0

I have Kingston DataTraveler vault privacy USB flash drive (DTVP/2GB). Here is tech specs. Flash drive has a 256-bit AES hardware based encryption. My flash has password protected and I do not know password. Is it possible, to crack password in some way?

The question is - is it possible to get encrypted password hash from flash drive and then brute force it on another machine ?

  • Without specifing a timeframe, yes, I believe so. But you would probably be long gone by the time it would be cracked. – Darsstar Jul 7 '14 at 8:53
  • Couple of questions to help demonstrate why this isn't a useful approach: imagine you could get the hash- do you know how long it takes to brute force passwords? Do you know how long the password is? How will you know when you have the right password? ... – Rory Alsop Jul 7 '14 at 8:55
  • I searched and found, that brute forcing can take very long time. And i thing that password can be salted. minimal length of password is 6 characters. i think that it can be between 6 and 12 characters. – Guntis Jul 7 '14 at 9:03
  • For information, oldest version of the same product had a big authentication breach: zdnet.com/article/… Because of this old my company keys have been replaced by these DTVP/2GB – Yves Martin May 16 '15 at 12:48
1

My flash has password protected and I do not know password. Is it possible, to crack password in some way?

Short answer: No, since neither me nor you know how the device operates inside.

Long answer: This requires a lot of knowledge on how this specific device implements the claimed Enterprise-Grade Security. My best bet would be, most of users here don't know that, and Kingston won't divulge the "commercial secrets" of how they implemented this "security".

That said, my strong belief is that there are weaknesses (poor cipher implementation e.g. leaking key data on flash), debug backdoors (specific commands that e.g. reset the retry counter, upload arbitrary firmware, or anything else -- those are always there), and other nasty things lingering in the device. We simply don't know about them, thus we are unable to exploit them to get you access to what's on the drive.

So to sum it up: for you/me this is probably not possible as we lack knowledge on the device operation. For an abstract attacker -- yes, this may be possible.

NB. If the drive is yours, how come you don't know the password?.. ;-)

  • I forget it and i have only left 3 chances to enter password .. :) I also think, that password hash does not leave flash drive. Password entering app is sending my plain password to flash and then internal hardware is doing the job .. – Guntis Jul 7 '14 at 9:14
  • While I don't know how this particular device works, I would not easily fall for "enterprise grade security" or "uses AES256". "Enterprise grade", like "military grade" is fad, and AES256 with a user-provided password is a not very educated design. That said, the vast majority of flash drives uses AES encryption, often with a hardcoded key, anyway. Nnot for security, but to mix bits (works favorably towards wear-levelling). Which could mean (again, I don't know this particular device!) that the whole AES stuff is meaningless marketing fad. – Damon Jul 7 '14 at 16:50
  • As for brute-forcing, Google for "top ten password list" and try these. You have an 80-90% chance that you got the correct one by then. – Damon Jul 7 '14 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.