Slashdot Mirror
Fingerprint-Protected USB Sticks Cracked
juct writes "Manufacturers of USB sticks and cards with fingerprint readers promise us that their data safes can only be opened with the right fingerprint. In their tests, heise Security found that it is easy to bypass the authentication and get access to the protected data. This works by sending a single USB command, using the open source tool PLscsi, that changes the accessible partition. They found the vulnerability in several USB sticks that use the same chipset. The article concludes: 'The fingerprint sensors in the products mentioned above apparently only serve one purpose: they mislead interested buyers. They do not provide any significant level of protection. We can only recommend that these products not be purchased.'"
I've never seen a fingerprint system that was worth a damn...I was doing consulting at a company a few years back that had the "pad style" thumb readers (rather than the little scanners that are more popular now), and I "hacked" one of them for the company director by taking a deep breath and breathing on it. Warm breath condenses on the previous fingerprint and heats up the temperature sensor, and voila.
Now I had garlic pizza for lunch, so there is more than one reason that would have worked, but the fact that it did work was more than enough to convince me of the worthlessness of the tech. They had a Mythbusters episode a while back where they were fooling fingerprint readers with xeroxes and rubber casts; again, a huge glaring flaw.
At this point, security is still about passwords. I haven't seen any consumer grade biometric I'd trust with my MySpace profile (if I ever make one), more less anything sensitive.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
"They do not provide any significant level of protection. We can only recommend that these products not be purchased."
You seldom get such unflinching prose in a review.
"Flyin' in just a sweet place,
Never been known to fail..."
And my boss has been pushing to get these deployed at our company, for the sake of security. I'm sending him this article right now.
Thanks once again, Slashdot, for making it possible for me to project the impression that I'm doing my job. ^_^
____
~ |rip/\/\aster /\/\onkey
Didn't Mythbusters beat a bunch of fingerprint readers a couple of seasons ago? I seem to recall them using printed pictures of fingerprints with great success.
http://www.youtube.com/watch?v=oXyFmieZjiE
Absolute power corrupts absolutely. indymedia
This is not the first USB-stick sold for a high price (typically 10 times the price of a normal USB stick of the same size) that doesn't actually add any security whatsoever.
Here is an article by a dutch website (the article is in english though) that does a thorough job (technical details included) of debunking a similar product.
Meanwhile, the scary thing is that government and military organizations are reported to have been actually using such products...
Every expression is true, for a given value of 'true'
Comment removed based on user account deletion
Corsair's Flash Padlock has the same issue. You can open the case through a single screw in the back of the drive and then access an electronic switch on the board, which can be easily tripped with a piece of wire, giving you access to the memory chip without having to punch in a security PIN. Hardware security methods just aren't as secure as software-based encryption.
But it is misleading. It offers a technology that, to the viewer, is designed to protect the content on the memory. It does nothing of the sort. It gives the facade of a deadbolted door, with a window around back that is just left open. You say it's quicker than inputting a password? I doubt people are really in that much of a hurry that 2 seconds is such a waste of time. If anything it would serve as not needing to remember a password, or multiple passwords. But I'm still wary of anything that will require any sort of biometric information of mine for me to access.
Absolute power corrupts absolutely. indymedia
I agree 100%. However, the whole point of these devices is to protect your data in case it is lost / stolen.
The only problem is that they do not work.
There is a big market for physical security. It needs companies that will exploit it without snake oil. I like the idea of a multi-layer encryption / pass phrase / physical lock / self-destruct / whatever combination etc. idea on USB sticks and laptops etc. and I expect that products that cater to that need will grow. Unfortunately products that fail to live up to consumer demands will also continue to grow. It's a young industry.
Biometrics is even younger, and right now I don't trust any kind of biometric security mechanism.
Having spent too many hours dealing with increasingly bizarre authentication schemes at various web sites, and more hours reading about each new form of high tech security wizardry, I've come to conclude that an awful lot of companies are ignoring the obvious - that the only really secure way to protect data is to prevent physical access to it.
As long as someone can get access to the container, they can find a way in.
Obviously we're balancing convenience with security, but when some employee takes your whole customer database off-site on his laptop your problem is not encryption, it's keeping that data in a controlled environment.
Three Squirrels
It goes without saying that there are a large number of low-end sensors disguised as excellent front-ends to biometric authentication. You need to segregate two things.
1. the sensor itself.
2. the implementation of the sensor. (e.g. sensor as a front end)
There are two legitimate sensor manufacturers in the U.S. and one very well-known French company all of whom do not sell to just anyone anywhere and at prices absolutely out of range for a TV show and the average company.
Another thing to keep in mind is even IF there was budget for a good device, (oh to dream) there are implementation issues that can make the hardware worthless. As is often the case, meaningful implementations tend to complicate practically all business/operations matters which is why no company bothers.
To generalize that all fingerprint scanners suck is just wrong.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
One swallow does not a fellatrix make
No, sorry, that's just wrong. If the data is properly encrypted with a decent cipher using a key with sufficient entropy, you should assume it has not been compromised.
If the encryption you are using is so poor that the loss of your USB stick means you consider the data to be compromised, why bother encrypting at all?!!!
When will fingerprint "security" die?
Obligatory links:
http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/
http://www.schneier.com/crypto-gram-9808.html#biometrics
It's important to understand that your fingerprints aren't secrets. You put them on thousands of objects every day. You can't create any security based on fingerprints unless you can assure that the reading device isn't tampered with. By placing a guard (a person) there or something.
)9TSS
Your print never reads the same twice (fingerprints are a poor biometric for this reason - you can only really guess within a certain probability that it's the right one), so to do what you're suggesting you'd have to store the hash on the device.
So your security is dependent on them hiding the hash to the rest of the data. Security is only as strong as its weakest point.
Biometrics has its place. This isn't it.
Most of the time, a username/password is a perfectly good access-control method. In some cases (either high-security environments or connections over hostile space), a second authentication method is advised. Now we have a two-factor authentication. Typical example is "log onto the firewall to allow you to log onto a machine inside the firewall." SecureID cards and the like also work as a good second-factor method.
A biometric challenge is arguably an acceptable second-factor when added to a username/password system. It is NOT a substitute for such a system.
However, biometrics are HARD to do correctly! Cheap scanners suck and are generally insecure by design. Expensive scanners suck, but are generally designed better. None are foolproof, yet.
Also, biometric authentication carries a risk. If your username and password are stolen, then you can change your password and stop the damage. If your biometric ID (retinal scan, fingerprint, etc.) are successfully 'stolen,' then you have lost your authentication ability for all time! If your fingerprint is compromised, you can NEVER USE it as an authentication method again! There ain't no resetting fingerprints!
So we have a large expense for an imperfect system with exactly one possible compromise per user per lifetime. This isn't a primary ID method. It's not a good second-factor ID method either. In EXTREME security environments, it might make sense as a third-factor authorization system, along with username/password and a (pseudo-) one-time pad (i.e. SecureID).
If you don't NEED that type of security, then DON'T USE YOUR BIOMETRIC DATA! One compromise, and it's useless. Forever. Period.
Oh yeah, but I forget the most important part: Fingerprint scanners are shiny and cool, just like in the movies. Bah.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
Someone already submitted this article under a different headline. It was rejected. Apparently we care about it now, though I'm not sure why. Even linked to the same article, and sent in by the same person, with a different description.
I guess now I know what to do if the stories I submit don't make it...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Eh, the poor guy probably just had to put up with some password policy that says he has to have at least one non-letter character in the password.
A polar bear is a cartesian bear after a coordinate transform.
Around the world there are millions of low-level padlocks etc that will stop most petty thieves but will not deter serious thieves. Most houses have pickable locks that anyone could learn to pick, but yet most locks still serve their purpose.
The only real issue is if peeople buy these devices and think they're getting Fort Knox level security and essentially use a two-dollar padlock to secure a bank.
Engineering is the art of compromise.
Those sticks are flawed not because the fingerprint sensor sucks, but because the authentication is made on the computer.
If I got it right, those sticks should work like this
The fact that the stick uses biometrics is irrelevant. With a design like that, it would have been vulnerable even if it had PIN, RSA keys or black magic. You can just bypass the security mechanism by sending the unlock command.
Essentialy, it has the same flaw as the secustik we saw last year.
GPG 0x1B479C78