GuiGui's Show - Liens
« The paper, titled got HW crypto? On the (in)security of a Self-Encrypting Drive series, recited a litany of weaknesses in the multiple versions of the My Passport and My Book brands of external hard drives. The flaws make it possible for people who steal a vulnerable drive to decrypt its contents, even when they're locked down with a long, randomly generated password.

[...]

In one case, the underlying key was predictable because the random numbers used to generate it was derived from the current time on the computer clock. That flaw was fixed last year, but it's likely many people with vulnerable drives have no idea they're at risk.

[...]

In other cases, it was possible to extract the hash off the drive and load it onto a computer so it could be subjected to off-line cracking.

[...]

Yet another flaw constitutes the equivalent of a backdoor that could allow an attacker to decrypt data without knowing or cracking the user password at all. The drives ship with a default password, but in cases where it has been changed to a user-defined password only once, the key corresponding to the default password remains stored on the device, making it trivial for adversaries to decrypt it. The flaw can overcome by resetting the password a second time, but without that knowledge, it's likely many users will not take the time to do so. »

J-O-I-E. LUKS (sous GNU/Linux) > * .
(Permalink)