Self-Destructing USB Stick

Hugh Pickens writes "PC World reports that Victorinox, maker of the legendary Swiss Army Knife, has launched a new super-secure memory stick that sounds like something out of Mission: Impossible. The Secure Pro USB comes in 8GB, 16GB, and 32GB sizes, and provides a variety of security measures including fingerprint identification, a thermal sensor, and even a self-destruct mechanism. Victorinox says the Secure is 'the most secure [device] of its kind available to the public.' The Secure features a fingerprint scanner and a thermal sensor 'so that the finger alone, detached from the body, will still not give access to the memory stick's contents.' While offering no explanation how the self-destruct mechanism works, Victorinox says that if someone tries to forcibly open the memory stick it triggers a self-destruct mechanism that 'irrevocably burns [the Secure's] CPU and memory chip.' At a contest held in London, Victorinox put its money where its mouth was and put the Secure Pro to the test offering a £100,000 cash prize ($149,000) to a team of professional hackers if they could break into the USB drive within two hours. They failed."

Comments

What if they cut the finger and heat it

[unity100]

to 37 degrees celsius ?

Re:What if they cut the finger and heat it

[jamesh]

Or alternatively, find someone the owner of the USB stick cares about and threaten to cut off that persons finger if the owner doesn't cooperate.

Re:What if they cut the finger and heat it

[John Hasler]

Some guy who finds your USB stick on the train isn't going to hunt you down and beat the password out of you. If he had motive and opportunity to do that he would already have done it.

Two hours?

[mog007]

Presumably, if you had physical access to the drive, wouldn't you have more time to crack it than two hours?

Re:Two hours?

[spacerog]

"At a contest held in London, Victorinox was offering a £100,000 cash prize ($149,000) to a team of professional hackers if they could break into the USB drive within two hours. They failed."

Umm, they weren't Pros. The contest was open to anyone who preregistered and you got to keep the knife after the contest. Not only that there were several restrictions on the contest. First you have to live in the UK, preregister and you only get two hours. Because ya know the bad guys always tell you who they are and always give up after two hours. Oh, and you have to be present to win, no Internet based attacks, you can only use Windows 64bit or whatever Linux flavor they are providing and of course you have to give up your exploit if you win. All that and more for a measly hundred thousand pounds? Yeah, no thanks, but hey it makes for great publicity and it is a cool knife.

So called "Hacker Challenges" are not a valid security assessment.

- Space Rogue

Re:Two hours?

[fuzzyfuzzyfungus]

Even if they aren't lying, the question is "did they use AES 256 correctly?"

There are a number of ways, some of them non-obvious, to produce a system that does, in fact, use AES 256 in some capacity; but doesn't actually achieve reasonably security against anybody who wouldn't also be stopped by XOR and a scary looking autorun program(particularly since, as this is a small USB drive, the attacker can probably make some plausible assumptions about some of the plaintext, based on what is known about what fat32 volumes look like).

Professional hackers? 2 hours?

[alexandre]

I thought that we had stopped 10 years ago to consider such scam contest as serious security proof?

Re:Professional hackers? 2 hours?

[HungryHobo]

Oh I didn't say it was useless.
My point is that pen testing doesn't secure your system.
It only provides feedback as to how secure your system really is within a reasonable margin of error.

If you test a system and find a hundred holes and hand over a neat list and they diligently go away and fix all the holes you found then their system is only marginally more secure than it was before.
The systematic failures that lead to the problems being there in the first place are still there making more problems.
The same crappy code is still there with a few patches.

On the other hand if you do a full pen test and find no security holes or only a few minor ones then that's a decent indication that there are very few there at all.

Pen testing is a fine way to test and be able to say "this system probably has very few problems" or "this system is utterly riddled with faults" but pen testing is an awful way to actually secure your system.

At best pen testing can show blinkered managers that they need to pay some attention to security and in that one case may help to actually improve security.

Thermal sensor?

[zmotula]

The Secure features a fingerprint scanner and a thermal sensor 'so that the finger alone, detached from the body, will still not give access to the memory stick's contents.'

Surely if somebody can chop off your finger he can also warm it up?

You're naive.

[Suzuran]

Last week in Texas, three men with assault rifles attempted to ambush and execute a family of four to steal the rims from their SUV. Human life is worthless to criminals.

Re:You're naive.

[Ihmhi]

With the insane amount of laws most industrialized nations have on the books, everyone is a criminal. They like it that way. They'll always have something to hold over your head to get you to cooperate.

Take an afternoon, head to your local library, and just read up on your local laws - city, town, county, whatever the smallest area of government you can narrow it down to. Good luck figuring that stuff out, much less following every single one without breaking any.

I predict

[Anonymous Coward]

that within 1-2 months we will find out that:

1) the finger print scanner is not actually linked to the encryption key, but is just to "power on" the device.

2) the encryption key is processed in host (windoze) based software and that a usb control packet (the exact same packet for all devices) is simply sent to the onboard controller to tell it to "allow access".

3) the encryption, while purporting to be aes256, is so poorly implimented that it in effect becomes a 16-bit key, thereby becoming brute-forcable on an old C-64 in only 2 days.