“The key derivation function issues have been addressed by using PBKDF2-SHA256 together with a randomly generated salt,” the company explained. The issues, tracked as CVE-2021-36750, have been patched with the release of SanDisk PrivateAccess version 6.3.5, and users have been advised to install the update as soon as possible. “The software also made use of a password hash with insufficient computational effort that would allow an attacker to brute force user passwords leading to unauthorized access to user data.” “SanDisk SecureAccess 3.02 was using a one-way cryptographic hash with a predictable salt making it vulnerable to dictionary attacks by a malicious user,” WD said in an advisory. Researcher Sylvain Pelissier has discovered that SanDisk SecureAccess is affected by a couple of key derivation function issues that can allow an attacker to crack user passwords. SanDisk SecureAccess, recently rebranded SanDisk PrivateAccess, is a piece of software that allows users to encrypt files and folders stored in a protected vault on SanDisk USB flash drives. Western Digital has updated its SanDisk SecureAccess product to address vulnerabilities that can be exploited to gain access to user data through brute force and dictionary attacks.
0 kommentar(er)
