Slashdot Mirror
Fingerprint-Protected USB Sticks Cracked
juct writes "Manufacturers of USB sticks and cards with fingerprint readers promise us that their data safes can only be opened with the right fingerprint. In their tests, heise Security found that it is easy to bypass the authentication and get access to the protected data. This works by sending a single USB command, using the open source tool PLscsi, that changes the accessible partition. They found the vulnerability in several USB sticks that use the same chipset. The article concludes: 'The fingerprint sensors in the products mentioned above apparently only serve one purpose: they mislead interested buyers. They do not provide any significant level of protection. We can only recommend that these products not be purchased.'"
Just saying...
np: Pole - Achterbahn (Shackleton Remix) (Steingarten Remixes)
"I'm not anti-anything, I'm anti-everything, it fits better." - Sole
But it is misleading. It offers a technology that, to the viewer, is designed to protect the content on the memory. It does nothing of the sort. It gives the facade of a deadbolted door, with a window around back that is just left open. You say it's quicker than inputting a password? I doubt people are really in that much of a hurry that 2 seconds is such a waste of time. If anything it would serve as not needing to remember a password, or multiple passwords. But I'm still wary of anything that will require any sort of biometric information of mine for me to access.
Absolute power corrupts absolutely. indymedia
Having spent too many hours dealing with increasingly bizarre authentication schemes at various web sites, and more hours reading about each new form of high tech security wizardry, I've come to conclude that an awful lot of companies are ignoring the obvious - that the only really secure way to protect data is to prevent physical access to it.
As long as someone can get access to the container, they can find a way in.
Obviously we're balancing convenience with security, but when some employee takes your whole customer database off-site on his laptop your problem is not encryption, it's keeping that data in a controlled environment.
Three Squirrels
Stupidity of the gullible people buying this, that is.
The guys who designed this (and, more importantly, marketed it) are certainly not stupid - they are essentially selling low-grade USB sticks at probably a 10x markup, at the cost of having a couple programmers write a Windows-only driver that makes it look like there is a security layer. I wouldn't call this stupid (although certainly ethically questionable, but that's a different matter)
Every expression is true, for a given value of 'true'
Someone already submitted this article under a different headline. It was rejected. Apparently we care about it now, though I'm not sure why. Even linked to the same article, and sent in by the same person, with a different description.
I guess now I know what to do if the stories I submit don't make it...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
My biggest problem with finger print locks is that they use only my finger to open them, and I don't want someone using my finger to open a lock when I'm not there. A good rule of thumb is that you should never lock anything with a finger print that is more valuable to a thief than your finger is to you, or that is harder to crack than cutting off your fingers.
This is why I don't ever want a car with fingerprint locks. Pretty much the same for laptops. I am going to put a fingerprint reader on my pool gate though, as it will be easier for someone to just kick the gate open, or jump the gate than it is for them to mug me and take my fingers.
Around the world there are millions of low-level padlocks etc that will stop most petty thieves but will not deter serious thieves. Most houses have pickable locks that anyone could learn to pick, but yet most locks still serve their purpose.
The only real issue is if peeople buy these devices and think they're getting Fort Knox level security and essentially use a two-dollar padlock to secure a bank.
Engineering is the art of compromise.
Adding a few numbers or characters should buy you a fair amount of security, for instance, "DrPepper!!!" or "DrPepper732" should be harder to guess than "DrPepper". The problem is that you can go too far. You could require, for instance, that passwords be at least 12 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one non-alphanumeric symbol, e.g. "DrPepper732!?". The problem is that you've got multiple passwords- one for work, one for Amazon.com, one for online banking, one for /., etc. etc. so it becomes virtually impossible to remember the damn things. Now what? People have to start writing them down, and posting them next to the machine. A huge part of the security of passwords comes from the fact that it's not physically written down; as soon as you have to record it instead of keeping it in your memory, your overall level of security is going down, even if the password is getting harder to crack.
Exactly. Password security is not simply dependent on how many and what type of characters are used, but also on what the person using the password does with it. Even the most secure password could be easily determined if the user tried to use it to register on a non-legitimate site. It really depends on the user, as well as the password. A semi-weak password used by a security conscious person is far better at protecting something than an extremely strong password used by someone who doesn't know, or care, about security.
There are two kinds of fool One says 'This is old therefore good' Another says 'This is new therefore better'- Dean Ing
Those sticks are flawed not because the fingerprint sensor sucks, but because the authentication is made on the computer.
If I got it right, those sticks should work like this
The fact that the stick uses biometrics is irrelevant. With a design like that, it would have been vulnerable even if it had PIN, RSA keys or black magic. You can just bypass the security mechanism by sending the unlock command.
Essentialy, it has the same flaw as the secustik we saw last year.
GPG 0x1B479C78
Disclaimer: I work for a major fingerprint sensor manufacturer.
The problem with these particular devices isn't in the fingerprint sensors but with the way the security system was setup on the USB chip. The attacks shown used in the article don't have anything to do with the fingerprint sensors. Heise did a similar review of similarly flawed "fingerprint protected" hard drives recently. I think I saw that link from Bruce Schnier's site originally.
This is not to say that fingerprint sensors are perfect. However, creating a spoof for a good fingerprint sensor requires more time and skill than creating a duplicate key for a traditional lock, for example. The sensor mentioned breathing on was probably a sensor that is a few generations old when the technology for just getting an image was not yet mature. They hadn't yet begun to deal with spoofs. You'll find the sensors included on modern laptops, for example, to be much better devices.
Fingerprint sensors are tradeoffs between security and convinience. I keep a password vault protected by a fingerprint sensor. In it, I have a different randomly generated password (using as the maximum number of characters chosen from the widest range of characters allowed by the account) for each website, computer, program that I use. If I was a more capable human being, I would simply remember those passwords for the best security available (at least via passwords). If I wasn't using the password vault, I would certainly have fewer and less complex passwords, and I would the passwords less frequently.
So, in this case. Mock the engineers that designed these storage devices. They failed to design their devices properly. What's sad is that these sensors look to be fairly modern, and someone could probably design a storage device with fairly good security around them.