0

I have Kingston DataTraveler vault privacy USB flash drive (DTVP/2GB). Here is tech specs. Flash drive has a 256-bit AES hardware based encryption. My flash has password protected and I do not know password. Is it possible, to crack password in some way?

The question is - is it possible to get encrypted password hash from flash drive and then brute force it on another machine ?

Improve this question
4
  • Without specifing a timeframe, yes, I believe so. But you would probably be long gone by the time it would be cracked.
    – Darsstar
    Jul 7, 2014 at 8:53
  • Couple of questions to help demonstrate why this isn't a useful approach: imagine you could get the hash- do you know how long it takes to brute force passwords? Do you know how long the password is? How will you know when you have the right password? ...
    – Rory Alsop ♦
    Jul 7, 2014 at 8:55
  • I searched and found, that brute forcing can take very long time. And i thing that password can be salted. minimal length of password is 6 characters. i think that it can be between 6 and 12 characters.
    – Guntis
    Jul 7, 2014 at 9:03
  • For information, oldest version of the same product had a big authentication breach: zdnet.com/article/… Because of this old my company keys have been replaced by these DTVP/2GB
    – Yves Martin
    May 16, 2015 at 12:48

1 Answer 1

Reset to default
1

My flash has password protected and I do not know password. Is it possible, to crack password in some way?

Short answer: No, since neither me nor you know how the device operates inside.

Long answer: This requires a lot of knowledge on how this specific device implements the claimed Enterprise-Grade Security. My best bet would be, most of users here don't know that, and Kingston won't divulge the "commercial secrets" of how they implemented this "security".

That said, my strong belief is that there are weaknesses (poor cipher implementation e.g. leaking key data on flash), debug backdoors (specific commands that e.g. reset the retry counter, upload arbitrary firmware, or anything else -- those are always there), and other nasty things lingering in the device. We simply don't know about them, thus we are unable to exploit them to get you access to what's on the drive.

So to sum it up: for you/me this is probably not possible as we lack knowledge on the device operation. For an abstract attacker -- yes, this may be possible.

NB. If the drive is yours, how come you don't know the password?.. ;-)

Improve this answer
3
  • I forget it and i have only left 3 chances to enter password .. :) I also think, that password hash does not leave flash drive. Password entering app is sending my plain password to flash and then internal hardware is doing the job ..
    – Guntis
    Jul 7, 2014 at 9:14
  • While I don't know how this particular device works, I would not easily fall for "enterprise grade security" or "uses AES256". "Enterprise grade", like "military grade" is fad, and AES256 with a user-provided password is a not very educated design. That said, the vast majority of flash drives uses AES encryption, often with a hardcoded key, anyway. Nnot for security, but to mix bits (works favorably towards wear-levelling). Which could mean (again, I don't know this particular device!) that the whole AES stuff is meaningless marketing fad.
    – Damon
    Jul 7, 2014 at 16:50
  • As for brute-forcing, Google for "top ten password list" and try these. You have an 80-90% chance that you got the correct one by then.
    – Damon
    Jul 7, 2014 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .