May 1, 2010, Most major brands such as memory, SanDisk, Kingston and Verbatim flash drives provide a safe addition to its standard range of flash drives on the market. Secure flash drives promise to keep your data safe from hackers, viruses, water, earthquakes and other natural disasters.
On May 1, 2010, the design error was reported, which would allow an attacker to gain access to secure flash drives are made some of the major brands flash-memory makers. It was reported that it is possible to send the "unlock" flag on the device, which would trigger them to unlock a <a href="http://www.computerfreeship.com" title="Cheap Desktops“>Computer without a user-set password. German Pen-Test company SySS GmbH has published a document highlighting shortcomings.
Affected devices
SanDisk Cruzer ® Enterprise FIPS Edition USB flash drive McAfee, CZ46 – 1GB SanDisk Cruzer ® Enterprise FIPS Edition USB> Flash Drive, CZ32 – 1GB, 2GB, 4GB, 8GB
SanDisk Cruzer Enterprise with McAfee ® USB flash drive, CZ38 – 1GB, 2GB, 4GB, 8GB
SanDisk Cruzer ® Enterprise USB flash drive, CZ22 – 1GB, 2GB, 4GB, 8GB
Kingston DataTraveler BlackBox (DTBB)
Kingston DataTraveler Secure – Privacy Edition (DTSP)
Kingston DataTraveler Elite – Privacy Edition (DTEP)
VerbatimCorporate Secure FIPS Edition USB Flash Drive 1GB, 2GB, 4GB, 8GB
Verbatim Business Secure USB Flash Drive 1GB, 2GB, 4GB, 8GBThe error is pretty straight forward ". If the drive is connected to the <a href="http://www.computerfreeship.com" title="Cheap Desktops“>Computer Software with the drive is running on a <a href="http://www.computerfreeship.com" title="Cheap Desktops“>Computer, which verifies the supplied password and sends the "open" flag on the disk. When analyzed according to the debugger, code simply translates into a common "conditional jump", which can bepatch to unlock the device.
Such implementations have been criticized by safety-reserve technicians around the world and certainly raise questions about the design process, threatened flash drives.
Many of the "crack" the Software is based around the same logic, Software engineering change on the fly, which is visible under a good debugger, and say Ollydbg Softice. On the facts, the public and many users who have purchased these devicesis that boasted, as certified by FIPS 140-2 Level 2 security validation by U.S. government organizations NIST (National Institute of Standards and Technology).
SySS GmbH uses OllyDgb reflag accompanying Software disks to access the drive without knowing the original password. Of course, this raises the question of how and why the NIST certify products as safe flash drives, so he had his own mistakesin design.
NIST is, of course, maintain their position and said:
"From our initial analysis, it appears that the software, which decryption, rather than a cryptographic module validated by NIST, is a source of vulnerability," Yes, of course.
"Nevertheless, we are actively investigating whether any changes in the certification process should be NIST in the light of this problem." NIST certification covers cryptographic modules that encrypt and decryptdata contained in the device. As a security enthusiasts will argue that if you give the most secure encryption module to be dangerous implementations, this will result in an overall uncertain system. To secure flash drives, it's pretty embarrassing to see the top suppliers that deliver what they promised product.
As it turned out this error, media-led consumers have a false perception of a certificate issued by large organizations. These certificates do not guarantee thatEquipment is safe, only that the cryptographic module is secure, the truth.
IronKey users would be happy to know that the error was not influenced by their products. IronKey uses hardware-based authentication rather than sending the flags to unlock the device. All IronKey Secure Flash Drives remained unaffected by this defect, and are not surprised to see sales of this device hitting the roof.
Remember that software is not vulnerable, but also hardware. It is easier to analyzesoftware under a debugger, but the right tools, an analysis of the hardware debugger is equally easy. Particularly vulnerable are the sequence that opens the way for the verification is complete – which nodoubt should be one of the most guarded routines for the flash drive.
Fortunately IronKey designed to protect themselves from scratch. Chips to drive in the epoxy melts, which means gain access to the hardware, it is almost impossible, even the most determinedhackers.
As we understand, when you spent on the chance to buy a secure flash drive, you should be responsible for implementing security on the device. Although Kingston, SanDisk and Verbatim will be furiously trying to do anything to correct the problem and buried, we believe it wont be an easy task to restore consumer confidence.
As expected, Kingston will replace all affected secure flash memory units, and issued the following statementreassure its customers;
Kingston Digital Inc. believes that the security of our customer data as a priority. Kingston customers affected by security risks, please visit our website for further direction on how to solve any problems at: http://www. Kingston. com / driveupdate
The Evolution of computers Technology