exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Verbatim Keypad Secure USB 3.2 Gen 1 Drive Cryptography Issue

Verbatim Keypad Secure USB 3.2 Gen 1 Drive Cryptography Issue
Posted Jun 19, 2022
Authored by Matthias Deeg | Site syss.de

When analyzing the USB drive Verbatim Keypad Secure version 3.2 Gen 1 Drive, Matthias Deeg found out it uses an insecure design which allows for offline brute-force attacks against the passcode.

tags | advisory
advisories | CVE-2022-28384
SHA-256 | 3ed883a011f776ec342336cc3c9cfdade67dfbd44f04b20239f15f16a6dc912e

Verbatim Keypad Secure USB 3.2 Gen 1 Drive Cryptography Issue

Change Mirror Download
Advisory ID:               SYSS-2022-001
Product: Keypad Secure USB 3.2 Gen 1 Drive
Manufacturer: Verbatim
Affected Version(s): Part Number #49428
Tested Version(s): Part Number #49428
Vulnerability Type: Use of a Cryptographic Primitive with a Risky
Implementation (CWE-1240)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2022-01-27
Solution Date: -
Public Disclosure: 2022-06-08
CVE Reference: CVE-2022-28384
Author of Advisory: Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The Verbatim Keypad Secure is a USB drive with AES 256-bit hardware
encryption and a built-in keypad for passcode entry.

The manufacturer describes the product as follows:

"The AES 256-bit Hardware Encryption seamlessly encrypts all data on the
drive in real-time with a built-in keypad for passcode input. The USB
Drive does not store passwords in the computer or system's volatile
memory making it far more secure than software encryption. Also, if it
falls into the wrong hands, the device will lock and require
re-formatting after 20 failed passcode attempts."[1]

Due to an insecure design, the Verbatim Keypad Secure USB drive is
vulnerable to an offline brute-force attack for finding out the correct
passcode, and thus gaining unauthorized access to the stored encrypted
data.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

When analyzing the USB drive Verbatim Keypad Secure, Matthias Deeg found
out it uses an insecure design which allows for offline brute-force
attacks against the passcode.

The Verbatim Keypad Secure consists of the following four main parts:

1. An SSD in M.2 form factor (SSD controller MARVELL-88NV1120)
2. A USB-to-SATA bridge controller (INIC-3637EN)
3. An SPI flash memory chip (XT25F01D) containing the firmware of the
INIC-3637EN
4. A keypad controller (unknown chip, marked "SW611 2121")

For encrypting the data stored on the SSD, the hardware AES engine of
the INIC-3637EN is used. More specifically, AES-256 in ECB (Electronic
Codebook) mode is used for data encryption, which is also a security
issue by itself described in SySS security advisory SYSS-2022-002[2].

The cryptographic key for the actual data encryption, the so-called data
encryption key (DEK), is stored in a special sector of the SSD which in
turn is encrypted using AES-256-ECB with a so-called key encryption key
(KEK).

This KEK is derived from the entered passcode which can be between five
and twelve digits long, and can be generated by the keypad controller.

When the unlock button is pressed on the Verbatim Keypad Secure, this
generated AES 256-bit key is transmitted via SPI communication from the
keypad controller to the USB-to-SATA bridge controller INIC-3637EN for
configuring the corresponding hardware AES engine.

For verifying the entered passcode, the firmware of the INIC-3637EN
reads and decrypts the special sector on the SSD with the provided KEK,
and checks specific data offsets for the known byte pattern (signature)
"0x20 0x49 0x4E 0x49" which represents the string " INI".

If this byte pattern could successfully be found, the entered passcode
and its derived AES key are very likely correct, and enable the firmware
access to the decrypted DEK which can then be used to decrypt the
actual SSD user data.

This described design of the Verbatim Keypad Secure allows for offline
brute-force attacks for finding the correct passcode. Because an
attacker can generate and observe the derived AES keys (KEK) of the
keypad for all possible passcodes, and then try to correctly decrypt the
data of the specific SSD sector. If the magic byte pattern " INI" can be
found in the expected places of the resulting plaintext, the correct
passcode was found, which then allows for gaining unauthorized access to
the encrypted user data.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

For demonstrating the offline brute-force attack, Matthias Deeg
developed a sample brute-forcing software tool which checks the complete
search space of all possible passcodes between five and twelve digits.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS GmbH is not aware of a solution for the described security issue.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2022-01-27: Vulnerability reported to manufacturer
2022-02-11: Vulnerability reported to manufacturer again
2022-03-07: Vulnerability reported to manufacturer again
2022-06-08: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Verbatim Keypad Secure

https://www.verbatim-europe.co.uk/en/prod/verbatim-keypad-secure-usb-32-gen-1-drive-64gb-49428/#
[2] SySS Security Advisory SYSS-2022-002

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-002.txt
[3] SySS Security Advisory SYSS-2022-001

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-001.txt
[4] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg of SySS GmbH.

E-Mail: matthias.deeg (at) syss.de
Public Key:
https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close