Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/4/2010
06:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Secure USB Flaw Exposed

USBs go under the microscope as vulnerability discovered in SanDisk secure USB leads to recall of Kingston USBs and updates to SanDisk, Verbatim USBs

A newly discovered flaw in USB vendor SanDisk's secure USB technology leaves the devices vulnerable to attack and has led to the recall and patching of multiple vendors' secure USB drive products.

A flaw resides in the password-handling process of SanDisk's Cruzer Enterprise USBs. SanDisk issued a security alert and update last month for multiple models of the Cruzer Enterprise drives that fixes the bug in the access-control features. The USB vendor emphasized in the alert that the flaw was not in the device hardware or firmware, but in the application that runs on the host system.

Meanwhile, secure USB vendor Kingston Technologies, which security experts say uses SanDisk software in its products, has recalled three of its secure USB drives, warning its customers that data on the encrypted drives could be accessed by seasoned attackers. Kingston recommended the drives be physically returned for updates.

The vulnerability, which was discovered by researchers at German penetration testing firm SySS, would basically let an unauthorized person access data on the drives by exploiting a weakness in the way the software handles passwords. Vulnerability finds for secure USB drives have been rare, with the biggest threats to these devices historically being physical loss or theft, or for becoming infected with malware. But secure USB experts say the newly discovered password-handling flaw in the SanDisk and Kingston USB drives is only the tip of the iceberg when it comes to potential bugs that could be found in secure USBs that rely on software.

SanDisk's Cruzer Enterprise USB flash drive, CZ22; CZ32; Cruzer Enterprise with McAfee USB flash drive, CZ38; and Cruzer Enterprise FIPS Edition with McAfee USB flash drive CZ46 are all affected by the flaw. Kingston's DataTraveler BlackBox (DTBB), DataTraveler Secure"Privacy Edition (DTSP), and DataTraveler Elite"Privacy Edition (DTEP) contain the vulnerability.

"It has recently been brought to our attention that a skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data contained on [them]," according to a notice on Kingston's Website.

Verbatim, which also uses SanDisk technology, has issued an update alert on some of its USB products, as well.

Software-based password validation technology is a model that security experts say leaves the door open for trouble. And any software element is bound to be subject to some flaws.

"Any time you write software, whether as an interface to an encryption algorithm or business software, there will be vulnerabilities," says Jon Oltsik, principal analyst with Enterprise Strategy Group. "The question is, how do you manage these and do you catch them on time and fix them on time?"

David Jevans, CEO at IronKey, which makes ultra-secure USB devices, says what makes this vulnerability so significant is that it affects multiple vendors' products.

"The thing that's scary about this one is that it [affects] a bunch of products," he says. "It just proved that these companies are memory vendors making fundamental errors that mean every device has the same password ... We're going to see more security [research] companies attacking these things" and finding weaknesses, he says.

The problem lays in how the devices check passwords: They do so in software and all rely on the same underlying password, he says. "They are relying on software on a computer to check if a password is correct -- a security company would never do that," Jevans says. "You've got to check passwords in hardware. You can't rely on software."

All it takes is for a tool that unlocks these devices, which the German research team SySS did, he says. "Having the same magic word [that] unlocks it [is not secure]," he says. Authentication flaws basically defeat the purpose of the encryption in the USB devices, he says.

With USBs getting smarter, more software-laden, and being used as virtual machines, for instance, they are, in turn, becoming more attractive targets. IronKey's Jevans says the firmware on some of these devices could also be targeted: "An attacker could easily replace the firmware on it to unlock it or score a password or even modify software on the device to add malicious code so that when you plug it in, it infects the network," he says. "That's a vulnerability area that's going to get explored."

But Oltsik says secure USBs won't usurp easier targets. These devices will be victims of more targeted attacks or insider jobs, he says. "You have to either know something valuable is there and have the knowledge to hack it, or have something you're specifically going after," he says.

Oltsik recommends enterprises assess what data their users are saving to USB sticks. "If it's their own personal productivity files and there's no risk if those files are exposed, it's OK not doing anything" security-wise with them, he says. "But if people are saving things, like private or regulated data, you should have some port-blocking so they can only use USB sticks certified by your company."

And the USB stick should authenticate to the system using strong passwords or other forms of authentication. "And you want the USB to be encrypted as well so if it's lost or stolen the data is not exposed," Oltsik says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9079
PUBLISHED: 2020-08-11
FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product.
CVE-2020-16275
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVE-2020-16276
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16277
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16278
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.