Protected Memory Stick Easily Cracked

Martin_Sturm writes "A $175 1GB USB stick designed to protect your data turns out to be a very insecure. According to the distributer of the Secustick, the safety of the data is ensured: 'Due to its unique technology it has the ability to destroy itself once an incorrect password is entered.' The Secustick is used by various European governments and organizations to secure data on USB sticks. Tweakers.net shows how easy it is to break the protection of the stick. Quoting: 'It should be clear that the stick's security is quite useless: a simple program can be used to fool the Secustick into sending its unlock command without knowing the password. Besides, the password.exe application can be adapted so that it accepts arbitrary passwords.' The manufacturer got the message and took the Secustick website offline. The site give a message (translated from Dutch): 'Dear visitor, this site is currently unavailable due to security issues of the Secustick. We are currently working on an improved version of the Secustick.'"

Comments

Well they could have been like other companies

[insanemime]

At least they had the balls to admit that something was wrong and try to take steps to fix it. It will be intresting to see if they recall the ones already sold.

Re:Well they could have been like other companies

[tritonman]

Destroying the contents on a bad password attempt is crazy. Especially when you use very cryptic passwords. People tend to type wrong, hold the shift key down too long, not hold the shift key down when necessary. Sometimes I have to type my passwords two or three times before getting it right. Destroying important sensitive information because I accidentally typed it wrong is just plain stupid. These kind of technologies will only be a pain for people using them legitimately, and anyone who wants to hack to get the information will generally be able to find some way to get it, thus it is only extends the problems and provides no solutions.

Re:Well they could have been like other companies

[antime]

What they admitted is that they have no idea what they are doing and have no idea what they are selling. You would have to be an idiot to buy anything security-related from a company like that.

Re:Well they could have been like other companies

[Lazerf4rt]

Well, not completely. A spokesperson for the product is reported saying:

Our customers are happy with the level of protection that our product offers. Normally, the amount of security is sufficient, not everyone has the technical expertise that you have.

This is quite a different statement from the one made near the start of the article.

The stick was commissioned by the French government and - according to the company's press release - the result is revolutionary, ultra safe and approved by the French intelligence service.

Funny part is, all they did was run the program in a debugger, put a breakpoint after the clearly labelled "VerifyPassWord" function, and change the return value from 0 to 1. Pretty embarassing. But the article went pretty easy on them after that. Really good read by the way.

Re:Well they could have been like other companies

[FuzzyDaddy]

I don't know about you, but I don't keep original copies of data on a USB key. I use it to transfer files from one computer to another, so wiping the data after unsuccessful attempts, in this context, strikes me as a good idea.

Re:Well they could have been like other companies

[jandrese]

I love the part where it is "approved by the French intelligence service". Of course it is, since it's so easy to break. Of course it's not approved for their own use, they just want everybody else to use it.

Re:Well they could have been like other companies

[computational super]

You would have to be an idiot to buy anything security-related from a company like that.

Which is a shame for this company, because idiots are in such short supply these days...

Re:Well they could have been like other companies

[morgan_greywolf]

Funny part is, all they did was run the program in a debugger, put a breakpoint after the clearly labelled "VerifyPassWord" function

Wait. The executable was compiled with debug symbols turned on? With functions with easy-to-understand names? I mean, I know it's only security-through-obscurity, but c'mon! At least up the ante a little bit ... many programmers are not skilled enough to disassemble a program with no symbol table. And the ones that are ... *shrug* rely on the security of your methods, not on the obscurity of your code. IOW, they should have used encryption, even with the self-destruct mechanism.

Re:Well they could have been like other companies

[TheRaven64]

It is unlikely that the only copy of sensitive data would be on the USB stick. If it is destroyed, you still have the original copy somewhere more secure than your pocket. If it's destroyed accidentally, it could be a lot less of a problem than if it fell into the wrong hands.

There are a lot of situations where having a local copy of the data is a convenience, rather than a necessity, and this would allow the convenience without the risk of it being stolen. If it's accidentally destroyed, then it's an inconvenience, not a disaster.

Nice one!

[Anonymous Coward]

At least the manufacturer is doing the right thing and eating crow over this. Here in the US the company would probably have just sued the hackers under DMCA while continuing to sell the defective product.

Just put -

[ditoa]

TrueCrypt on a memory stick with an encrypted volume file with a good passphrase and your data will be secure from pretty much anything. I have not heard of TrueCrypt being cracked yet.

TrueCrypt

[Teckla]

Most Slashdotters know you should not trust the built in security on these devices.

The solution for real security on these devices is to use TrueCrypt.

It's not hard to use, though the more technical among us may need to help out the less technically inclined to get things rolling. Once it's setup, though, it's secure and easy to use.

This begs the question......

[8127972]

...... Since there are a ton of these products out there. Does any third party verifiy that they are secure as they are claimed to be? Or are we truly at the mercy of the marketing spin that these companies put out?

A cheaper alternative that actually works

[jrumney]

1. 1Gb USB stick - from around $20 (maybe even cheaper)
2. Truecrypt - free

No self-destruct, but hard enough enryption for all but the most sensitive secret data.

Dumb design

[binaryDigit]

The whole thing is just stupid. Oh where to start ...

- self destruct, great, so if you want to destroy someones data, just grab their memory stick and intentional use bogus passwords. Now that's brilliant. A MS with a builtin self DOS.

- No security support in hardware, just desolder the actual memory and stick it into your favourite $15 MS. Brilliant.

- So smug in their design they don't even encrypt the data. Outstanding.

- Software designed apparently by a 12 yo. Oh wait, a 12yo probably wouldn't have made it so dumb. Maybe it was a 6yo, were there identifiers named after Spongebob characters?

Actually, the bigger problem is that so many govt agencies approved of this thing, apparently, without it going through any type of remotely rigorous testing and verification. As much as our US govt agencies get ripped for doing stupid stuff, it's clear that they don't have the market cornered on such activity.

Hey, I have a secure self destructing bridge to sell to ....

Re:TrueCrypt

[Rob T Firefly]

The type of people who have got the wherewithal to set up TrueCrpyt are not the market this was aiming for. This seems like a product made for the techno-clueless PHB types who just want to buy something off the shelf they can stick in their magic computer box and have it "just work," and who see that high a price on a simple 1-gig USB stick not as an obvious ripoff, but as a measure of how much good computer magic it must surely contain.

Re:This RAISES the question......

[Xanni]

http://begthequestion.info/

A surprise and a non-surprise.

[eddy]

No surprise that the security is non-existant, but a nice surprise that tweakers.net[0] have people skilled enough to do a thorough technical review. Tip-of-the-Hat to the reviewers and keep the good work up. Anyone can run 3D benchmarks and make graphs against the previous generation, but this requires a different level of technical know-how. It's always been my hope that the future would feature this type of review, using reverse-engineering techniques for indepth technical reviews, as a norm not an exception.

[0] No disrespect to the people of tweakers.net, I mean in the sense of 'any popular review site'.

Re:There's Your Problem

[vidarh]

I worked for a company years ago where several of the engineers were seriously impressed when I showed them I could "break" their "base64 encryption" in realtime...

They had added it to close a previous security problem I'd pointed out with their product that stored an internal customer id in a cookie to grant access to a web app - problem was, the customer id's were allocated sequentially, so anyone brute-forcing it would get access to all their customer data in minutes, including the adress books of the entire top management team.... base64 "encrypting" the customer id was supposed to prevent anyone from trying that trick again... I left that company pretty much as soon as I could..