Some Kingston key drives aren't so secure after all

One of the best things about working in the test lab for GCN is that we get to try all different types of technology, grade them and then pick the best ones to use ourselves (along with advising our readers).

So when the Kingston DataTraveler BlackBox got a good review in the lab with its high security and good test results, we decided to make that the key drive we in the lab would use. It turns out, however, that it’s not as secure as we thought.

The company today released a statement saying that a hacker “with the proper tools and physical access to the drives may be able to gain unauthorized access to data.”

The revolutionary feature of the BlackBox was that it not only featured 256-bit, hardware-based Advanced Encryption Standard encryption and password protection, but could actually erase data if an incorrect password was entered too many times. The earliest models had this number set at 25; the one we tested dialed that down to 10.

This feature was tested during the review. After the 11^th time an incorrect password was entered, all data on the drive was erased. The key drive continued to function normally, sans data.

So what’s the problem? Kingston isn’t saying how its drives can be hacked, but from what we found experimenting with ours, we can make an intelligent guess. Unlike the IronKey secure drive, which the lab also uses, the actual drive of the BlackBox isn’t in any danger from incorrect password entering. With the IronKey, too many failed attempts turns the drive into slag, rather than just erasing the data. Also, the IronKey is physically protected, so trying to open up the drive to get at the flash memory is almost impossible without destroying the memory. A sticky epoxy inside a tough metal case ensures that. If you try to pry open an IronKey, it will destroy the media. The BlackBox has no such protection.

Kingston did say that a hacker would need “the right tools” and “physical access to the drive,” which gives us a good clue that this might be how the drives can be hacked. Nobody is going to break the FIPS-certified 256-bit encryption. We’ve tried in the lab before and never got close, even after running a brute force attack against it for weeks on end. However, the BlackBox is only certified to level 2, which means that the device in question will show evidence of physical tampering. It’s only at levels 3 and 4 that the device has to resist physical tampering, which would block any access to the encryption key stored within the drive.

Now, the BlackBox is rugged. GCN Lab Reviewer Greg Crowe lost his in the parking lot once. We found it days later. It had obviously been run over by a car at least once because it was slightly squashed and had tire tracks on it. But the drive itself still worked fine. However, the shell is just a high-strength plastic. A sodering iron will flay it open like a hot knife thorugh butter, if done right -- when we tried, we acidentally melted the memory. But we were working on a tight deadline and didn’t know what the internal media looked like.

So what’s the weak link in the BlackBox? You can physically take the drive apart, although it’s not easy. It only has a plastic shell, not a metal one like the IronKey. Opening the box up would likely let someone who knew what they were doing change the factory setting that erases the drive after only 10 wrong passwords are entered.

A hacker would not need to go after the data itself, but could use a brute force attack against the password. And we have reviewed devices that can do that in seconds without leaving a trace behind. Once the data-erase setting was changed, it would only be a matter of time, and not too much of it, either. Sure, the drive would “show evidence of tampering.” But if a hacker has the right tools and access to the drive, that doesn’t really matter. Most likely, they are sitting at a workbench somewhere with your stolen drive.

Suddenly, our BlackBox drives don’t look so secure anymore. Kingston says that the DataTraveler Secure Privacy Edition and the DataTraveler Elite Privacy Edition are also affected, though the company claims that the rest of the lineup is fine. And the only solution to the problem is to send your drive back to the factory, with the warning that you will lose all your data. It sounds like Kingston is actually going to replace the drive, presumably with something more secure against physical tampering, instead of fixing the old ones.

It’s worth noting that other companies that make key drives are jumping on the bandwagon, distancing themselves from Kingston and saying that their drives aren’t affected by this flaw. They stress that they use hardware chips to validate the password, not a hackable software engine. So even if you can get at the drive physically, you won’t be able to hack it regardless of what device you happen to possess.