Verbatim Fingerprint SSD AES-ECB Mode Vulnerability (CVE-2022-28382)

Critical Vulnerability Information Vulnerability ID: SYSS-2022-010 Product: Verbatim Executive Fingerprint Secure SSD Manufacturer: Verbatim Affected Version: GDMSFE01-INI3637-C VER1.1 Tested Version: GDMSFE01-INI3637-C VER1.1 Vulnerability Type: Use of Risky Cryptographic Primitives (CWE-1240) Risk Level: Low Remediation Status: Open Manufacturer Notification Date: 2022-02-03 Remediation Date: Not provided Public Disclosure Date: 2022-06-08 CVE Reference: CVE-2022-28382 Advisory Author: Matthias Deeg (SySS GmbH) Vulnerability Overview The Verbatim Executive Fingerprint Secure SSD is a USB drive equipped with AES 256-bit hardware encryption and an integrated fingerprint sensor, designed to unlock the device using a pre-registered fingerprint. The manufacturer claims the drive complies with GDPR requirements and provides seamless real-time encryption. Vulnerability Details Analysis revealed that the firmware employs an insecure AES mode (ECB mode), which may allow attackers to extract information from encrypted data, such as by observing repeating byte patterns. ECB mode lacks diffusion and is ineffective at protecting data with specific patterns. Proof of Concept (PoC) The same 16-byte plaintext pattern was repeatedly written to an unlocked SSD. When read from another SSD, the identical 16-byte ciphertext pattern remained visible, demonstrating data predictability and associated risks. Remediation SySS GmbH states that no remediation has been found yet. Disclosure Timeline 2022-02-03: Vulnerability reported to the manufacturer 2022-02-11: Vulnerability reported again 2022-03-07: Vulnerability reported again 2022-06-08: Security advisory publicly released References Product Official Website Wikipedia on ECB Mode) SySS Security Advisory SySS Responsible Disclosure Policy

Goal Reached Thanks to every supporter — we hit 100%!

Verbatim Fingerprint SSD AES-ECB Mode Vulnerability (CVE-2022-28382)

More from this source