-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2025-016 Product: Store 'n' Go Secure Portable SSD Manufacturer: Verbatim Affected Version(s): Part Number #53402 (GDMSLK02 C-INIC3637-V1.1) Tested Version(s): Part Number #53402 (GDMSLK02 C-INIC3637-V1.1) Vulnerability Type: Use of a Cryptographic Primitive with a Risky Implementation (CWE-1240) Risk Level: High Solution Status: Open Manufacturer Notification: 2025-02-21 Solution Date: - Public Disclosure: 2025-10-20 CVE Reference: Not assigned yet Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: The Verbatim Store 'n' Go Secure Portable SSD is a portable USB drive with AES 256-bit hardware encryption and a built-in keypad for passcode entry. The manufacturer describes the product as follows: "The AES 256-bit Hardware Encryption seamlessly encrypts all data on the drive in real-time with a built-in keypad for password input. The hard drive does not store passwords in the computer or system's volatile memory making it far more secure than software encryption. Also, if it falls into the wrong hands, the hard drive will lock and require re-formatting after 20 failed password attempts."[1] Due to an insecure design, the Verbatim Store 'n' Go Secure Portable SSD with the latest security update[2] is vulnerable to an offline brute-force attack for finding out the correct passcode and the corresponding data encryption key, thus gaining unauthorized access to the stored encrypted data. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: When analyzing the external storage device Verbatim Store 'n' Go Secure Portable SSD with the latest security update[2], Matthias Deeg found out that it is still possible to perform offline brute-force attacks against this device because of an insecure design. Compared to the brute-force attack published in 2022 regarding an older firmware version (see SySS Security Advisory SYSS-2022-043[3]), the Verbatim Store 'n' Go Secure Portable SSD with the latest firmware version uses a different AES encryption mode, AES-XTS instead of AES-ECB, and the logic for verifying the entered passcode was changed. Nevertheless, an attacker can still gain access to all required data for performing an offline brute-force attack. The device consists of the following four main parts: 1. An SSD with M.2 form factor 2. A USB-to-SATA bridge controller (INIC-3637EN) 3. An SPI flash memory chip (XT25F01D) containing the firmware of the INIC-3637EN 4. A keypad controller (unknown chip, marked "SW611 2201") For encrypting the data stored on the SSD, the hardware AES engine of the INIC-3637EN is used. The firmware version of the latest security update uses AES-XTS-256 (XEX-based tweaked-codebook mode with ciphertext stealing[4]). This mode of operation requires a 512-bit XTS key and so-called 128-bit tweaks for decrypting different disk sectors. The cryptographic key for the actual data encryption, the so-called data encryption key (DEK), is stored in a special sector of the SSD which in turn is encrypted using a so-called key encryption key (KEK). This KEK is derived from the entered passcode which can be between five and twelve digits long, and can be generated by the keypad controller. When the unlock button is pressed on the Verbatim Store 'n' Go Secure Portable SSD, the first half of the generated AES-XTS key (32 bytes) is transmitted via SPI communication from the keypad controller to the USB-to-SATA bridge controller INIC-3637EN for configuring the corresponding hardware AES engine together with a static second half of the AES-XTS key (32 bytes). For verifying the entered passcode, the firmware of the INIC-3637EN reads and decrypts the special sector on the SSD with the provided KEK, and it checks specific data offsets for known byte patterns. If this check is successful, the entered passcode and its derived AES-XTS key are considered correct, enabling the firmware access to the decrypted DEK, which can then be used to decrypt the actual user data. This described design of the Verbatim Store 'n' Go Secure Portable SSD allows for offline brute-force attacks for finding the correct passcode and the corresponding DEK. An attacker can generate the derived AES-XTS keys (KEK) for all possible passcodes and then try to correctly decrypt the data of the specific SSD sector. If the resulting plaintext meets certain criteria, the correct passcode and data encryption key was found, which then allows for gaining unauthorized access to the encrypted user data. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): For demonstrating the offline brute-force attack, Matthias Deeg developed a brute-forcing software tool which checks the complete search space of all possible passcodes between five and twelve digits. The following output exemplarily shows a successful attack: # ./vks-cracker 8 /dev/sda █████ █████ █████ ████ █████████ █████████ █████ ░░███ ░░███ ░░███ ███░ ███░░░░░███ ███░░░░░███ ░░███ ░███ ░███ ░███ ███ ░███ ░░░ ███ ░░░ ████████ ██████ ██████ ░███ █████ ██████ ████████ ░███ ░███ ░███████ ░░█████████ ░███ ░░███░░███ ░░░░░███ ███░░███ ░███░░███ ███░░███░░███░░███ ░░███ ███ ░███░░███ ░░░░░░░░███ ░███ ░███ ░░░ ███████ ░███ ░░░ ░██████░ ░███████ ░███ ░░░ ░░░█████░ ░███ ░░███ ███ ░███ ░░███ ███ ░███ ███░░███ ░███ ███ ░███░░███ ░███░░░ ░███ ░░███ █████ ░░████░░█████████ ░░█████████ █████ ░░████████░░██████ ████ █████░░██████ █████ ░░░ ░░░░░ ░░░░ ░░░░░░░░░ ░░░░░░░░░ ░░░░░ ░░░░░░░░ ░░░░░░ ░░░░ ░░░░░ ░░░░░░ ░░░░░ ... finds out your passcode. Verbatim Keypad Secure Cracker v0.8 by Matthias Deeg (c) 2022,2025 - - --- [*] Initialize passcode hash table [*] Found 16 CPU cores [*] Reading magic sector from device /dev/sda [*] Initialize passcode hash table [*] Start cracking ... [+] Success! The passcode is: 13372025 The DEK is: a715e0b4523eb8fd3651b291bd7bb976a6ebeff3c5a0ebacdf3cf41a8ef1bb82f244b6809e86b5cecab0bb109b2c9119da78f8d49725ae479e479f6c3320b139 [*] Have a nice day. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a solution for the described security issue. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2025-02-21: Vulnerability reported to manufacturer 2025-03-10: Vulnerability reported to manufacturer again 2025-10-20: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Verbatim Store 'n' Go Secure Portable SSD https://www.verbatim-europe.com/en/external-ssd/products/store-n-go-portable-ssd-with-keypad-access-256gb-53402 [2] Verbatim Store 'n' Go Portable SSD Security Update 1.0.0.6 https://www.verbatim-europe.com/files/products/store-n-go-secure-portable-ssd-with-keypad-access/keypad-products-update-1006-manual.zip [3] SySS Security Advisory SYSS-2022-043 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-043.txt [4] Wikipedia: Disk encryption theory - XTS https://en.wikipedia.org/wiki/Disk_encryption_theory#XTS [5] SySS Security Advisory SYSS-2025-016 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-016.txt [6] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAmj10JwACgkQ2aS/ajSt TavCug//aoT9qJSbQqzJ5eRyV5/a9n7fAAW//x3fLms9cetFXHfKKM14GiW0smQZ 51Rg6iemkdr6bojwzS7/jGODr1BEnn7d4FC/nd3rGdzWaxPlpBf88lJKp8/2huaz xFaDdjRoOTLTyU3kK+5VRlJ51HK8aO/58LoEaHbKf6BgGhINOtNWEuhZJgGtmEY6 tglMogeXL92SlSPMaA5Db88AljaBP28bMELI+83pmBF444BTF9Sxeu0JxDxC84YY NC01KxxcYK0xtwlarBUk5HUA+bdNXJlexZRQPODVVr/NXMw1hcwRZDiA+1btCCZD 6UenknMPR5yyIhqUCZ8WAx/mj6uk7J+X3R+JENIJIienhXA+0mDanBLTw8GzfEEC 3+AWfDMilzK5dtKtiiKUrVwxqKmPiFXkDvDLGxOCASGKW4yWjwvazKkLcl681VTs XpMG1YNX7EyQPcILFGV5n1EcPeOqyz78gB8uWBIychgbwD3n0u/zkkdE8/OSYwmT mG6OQrGeDzWWs29j2LvddmeSdWpPZaH5eM6sELSOY0puRFvR9wqFtKC46E4ASwBO 0zL4oxst4shTnykvCZgHiVGwqnfCs4lcqhn0eBg7r515JMrssG2KkDvGPxvZoLDi dUwSeVlprxlt3Txy6P0TcCZFDsp9gLD8HvnvNr7N+3kB3cLE+Xw= =kap/ -----END PGP SIGNATURE-----