via Everything USB - Gadgets, Wireless USB, USB 3.0 on 1/6/10
Following the admonition of Kingston more supposedly secure drives are found to be vulnerable. Details have emerged of the far too simple hack that makes quick work defeating certain encryption programs. The drives themselves remain secure except the common software that opens them up seems to use basically the same "password correct" command to the drive to start serve up the protected contents. Using and in-line sniffer the universal password was discovered, and could easily be inserted into the data stream and start unraveling all those super secret files, like using a digital bump-key. Many of these affected drives have been granted FIPS 140-2 government security standards certification, whoops. This is a very easy hack, and by "easy" we mean that you'd need to have a degree in electronics and a penchant for reading binary data with a few months to spare to whip up a program. You could always convert to TrueCrypt or some other software based encryption tool. If not, you should check to see if your drive is affected, and whether or not you can return it or patch it. Verbatim and SanDisk both have released software patches that should fix the issue. Since this vulnerability seems to have been incorporated into several manufacturers, more are likely to come to light in the next few weeks. You'd be wise to keep an eye on the feeds to make sure your private drive doesn't show up on the list. Permanent Link
No comments:
Post a Comment