Secure USB Flaw Exposed

A newly discovered flaw in USB vendor SanDisk's secure USB technology leaves the devices vulnerable to attack and has led to the recall and patching of multiple vendors' secure USB drive products.

A flaw resides in the password-handling process of SanDisk's Cruzer Enterprise USBs. SanDisk issued a security alert and update last month for multiple models of the Cruzer Enterprise drives that fixes the bug in the access-control features. The USB vendor emphasized in the alert that the flaw was not in the device hardware or firmware, but in the application that runs on the host system.

Meanwhile, secure USB vendor Kingston Technologies, which security experts say uses SanDisk software in its products, has recalled three of its secure USB drives, warning its customers that data on the encrypted drives could be accessed by seasoned attackers. Kingston recommended the drives be physically returned for updates.

The vulnerability, which was discovered by researchers at German penetration testing firm SySS, would basically let an unauthorized person access data on the drives by exploiting a weakness in the way the software handles passwords. Vulnerability finds for secure USB drives have been rare, with the biggest threats to these devices historically being physical loss or theft, or for becoming infected with malware. But secure USB experts say the newly discovered password-handling flaw in the SanDisk and Kingston USB drives is only the tip of the iceberg when it comes to potential bugs that could be found in secure USBs that rely on software.

SanDisk's Cruzer Enterprise USB flash drive, CZ22; CZ32; Cruzer Enterprise with McAfee USB flash drive, CZ38; and Cruzer Enterprise FIPS Edition with McAfee USB flash drive CZ46 are all affected by the flaw. Kingston's DataTraveler BlackBox (DTBB), DataTraveler Secure"Privacy Edition (DTSP), and DataTraveler Elite"Privacy Edition (DTEP) contain the vulnerability.

"It has recently been brought to our attention that a skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data contained on [them]," according to a notice on Kingston's Website.

Verbatim, which also uses SanDisk technology, has issued an update alert on some of its USB products, as well.

Software-based password validation technology is a model that security experts say leaves the door open for trouble. And any software element is bound to be subject to some flaws.

"Any time you write software, whether as an interface to an encryption algorithm or business software, there will be vulnerabilities," says Jon Oltsik, principal analyst with Enterprise Strategy Group. "The question is, how do you manage these and do you catch them on time and fix them on time?"

David Jevans, CEO at IronKey, which makes ultra-secure USB devices, says what makes this vulnerability so significant is that it affects multiple vendors' products.

"The thing that's scary about this one is that it [affects] a bunch of products," he says. "It just proved that these companies are memory vendors making fundamental errors that mean every device has the same password ... We're going to see more security [research] companies attacking these things" and finding weaknesses, he says.

The problem lays in how the devices check passwords: They do so in software and all rely on the same underlying password, he says. "They are relying on software on a computer to check if a password is correct -- a security company would never do that," Jevans says. "You've got to check passwords in hardware. You can't rely on software."

All it takes is for a tool that unlocks these devices, which the German research team SySS did, he says. "Having the same magic word [that] unlocks it [is not secure]," he says. Authentication flaws basically defeat the purpose of the encryption in the USB devices, he says.

With USBs getting smarter, more software-laden, and being used as virtual machines, for instance, they are, in turn, becoming more attractive targets. IronKey's Jevans says the firmware on some of these devices could also be targeted: "An attacker could easily replace the firmware on it to unlock it or score a password or even modify software on the device to add malicious code so that when you plug it in, it infects the network," he says. "That's a vulnerability area that's going to get explored."

But Oltsik says secure USBs won't usurp easier targets. These devices will be victims of more targeted attacks or insider jobs, he says. "You have to either know something valuable is there and have the knowledge to hack it, or have something you're specifically going after," he says.

Oltsik recommends enterprises assess what data their users are saving to USB sticks. "If it's their own personal productivity files and there's no risk if those files are exposed, it's OK not doing anything" security-wise with them, he says. "But if people are saving things, like private or regulated data, you should have some port-blocking so they can only use USB sticks certified by your company."

And the USB stick should authenticate to the system using strong passwords or other forms of authentication. "And you want the USB to be encrypted as well so if it's lost or stolen the data is not exposed," Oltsik says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.