Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/4/2010
06:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Secure USB Flaw Exposed

USBs go under the microscope as vulnerability discovered in SanDisk secure USB leads to recall of Kingston USBs and updates to SanDisk, Verbatim USBs

A newly discovered flaw in USB vendor SanDisk's secure USB technology leaves the devices vulnerable to attack and has led to the recall and patching of multiple vendors' secure USB drive products.

A flaw resides in the password-handling process of SanDisk's Cruzer Enterprise USBs. SanDisk issued a security alert and update last month for multiple models of the Cruzer Enterprise drives that fixes the bug in the access-control features. The USB vendor emphasized in the alert that the flaw was not in the device hardware or firmware, but in the application that runs on the host system.

Meanwhile, secure USB vendor Kingston Technologies, which security experts say uses SanDisk software in its products, has recalled three of its secure USB drives, warning its customers that data on the encrypted drives could be accessed by seasoned attackers. Kingston recommended the drives be physically returned for updates.

The vulnerability, which was discovered by researchers at German penetration testing firm SySS, would basically let an unauthorized person access data on the drives by exploiting a weakness in the way the software handles passwords. Vulnerability finds for secure USB drives have been rare, with the biggest threats to these devices historically being physical loss or theft, or for becoming infected with malware. But secure USB experts say the newly discovered password-handling flaw in the SanDisk and Kingston USB drives is only the tip of the iceberg when it comes to potential bugs that could be found in secure USBs that rely on software.

SanDisk's Cruzer Enterprise USB flash drive, CZ22; CZ32; Cruzer Enterprise with McAfee USB flash drive, CZ38; and Cruzer Enterprise FIPS Edition with McAfee USB flash drive CZ46 are all affected by the flaw. Kingston's DataTraveler BlackBox (DTBB), DataTraveler Secure"Privacy Edition (DTSP), and DataTraveler Elite"Privacy Edition (DTEP) contain the vulnerability.

"It has recently been brought to our attention that a skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data contained on [them]," according to a notice on Kingston's Website.

Verbatim, which also uses SanDisk technology, has issued an update alert on some of its USB products, as well.

Software-based password validation technology is a model that security experts say leaves the door open for trouble. And any software element is bound to be subject to some flaws.

"Any time you write software, whether as an interface to an encryption algorithm or business software, there will be vulnerabilities," says Jon Oltsik, principal analyst with Enterprise Strategy Group. "The question is, how do you manage these and do you catch them on time and fix them on time?"

David Jevans, CEO at IronKey, which makes ultra-secure USB devices, says what makes this vulnerability so significant is that it affects multiple vendors' products.

"The thing that's scary about this one is that it [affects] a bunch of products," he says. "It just proved that these companies are memory vendors making fundamental errors that mean every device has the same password ... We're going to see more security [research] companies attacking these things" and finding weaknesses, he says.

The problem lays in how the devices check passwords: They do so in software and all rely on the same underlying password, he says. "They are relying on software on a computer to check if a password is correct -- a security company would never do that," Jevans says. "You've got to check passwords in hardware. You can't rely on software."

All it takes is for a tool that unlocks these devices, which the German research team SySS did, he says. "Having the same magic word [that] unlocks it [is not secure]," he says. Authentication flaws basically defeat the purpose of the encryption in the USB devices, he says.

With USBs getting smarter, more software-laden, and being used as virtual machines, for instance, they are, in turn, becoming more attractive targets. IronKey's Jevans says the firmware on some of these devices could also be targeted: "An attacker could easily replace the firmware on it to unlock it or score a password or even modify software on the device to add malicious code so that when you plug it in, it infects the network," he says. "That's a vulnerability area that's going to get explored."

But Oltsik says secure USBs won't usurp easier targets. These devices will be victims of more targeted attacks or insider jobs, he says. "You have to either know something valuable is there and have the knowledge to hack it, or have something you're specifically going after," he says.

Oltsik recommends enterprises assess what data their users are saving to USB sticks. "If it's their own personal productivity files and there's no risk if those files are exposed, it's OK not doing anything" security-wise with them, he says. "But if people are saving things, like private or regulated data, you should have some port-blocking so they can only use USB sticks certified by your company."

And the USB stick should authenticate to the system using strong passwords or other forms of authentication. "And you want the USB to be encrypted as well so if it's lost or stolen the data is not exposed," Oltsik says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34812
PUBLISHED: 2021-06-18
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2021-34808
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVE-2021-34809
PUBLISHED: 2021-06-18
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34810
PUBLISHED: 2021-06-18
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34811
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.