Verbatim Store 'n' Go Secure Portable SSD Weak Cryptography

Advisory ID: SYSS-2022-043
Product: Store ‘n’ Go Secure Portable SSD
Manufacturer: Verbatim
Affected Version(s): #53402 (GDMSLK02 C-INIC3637-V1.1)
Tested Version(s): #53402 (GDMSLK02 C-INIC3637-V1.1)
Vulnerability Type: Use of a Cryptographic Primitive with a Risky
Implementation (CWE-1240)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2022-06-29
Solution Date: 2022-07
Public Disclosure: 2022-10-07
CVE Reference: CVE-2022-28384
Author of Advisory: Matthias Deeg (SySS GmbH)

Overview:

The Verbatim Store 'n' Go Secure Portable SSD is a portable USB drive  
with AES 256-bit hardware encryption and a built-in keypad for passcode  
entry.

The manufacturer describes the product as follows:

"The AES 256-bit Hardware Encryption seamlessly encrypts all data on the  
drive in real-time with a built-in keypad for password input. The hard  
drive does not store passwords in the computer or system’s volatile  
memory making it far more secure than software encryption. Also, if it  
falls into the wrong hands, the hard drive will lock and require  
re-formatting after 20 failed password attempts."[1]

Due to an insecure design, the Verbatim Store 'n' Go Secure Portable SSD  
is vulnerable to an offline brute-force attack for finding out the  
correct passcode and thus gaining unauthorized access to the stored  
encrypted data.

Vulnerability Details:

When analyzing the external storage device Verbatim Store ‘n’ Go Secure
Portable SSD, Matthias Deeg found out that it uses an insecure design
which allows for offline brute-force attacks against the passcode.

The device consists of the following four main parts:

1. An SSD with M.2 form factor
2. A USB-to-SATA bridge controller (INIC-3637EN)
3. An SPI flash memory chip (XT25F01D) containing the firmware of the
   INIC-3637EN
4. A keypad controller (unknown chip, marked “SW611 2201”)

For encrypting the data stored on the SSD, the hardware AES engine of
the INIC-3637EN is used. More specifically, AES-256 in ECB (Electronic
Codebook) mode is used for data encryption, which is also a security
issue by itself described in SySS security advisory SYSS-2022-044[2].

The cryptographic key for the actual data encryption, the so-called data
encryption key (DEK), is stored in a special sector of the SSD which in
turn is encrypted using AES-256-ECB with a so-called key encryption key
(KEK).

This KEK is derived from the entered passcode which can be between five
and twelve digits long, and generated by the keypad controller.

When the unlock button is pressed on the Verbatim Store ‘n’ Go Secure
Portable SSD, this generated AES 256-bit key is transmitted via SPI
communication from the keypad controller to the USB-to-SATA bridge
controller INIC-3637EN for configuring the corresponding hardware AES
engine.

For verifying the entered passcode, the firmware of the INIC-3637EN
reads and decrypts the special sector on the SSD with the provided KEK
and checks specific data offsets for the known byte pattern (signature)
“0x20 0x49 0x4E 0x49” which represents the string " INI".

If this byte pattern could successfully be found, the entered passcode
and its derived AES key is very likely correct and grants the firmware
access to the decrypted DEK, which can then be used to decrypt the
actual SSD user data.

This described design of the Verbatim Store ‘n’ Go Secure Portable SSD
allows for offline brute-force attacks for finding the correct passcode,
because an attacker can generate and observe the derived AES keys (KEK)
of the keypad for all possible passcodes and then try to correctly
decrypt the data of a specific SSD sector. If the magic byte pattern
" INI" can be detected in the expected places of the resulting plaintext,
the correct passcode is found, which then allows for gaining
unauthorized access to the encrypted user data.

Proof of Concept (PoC):

For demonstrating the offline brute-force attack, Matthias Deeg  
developed a sample brute-forcing software tool which checks the complete  
search space of all possible passcodes between five and twelve digits.

The following output exemplarily shows a successful attack.

 >VKSCracker.exe  
  _   _ _   __ _____   _____                _  
| | | | | / //  ___| /  __ \              | |  
| | | | |/ / \ `--.  | /  \/_ __ __ _  ___| | _____ _ __  
| | | |    \  `--. \ | |   | '__/ _` |/ __| |/ / _ \ '__|  
\ \_/ / |\  \/\__/ / | \__/\ | | (_| | (__|   <  __/ |  
  \___/\_| \_/\____/   \____/_|  \__,_|\___|_|\_\___|_|  
  ... finds out your passcode.

Verbatim Keypad Secure Cracker v0.6 by Matthias Deeg   
<[email protected]> (c) 2022  
---  
[*] Found 8 logical processors  
[*] Found 2 physical drives  
[*] Trying to read magic sector from device \\.\PHYSICALDRIVE0  
[*] Trying to read magic sector from device \\.\PHYSICALDRIVE1  
[*] Found a plausible magic sector for Verbatim Keypad Secure (#49428) or  
     Verbatim Store 'n' Go Secure Portable SSD (#53402)  
[*] Initialize passcode hash table  
[*] Start cracking ...  
[+] Success!  
     The passcode is: 12345678  
[*] Some statistics  
     Total cracking time:   5.37 seconds  
     Candidates per second: 10132001

Solution:

The described offline brute-force attack was fixed by the Verbatim
“Security Update July 2022”[4].

Disclosure Timeline:

2022-06-29: Vulnerability reported to manufacturer  
2022-07   : Manufacturer publishes security update[4]  
2022-10-07: Public release of security advisory

References:

[1] Product website for Verbatim Store ‘n’ Go Secure Portable SSD

https://www.verbatim.com.au/products/store-n-go-portable-ssd-with-keypad-access/
[2] SySS Security Advisory SYSS-2022-044

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-044.txt
[3] SySS Security Advisory SYSS-2022-043

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-043.txt
[4] Security Update July 2022: Store ‘n’ Go Portable SSD
https://www.verbatim-europe.co.uk/en/support-centre/?part_no=53402
[5] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy

Credits:

This security vulnerability was found by Matthias Deeg of SySS GmbH.

E-Mail: matthias.deeg (at) syss.de  
Public Key:   
https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc  
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

Disclaimer:

The information provided in this security advisory is provided “as is”
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

Copyright:

Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en