CVE-2022-28384

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2022-005 Product: Store ‘n’ Go Secure Portable HDD Manufacturer: Verbatim Affected Version(s): GD25LK01-3637-C VER4.0 Tested Version(s): GD25LK01-3637-C VER4.0 Vulnerability Type: Use of a Cryptographic Primitive with a Risky Implementation (CWE-1240) Risk Level: High Solution Status: Open Manufacturer Notification: 2022-01-31 Solution Date: - Public Disclosure: 2022-06-08 CVE Reference: CVE-2022-28384 Author of Advisory: Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: The Verbatim Store ‘n’ Go Secure Portable HDD is a portable USB drive with AES 256-bit hardware encryption and a built-in keypad for passcode entry. The manufacturer describes the product as follows: “The AES 256-bit Hardware Encryption seamlessly encrypts all data on the drive in real-time with a built-in keypad for password input. The SSD does not store passwords in the computer or system’s volatile memory making it far more secure than software encryption. Also, if it falls into the wrong hands, the SSD will lock and require re-formatting after 20 failed password attempts.” [1] Due to an insecure design, the Verbatim Store ‘n’ Go Secure Portable HDD is vulnerable to an offline brute-force attack for finding out the correct passcode, and thus gaining unauthorized access to the stored encrypted data. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: When analyzing the external SSD Verbatim Store ‘n’ Go Secure Portable HDD, Matthias Deeg found out it uses an insecure design which allows for offline brute-force attacks against the passcode. The device consists of following four main parts: 1. a Toshiba SSD (MQ04ABF100) 2. an USB-to-SATA bridge controller (INIC-3637EN) 3. a SPI flash memory chip (XT25F01D) containing the firmware of the INIC-3637EN 4. a keypad controller (unknown chip, marked “SW611 2121”) For encrypting the data stored on the SSD, the hardware AES engine of the INIC-3637EN is used. More specifically, AES-256 in ECB (Electronic Codebook) mode is used for data encryption, which is also a security issue by itself described in SySS security advisory SYSS-2022-002 [2]. The cryptographic key for the actual data encryption, the so-called data encryption key (DEK) is stored in a special sector of the SSD which in turn is encrypted using AES-256-ECB with a so-called key encryption key (KEK). This KEK is derived from the entered passcode which can be between five and twelve digits long, and generated by the keypad controller. When the unlock button is pressed on the Verbatim Store ‘n’ Go Secure Portable HDD, this generated AES 256-bit key is transmitted via SPI communication from the keypad controller to the USB-to-SATA bridge controller INIC-3637EN for configuring the corresponding hardware AES engine. For verifying the entered passcode, the firmware of the INIC-3637EN reads and decrypts the special sector on the SSD with the provided KEK, and checks specific data offsets for the known byte pattern (signature) “0x20 0x49 0x4E 0x49” which represents the string " INI". If this byte pattern could successfully be found, the entered passcode and its derived AES key is very likely correct, and enables the firmware access to the decrypted DEK, which can then be used to decrypt the actual SSD user data. This described design of the Verbatim Store ‘n’ Go Secure Portable HDD allows for offline brute-force attacks for finding the correct passcode. Because an attacker can generate and observe the derived AES keys (KEK) of the keypad for all possible passcodes, and then try to correctly decrypt the data of specific SSD sector. If the magic byte pattern " INI" can be found in the expected places of the resulting plaintext, the correct passcode was found, which then allows for gaining unauthorized access to the encrypted user data. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): For demonstrating the offline brute-force attack, Matthias Deeg developed a sample brute-forcing software tool which checks the complete search space of all possible passcodes between 5 and 12 digits. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a solution for the described security issue. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2022-01-31: Vulnerability reported to manufacturer 2022-02-11: Vulnerability reported to manufacturer again 2022-03-07: Vulnerability reported to manufacturer again 2022-06-08: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Verbatim Store ‘n’ Go Secure Portable HDD https://www.verbatim-europe.co.uk/en/prod/store-n-go-portable-ssd-with-keypad-access-256gb-53402/ [2] SySS Security Advisory SYSS-2022-006 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-006.txt [3] SySS Security Advisory SYSS-2022-005 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-005.txt [4] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided “as is” and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAmKgQV4ACgkQ2aS/ajSt TasjRRAAhtk8nBm5SWqnu0hs3YmhIRmNc9qfaNPw1kQvYqQz1Uit+4sc19D6c3gq uxp4b7MqnLehyw+lPkK0vLvZ2+IwbxvzWx2j9efu1Pnm4fDTiX2pAWD5zL+yyi0s JALVE6Mn40brjUfzCvj0Mbyvca/S58ifmPVk+c+HhkvsUqStEj/yOZAblf8lK6CM vj64NyGTw/P6xRe7IOJXHAOVsM9PEDM8PsIV06J4XfWhf79BVrifQcVu2GNDWXOU izg/5nZ4vHVeKYFL1ZK1NfGMFOsOwbw9Cx3Z9y+LzqwG3t2G0xt8cZRagEuthjJg p+Eo2mMqvH8wZZgqwn22sOCdfSqoP7fXb+KMGaTjaOAqs37sYpGW17+qm+xv5fiJ R2Zeuk3sUlr+t0nAoFAN/iSCvusI+SW2vVvn1G0wOznNZLIbTFhJ3mM8ita+1Wfl 9FDsIgWHmkgtkEpQp6pKhxstsKmu88BfWkMLjmWDzAJW8N6szvlQa+V2wSAMbMUn PJJbBJKbzDgL0WolIYHH0I34KY8vQ9lxAR+0D9ctsuUVqeV+ceMwHjjqwd1I9+Az qDelwm/Tba/t7KKiOOgrcqKA0C/cm/3O0HZy+TQYm6WW0DUqmqXJWJd7TUAjTBW6 IGpM63u1JrIdupL2T0mBn4wWm3NDBFdRl6BZv+M+82OguPUVOHM= =FE8o -----END PGP SIGNATURE-----