The other month my friend Travis Altman and I ran across an excellent paper published by SySS regarding cracking encrypted FIPS 140-2 USB Sandisk drives. SySS has cracked a handful of USB drives and have released a good amount of research on multiple different issues and manufacturers
The paper does a great job detailing the product including its strengths and of course it’s giant flaw. My Reverse Engineering skills are fairly weak, so I am always itching to find something that looks like it might be cool to play with and help educate me. So I purchased an also vulnerable Kingston Blackbox Datatraveler. It supports all the normal things you would expect with an encrypted drive – 256 bit AES encryption, strong password enforcement and a reset on the drive if X number of incorrect attempts are made. One of the things I found was odd was that SanDisk, Kingston and Verbatim all appear for the most part to use the same authentication/unlock software. I guess when I think about it multiple vendors using roughly the same software that is FIPS certified isn’t relatively that hard to understand but at first it struck me as odd. Either way, as the SySS paper lays it out, the user password is essentially converted, MD5 hashed and the first half of this hash will serve as a key combined with 32 bytes of data and encrypted using AES 256-ECB. As the paper states the big oops is that the same 32 bytes of data will always be used when setting a new password so the password decryption process must always produce these exact 32 bytes. You can find your 32 bytes of data or alter your 32 bytes of data by doing the following steps.
If you have autorun disabled you will need to run the DTBB_Launcher.exe and set the initial password. To make things easier, one of the first things you will need to do is make a copy of the temporary extract software directory. It should be located under your
C:\Documents and Settings\rahl\Local Settings\Temp\{A12647A7-95A4-947c-90B0-45C455CBDE53}
After you make a copy of the directory you will need to jot down the command line arguments that the ExmpSrv.exe (the authentication software) needs. You can do this however you want => “wmic process list”, Proc Explorer or whatever you should see something like
C:\Documents and Settings\rahl\Local Settings\Temp\{A12647A7-95A4-947c-90B0-45C455CBDE53}\55421912199014dd\V2SubFolder\ExmpSrv.exe” -cd=E -serial=55421912199014dd -firmware=S2
After that, close the Login window and you will notice that the temporary dir has cleaned itself up. Now copy the contents of your copied dir into the left over placeholder and run OllyDbg and give it the arguments you jotted down earlier.
Now Run it and the authentication window should pop up.
Now you need to place a breakpoint at the instruction that performs the decryption of the inputted password and then reads in the 32 byte result from memory. For my version of the software, this was 00453AB8 (the memcpy instruction). I played with earlier revisions of the software and the instruction point was located elsewhere.
Enter the incorrect password and press Login. With the app now paused pay attention to the Memory Stack window showing the location of the Unicode password and open the Memory window and open within the range of that location. Now you need to find the correct spot in memory to adjust. The way I found the exact point in memory I needed to alter was to find my 32 bytes using the correct password “00000000 DC68D3B5 B1A54D8A 84682EFD 520DF24D CDF92B1E 00000000 00000000” and note it’s location. It should be near your final ASCII representation of your MD5 key and a large amount of 0 bytes and for me a call to ntdll.7C94BAFC. Now just inline edit the bytes to equal the proper 32 bytes “00000000 DC68D3B5 B1A54D8A 84682EFD 520DF24D CDF92B1E 00000000 00000000” and you can press Login and boom you should be in.
