Slashdot Mirror
Self-Destructing USB Stick
Hugh Pickens writes "PC World reports that Victorinox, maker of the legendary Swiss Army Knife, has launched a new super-secure memory stick that sounds like something out of Mission: Impossible. The Secure Pro USB comes in 8GB, 16GB, and 32GB sizes, and provides a variety of security measures including fingerprint identification, a thermal sensor, and even a self-destruct mechanism. Victorinox says the Secure is 'the most secure [device] of its kind available to the public.' The Secure features a fingerprint scanner and a thermal sensor 'so that the finger alone, detached from the body, will still not give access to the memory stick's contents.' While offering no explanation how the self-destruct mechanism works, Victorinox says that if someone tries to forcibly open the memory stick it triggers a self-destruct mechanism that 'irrevocably burns [the Secure's] CPU and memory chip.' At a contest held in London, Victorinox put its money where its mouth was and put the Secure Pro to the test offering a £100,000 cash prize ($149,000) to a team of professional hackers if they could break into the USB drive within two hours. They failed."
to 37 degrees celsius ?
Read radical news here
Presumably, if you had physical access to the drive, wouldn't you have more time to crack it than two hours?
Learn something new.
Surely if somebody can chop off your finger he can also warm it up?
Against the trojan on the computer you hook it up to.
The knife might be useful for cutting off your finger though.
Indeed.
Not only do you have to let it out of your sight/control if you fly, it also comes with a built in way for someone to threaten you or cut off your finger (and use it quickly.. they are not nice to touch once they go cold)
Teacher, I swear I wrote up the entire 40 page paper, but I burned my thumb really bad the other day and when I went to retrieve my paper, it exploded.
"...if they could break into the USB drive within two hours. They failed."
Am I completely deluded if I think that if crackers have a physical access to a USB drive, they just may be able to withhold it for more than two hours? Maybe I'm proposing a completely implausible scenario here, but suppose the USB drive has been "stolen" (a term which means "physically removed from the possession of the legitimate owner" for those who don't grok this high-tech security lingo) - in such case, the legitimate owner may, theoretically, need more than 2 hours to recover the USB drive, and the attacker can use a longer period of time to their advantage. I remember reading in the literature that "stolen" USB drives may, in some cases, be recovered days, weeks, months later - and in many cases, they may never be recovered. Whether that qualifies as significantly longer than 2 hours, I don't know. I'm not an expert.
In case you're wondering, no, I don't put much faith in hacking contests, especially if the scenarios they test have small obvious flaws like this. =)
Just for curiosity's sake, I'm trying to think of how difficult that would actually be....
Exposing blood to air gives your pretty decent oxygen saturation. Doing that for any great length of time is likely to cause clotting or other nastiness, so it isn't exactly an alternative to the "lung" side of "heart lung machine"; but this isn't medicine we are talking about, just fooling a sensor. In the same vein, the sensor isn't going to care about blood type, immune matching, or anything like that. Also, a finger doesn't have that much volume to in. A few CCs of fresh blood(from say, yourself, or the same guy you took the finger from), exposed to air for a few seconds, would be fine.
Pulse could presumably be simulated with a low power pump(perhaps a small peristaltic unit), with its power supply being turned on and off at roughly the right frequency. I can't imagine that huge exactness is required, since the pulse rates of humans vary fairly widely with conditions, and people would be pissed if their fingerprint scanner doesn't work if they've just run up a flight of stairs, or are freaking out about the big presentation in 20 minutes.
The real difficulty, or lack thereof, would really come down to the artery/vein structure of the finger. If you can get away with just connecting to a couple of big blood vessels and ignoring some minor leakage(since this is all temporary and nonmedical), an amateur willing to just shove a few little tubes in there should do fine. If the sensor can detect(and is tuned to care about) the details of the vascalature, you'd pretty much need a cooperative microsurgeon, a fancy microscope, and real surgical kit. That would probably be problematic for most applications.
Obviously, the above would be a huge pain in the ass, even under good conditions, and is highly unlikely to be worth it(probably easier just to show the owner of the finger your pair of bolt cutters, and let him operate the scanner for you, unless you are in an environment where the cameras would pick up on that, in which case the above described apparatus could, quite plausibly, be fit down the sleeve of a not-too-suspicious garment).
Perhaps more practical, I wonder how difficult it would be to produce a variant of the classic "gelatin finger with correct fingerprint" that reads as having oxygen sat and a pulse? Would one made of blood agar return plausible results under optical oxygen saturation tests? If so, that's raise the bar from "supermarket" to "laboratory supply house"; but that wouldn't be too bad. For pulse, the question is "how complex does your simulated vasculature have to be?" Any decently competent modeler can probably mould a simple circulatory loop into a gel finger; but achieving an actual capillary structure is sci-fi self-assembling nanomaterials stuff...
that within 1-2 months we will find out that:
1) the finger print scanner is not actually linked to the encryption key, but is just to "power on" the device.
2) the encryption key is processed in host (windoze) based software and that a usb control packet (the exact same packet for all devices) is simply sent to the onboard controller to tell it to "allow access".
3) the encryption, while purporting to be aes256, is so poorly implimented that it in effect becomes a 16-bit key, thereby becoming brute-forcable on an old C-64 in only 2 days.
I saw a self-destructed sample of this unit at CES in January. It did not self destruct from an opening attempt, as opening those is quite easy. The drive is enclosed by a simple clear plastic shell (not epoxy filled). The 'destruction' was caused by presumably supplying voltage in excess of the USB spec. You could literally pry the plastic off of the USB drive with the included knife, and it would work just fine (sans enclosure).
Also, it would be nice if PCWorld at would at least get the name of these things correct:
http://www.swissarmy.com/multitools/Pages/Category.aspx?category=presentation+pro&
Perhaps the USB-only part is dubbed 'Secure', but you won't ask for that name when you want to buy one.
Allyn Malventano
Storage Editor, PC Perspective
this sig was brought to you by the letter
I doubt very seriously that it's incendiary. I would guess that it is electrical in nature. I built an anti tamper device before and used a 300v photo flash cap run down the ground rail. VERY effective. Actually blew some SMB components off of the board and set several tantalum capacitors on fire.
Although I guess that could be considered incendiary....
Human life is worthless to criminals.
Human life is worthless to murderers. The term criminals covers a wide variety of law-breakers from litterers to mass-murderers.
When are they going to make a USB Stick with a corkscrew? I might just need to recover with a bottle of wine after my thumb drive destroys itself.
With the insane amount of laws most industrialized nations have on the books, everyone is a criminal. They like it that way. They'll always have something to hold over your head to get you to cooperate.
Take an afternoon, head to your local library, and just read up on your local laws - city, town, county, whatever the smallest area of government you can narrow it down to. Good luck figuring that stuff out, much less following every single one without breaking any.
Random Thoughts From A Diseased Mind (Not For Dummies)
Rather than try to "protect" the data contained within a thumb stick (which is kind of passive if you think about it), why not actively try to destroy all data to whatever is connected to the thumb stick instead...
Criminal: "Ha! I stole this thumb stick from that stupid corporation, and I am sure it is just stuffed with credit card info! Now to just use these easily available utilities I found online to crack it..."
Plugs in device
PC: "Password: "
Criminal: "Pffft I can just ignore that, now where did I put that cracker utility..."
PC: "Timeout. Initiating self destruct!"
Criminal: "Pfft as if it is going to blow up or something, what a joke..."
PC: "Virus Loaded....Deleting all files.... Complete. Have a nice day!"
Criminal: "....."
Criminal: "....."