SafeConsoleReady Devices not affected by BadUSB

Security researchers at SR Labs have highlighted a weakness in the USB protocol and published a demonstration of the exploit named BadUSB.

The BadUSB makes use of the fact that cheap USB accessories such as flash drives, web cams and gadgets don’t require verification of firmware updates. Firmware is what runs on the controller (the small computer) inside the devices. Computer operating systems cannot verify that the devices have not been exploited as it is possible to do so in the USB protocol. The threat is that the hijacked or infected USB accessory then can be used the perform malicious tasks on the unsuspecting host computer.

All present and past SafeConsoleReady secure USB drives are unaffected by BadUSB as they all require digital signature verification before allowing firmware upgrades.

BlockMaster’s recommendation is to:

• Only use SafeConsoleReady secure USB drives.
• Use a USB port control such as Device LockOut from BlockMaster to only allow access for verfied secure USB drives. Device LockOut can also be used to block USB device classes to ensure that no device can be connected for instance as a modem or wireless controller. To our knowledge no other port control offers this capabillity to lock down device classes. Device LockOut starts at $9 per protected computer.
• Only use USB accessories from high-quality providers.

Please contact us at [email protected] if you have any questions.

SafeConsole and SafeConsoleReady Devices Not Affected by OpenSSL Heartbleed Vulnerabillity

Recently a security vulnerability in the OpenSSL cryptography library was discovered.

SafeConsole and the SafeConsoleReady Devices are not affected by the Heartbleed security vulnerability.

The SafeConsoleReady device software uses OpenSSL but remains unaffected. The device software is protected from the Heartbleed vulnerability specifically by using certificate pinning. The protection means that an attacker cannot setup a rogue SafeConsole and modify DNS records to trick devices to connect to another server.

Read more about the OpenSSL Heartbleed vulnerability here:

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160

On Gag Orders and Swedish Law

Recently we have all, thanks to Edward Snowden, become aware of the security issues inherent in software from US companies. The Government of the United States of America have legal instruments to force vendors to comply with state orders, e.g. install back doors, and make it illegal for them to reveal this to their customers.

In practice, any government can try to persuade any company to do anything by using bribes or threats, but only in a few countries can the government legally prevent companies and their employees from talking publicly about it. The USA is one such country, and from the leaked information available it seems that they employ it liberally.

Take for example Lavabit, a US company that provided encrypted email services to its customers. It, supposedly like many others, was approached by US authorities and required to install a back door for them. Unlike most other companies, the owner of the company, Ladar Levison, chose to close down Lavabit rather than betray his customers, and he may now face prosecution for this decision. We know about this only because Levison took great personal loss and risk instead of complying. We do not know about all the other companies that simply complied, and they all risk prosecution if they resist or go public. Levison says that he would “strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” [infoworld.com]

In Sweden it works differently. Here the government is also involved in massspying through the FRA and the Swedish police demands automated access to all telecommunication data, but we know this, not through anonymous leaks or heroic whistle-blowing, but by the government passing overt legislation permitting it, or from the people involved raising their voices and speaking out, e.g. by recording private talks with the security police and releasing it to the public. However, when this happens there are no legal instruments the government can use to retaliate. This allows Swedish companies to uphold their customers’ privacy without risk. If approached by government agencies, Swedish companies risk nothing by refusing to comply and/or going public.

Protect your data
If you have data that needs protection, you can rest assured that products from BlockMaster will contain no back doors. It is not in our interest, and our government cannot force us. We offer managed hardware-encrypted USB devices that will protect your data on the go, and ShieldShare that will allow you to securely share files with end-to-end encryption where only the clients hold the encryption keys.

SkypeGate - Skype Security Issues Can Expose Your Communications

This week Ars Technica reported that a hired expert had exposed that Skype communication passes unencrypted to Microsoft servers, even when it is advertised as end-to-end secure communication. Not only is the traffic monitored, Microsoft is actively analyzing the contents.

As Ars reports, and I can concur, there is a widely held belief that Skype for some reason is more secure and offers end-to-end encryption. Ongoing product placements also tell this story. In the high tech TV series Homeland, all conferences are handled over Skype at the CIA. Of course,  they would only be listening to themselves perhaps. But Big Brother is just part of the problem and mostly a problem for shady characters.

That Skype was secure may once have been the case but since Microsoft bought Skype they have effectively wiped away any smart client side security concept that once existed. Today the traffic passes through a network of 10.000 Linux servers hosted by Microsoft.

Microsoft has now taken up to extensively analyze the traffic. Allegedly as a measure to limit spam and phishing on Skype. Ars engineer used fresh web links and monitored the traffic to the site. After having skyped the link, the site got a visitor from a Microsoft server. Of course,  this is shocking. What is even more shocking is that Microsoft has squeezed a paragraph in the privacy policy that not only allows them to monitor all traffic but also to store it indefinitely. This truly is SkypeGate.

Why is SkypeGate a Problem?

Microsoft monitors all Skype communication and stores that data indefinitely. This combined with the perception of security, and you have a serious problem. Predominantly in these three categories:

1. Insider threat is a real, especially at large companies

You may trust Microsoft the brand and the company, they seem friendly enough. But do you trust that they have all the systems in place to control their 100.000 employees, many of them super engineers that could probably bypass any system, even from the outside.

2. Big Brother is listening, and Microsoft can’t tell you

Microsoft must under law hand over any information requested from them under FISAAA (part of the Patriot Act). Casper Bowden, former Chief Privacy Adviser at Microsoft, exposed the details of this practice in January this year saying that it provided blanket authorization and that there was no individual warrant needed. Microsoft is prevented by law, as a US company, to say anything to the affected users.

Most people are OK with the terrorist hunt which is the commonly used scape goat, but there is no way of knowing what use agencies are making of the all-the-information-you-can-eat buffet that Skype is. The latest scandal where the I.R.S seemed to have targeted the minority Tea Party movement raises a lot of questions. Did they skype-tap their way to that information?

3. Hackers for hire ready to get at the Skype servers

If there is a server on the Internet that gets access to peoples and companies’ private communication, there will be people motivated to hack it. It is a common business practice to host video conferences on Skype and often have sensitive discussions during these calls. It is an understatement that there would be people motivated to listen in. People wanting to affect stock prices, competitors on large deals and potential black mailers are but a few examples of criminal behavior that can be enabled by this.

 So what should Skype be used for?

Skype should be considered a semi-private communication tool. It can be used to share a lot of information but should be avoided if stakes are and the consequences are immense. It is frightening to read that the International Crime Tribunal in Haag received testimony through a Skype call. That is the highest risk, but there are many others that should revise their Skype usage.

Looking for secure file sharing?

BlockMaster produces the secure file sharing software ShieldShare that truly offers end-to-end protection using client-side encryption. It isn’t Skype, but it can help with transferring files, with only the intended recipient getting the information.

BlockMaster Extends Control of USB Usage With New Innovation

LONDON - BlockMaster is introducing a worlds-first at Infosecurity London, 23 - 25 April: ZoneRestrictor, the digital fence for secure USB drives. The patent pending technology locks down usage of SafeConsoleReady secure USB drives to specific computers using certificate technology, allowing stronger controls for manual transfers of confidential or sensitive files between secure networks, lab environments and within high-security organizations.

As recent events show, data leaks caused by portable storage continue to be a global problem with 25.000 patient records reported compromised in Ottawa Canada. In the US an employee of a Medicaid contractor was fired after losing 6.000 records when traveling to Washington. And in the UK the Information Commissioners Office continue to enforce and issue fines in accordance with the Data Protection Act with the Nursing and Midwifery Council being fined £150.000 for loss of portable data.

- The high availability of managed secure USB drives can stem the issues with portable data loss completely. Both the growing market and our highly evolved eco-system of SafeConsoleReady devices means a solution is available at an attractive price point to always satisfy budgetary requirements. BlockMaster is leading the development of both attractive prices and the latest cutting-edge technology”, says Daniel Östner CEO of BlockMaster.

ZoneRestrictor is part of the 4.7 release of SafeConsole, the leading management system for secure USB drives which will be made available to customers at the end of April 2013.

Introducing Cloud Backup – safe on-the-go backup for secure USB drives
Also included in the new release is Cloud Backup which introduces full feature automatic secure backup from the secure USB drive onto any cloud, be it private or public. All data is encrypted on the devices prior to being transferred to storage ensuring full compliance and security. Cloud Backup is an industry first and makes available effortless backup to remote and mobile workers that rely on secure USB drives as a working tool.

Meet BlockMaster at stand M95 where they are supporting SafeConsoleReady partner C TWO Products, the manufacturer of SafeXs secure USB drives.