Possible Encryption Chip Security Issues

[C1]

Tip of Iceberg ?

"Last year, Deeg analyzed the first firmware of a Verbatim secure USB thumbdrive that uses an Initio chip and found multiple security vulnerabilities: One allowed him to quickly bypass a fingerprint reader or PIN on the drives and access any “administrative” password that had been set for the drives, a master password feature designed to allow IT administrators to decrypt users' devices. Another flaw allowed him to “brute-force” the decryption key for the drives, deriving the key to access their contents in at most 36 hours."

"Security researchers' teardowns have shown that storage device manufacturers including Lenovo, Western Digital, Verbatim, and Zalman have all at times used encryption chips sold by Initio."

https://www.wired.com/story/hualan-...-china/?utm_source=dlvr.it&utm_medium=twitter

 

[Geven]

The vulnerabilities you mentioned are pretty serious. However, it's good to know that these are now out in the open, as it means manufacturers and software developers can work on fixing them. It's also worth noting that just because a device uses a chip from a certain company, it doesn't automatically mean it's vulnerable.

Going forward, be sure to keep your devices and software up-to-date with the latest patches, as updates often contain fixes for known vulnerabilities. And if possible, use a multi-layered approach to security.

 

[mikeymikec]

Going forward, be sure to keep your devices and software up-to-date with the latest patches, as updates often contain fixes for known vulnerabilities. And if possible, use a multi-layered approach to security.

It seems a lot easier just to use encryption software rather than rely on hardware that potentially can't be patched, not to mention availability and pricing of standard storage hardware.