Stealing passwords from secure flash drives

While under contract from Systematic Development Group to compare security of the new LOK-IT Secure Flash Drive ( http://www.LOK-IT.net ) to other secure drives in the marketplace, I found significant holes within the software authentication mechanisms employed by the other secure drives. This quick video demonstrates how undetectable malware can easily compromise the passwords (including Ironkey virtual keyboard).

Category:

Science & Technology

Tags:

• USB Flash Drives
• Nerve Net
• hack
• password theft
• security
• Kingston DataTraveler 5000
• Ironkey Basic S200
• Kanguru Defender Elite
• Lexar SAFE S3000

[davewilcox879]

If someone has repeated physical access to your computer, and knows your computer's password, and can install malicious software, then you have way bigger problems than a secure flash drive can fix!

Like, someone could install malicious software that ftps all your files from your secure device once you unlock it, whether it was biometric unlock or something else.

[wkstube101]

@davewilcox879 Are you saying that no employee with access to confidential business information has ever ended up with malicious software on his computer, either because he was duped into installing it or because other with access to his computer (e.g. his kids at home) installed it? History seems to indicate otherwise.

[stvjones653]

How is this new???? It's a home-grown keystroke logger that he installed on his own computer. It's got nothing to do with stealing passwords from secure flash drives... it will steal passwords from anything (online banking, email, VPN). There is a good Wikipedia article on keyloggers h

[wkstube101]

@stvjones653 That keyloggers aren't new does not mean the vulnerability isn't real. I'm pointing out here that my keyloggers escape detection by antivirus software, and that non-keylogger spying techniques successfully intercept passwords in virtual-keyboard situations. I've seen no wikipedia discussion of these matters, so that's how this is new. More videos to follow.

[ForrestDix]

What about physical wear? The buttons used in your password will wear over time. So, a careful analysis will reveal which buttons are used most. In the case of a 4 digit pin with no repetition and ten allowed attempts, this would provide a 10/4! chance of guessing the password. Or, about 42%. That doesn't seem secure to me.

[FerribySinger]

@Ralothael @Ralothael In your two posts you summed up eloquently what I was about to say. Maybe security could be improved by 2-factor authentication? The first factor (PIN) would unlock the drive, making it visible to the OS. The second factor also requiring direct entry onto the USB drive (eg hardware fingerprint reader) for each file read/written.

[lifebarier]

Or you could also watch keyboard when someone is typing password! That is vulnerability too!!!

[CALLMECRAZY69]

@stvjones653 He's promoting the competition's product (imho) which has a 12 button PIN pad on a 2"x.5" USB Key. That must be fun for bi-focals. A key logger can't access that information so therefor it must be a better option. For the price it maybe. :) Thanks for the post!

[pawndominance1]

so your saying you can get into the Ironkey without the password?

[syndragon]

This is no different then Spoofing the login, if you have admin access and can install virus.loggers on the host machine, then you can also just Spoof the login, its got next to nothing to do with the USB. Lets see you hack it without already knowing the PW lol, if you did this remotely you would then need to burglarize the USB itself, so its a very weak attack relying on 1. admin rights to host 2. possesion of the USB itself. 3) the real password typed in

[Ralothael]

Also, just because they have the password to your device doesn't mean much. They would also have to have the device itself. Think about it, If your password to your device and the device itself could be compromised by the SAME PERSON, then there are much bigger security issues present than a secure drive is going to fix. Yeah, someone has my password, big deal,. Unless that same person is in my house with me, they will not be getting the device, making their knowledge useless.

[Ralothael]

A key-logger is also not the only threat. There are programs that could steal the data from the USB when it is unlocked and open, which is something that no flash drive, not even the LOK-IT drive is going to prevent. No matter what secure drive you have, if there is malware on the computer, its data is going to be vulnerable. This video is just beating on others that use authentication in software, rather than hardware, hoping it will sway the people who don't know better.

[kevinthegenius]

The fact that a "reputable" antivirus software is running and detects nothing at all is what scares me the most. I am quite certain I've had to deal with 3 or 4 virus situations over the past few years; not a single time has any antivirus software been of any help, so this does not surprise me.