code so that when you plug it in, it infects the network," he says. "That's a vulnerability area that's going to get explored."

But Oltsik says secure USBs won't usurp easier targets. These devices will be victims of more targeted attacks or insider jobs, he says. "You have to either know something valuable is there and have the knowledge to hack it, or have something you're specifically going after," he says.

Oltsik recommends enterprises assess what data their users are saving to USB sticks. "If it's their own personal productivity files and there's no risk if those files are exposed, it's OK not doing anything" security-wise with them, he says. "But if people are saving things, like private or regulated data, you should have some port-blocking so they can only use USB sticks certified by your company."

And the USB stick should authenticate to the system using strong passwords or other forms of authentication. "And you want the USB to be encrypted as well so if it's lost or stolen the data is not exposed," Oltsik says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?