SafeConsole and SafeConsoleReady Devices Not Affected by OpenSSL Heartbleed Vulnerabillity

Recently a security vulnerability in the OpenSSL cryptography library was discovered.

SafeConsole and the SafeConsoleReady Devices are not affected by the Heartbleed security vulnerability.

The SafeConsoleReady device software uses OpenSSL but remains unaffected. The device software is protected from the Heartbleed vulnerability specifically by using certificate pinning. The protection means that an attacker cannot setup a rogue SafeConsole and modify DNS records to trick devices to connect to another server.

Read more about the OpenSSL Heartbleed vulnerability here:

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160

On Gag Orders and Swedish Law

Recently we have all, thanks to Edward Snowden, become aware of the security issues inherent in software from US companies. The Government of the United States of America have legal instruments to force vendors to comply with state orders, e.g. install back doors, and make it illegal for them to reveal this to their customers.

In practice, any government can try to persuade any company to do anything by using bribes or threats, but only in a few countries can the government legally prevent companies and their employees from talking publicly about it. The USA is one such country, and from the leaked information available it seems that they employ it liberally.

Take for example Lavabit, a US company that provided encrypted email services to its customers. It, supposedly like many others, was approached by US authorities and required to install a back door for them. Unlike most other companies, the owner of the company, Ladar Levison, chose to close down Lavabit rather than betray his customers, and he may now face prosecution for this decision. We know about this only because Levison took great personal loss and risk instead of complying. We do not know about all the other companies that simply complied, and they all risk prosecution if they resist or go public. Levison says that he would “strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” [infoworld.com]

In Sweden it works differently. Here the government is also involved in massspying through the FRA and the Swedish police demands automated access to all telecommunication data, but we know this, not through anonymous leaks or heroic whistle-blowing, but by the government passing overt legislation permitting it, or from the people involved raising their voices and speaking out, e.g. by recording private talks with the security police and releasing it to the public. However, when this happens there are no legal instruments the government can use to retaliate. This allows Swedish companies to uphold their customers’ privacy without risk. If approached by government agencies, Swedish companies risk nothing by refusing to comply and/or going public.

Protect your data
If you have data that needs protection, you can rest assured that products from BlockMaster will contain no back doors. It is not in our interest, and our government cannot force us. We offer managed hardware-encrypted USB devices that will protect your data on the go, and ShieldShare that will allow you to securely share files with end-to-end encryption where only the clients hold the encryption keys.

Lost USB Drive Involved In Death – ICO Fines Powerless

Reports link the loss of an unsecure USB drive which contained details about over 1000 police formants to the violent death of one of the suspects in the alleged theft.

The information went missing just weeks ago from the Greater Manchester Police after an officer brought the data home for work on an unsecure USB flash drive. This was in contradiction to a policy at the police force that mandated that all portable data be protected with encryption and passwords. This policy came in place after a similar data loss incident just ten months prior. This new incident involved the loss of the sensitive data that tracked the details of 1.075 police informants. The first incident prompted the ICO in the UK to issue a £120.000 fine which we reported about back then. The first loss prompted us to advocate a general ban of unsecure USB drives for government use.

The Daily Mail has published an article¹ which provide more details on the current case.
One of the main targets of the police operation that involved over 100 officers seemed to have been to recapture the unsecure USB drive that contained the data. It is unclear what the purpose of reclaiming the unsecure USB drive was as the data could be copied off the device to a second source at any point. Regular USB drives contain no record of who has copied data, it does not even trace if such an event ever took place.

There are many aspects to this tragic story, and many other are better suited to tell about it in all its facets. The IT security perspective is not the most important one, but it may be the one that holds the answers on how prevent events like these. It is tragic for all involved: victims, police officers and tech staff that something like this should take place. Especially when there are solutions readily available.

What also comes into question is the effectiveness of the ICO fines. The police force had already been fined £120.000 less than a year ago and still there seemed to be no signed of improvement. The only visible action is toothless paper tiger policy that says that data needed to be encrypted and password protected. The ICO forces there to be signs of improvement to avoid further fines. The policy was all that was needed to get of the radar of the ICO.

One thought might be to assign part of the fine as a mandatory purchase to avoid the problem to reoccur. The sensible thing to do is to ban the use of unsecure USB drives and unencrypted portable data for government use. There is no practical use for unsecure storage that cannot be replaced by encrypted storage. The costs involved in making the switch to a secure solution is not great.

ShieldShare Secure Cloud File Sharing Launched by BlockMaster

Offering unmatched cloud storage security ShieldShare from BlockMaster enables convenient file-sharing and sync between desktops and high security devices.
Read more →

BlockMaster Unveils Revolutionary New File Sharing Technology at RSA San Francisco

BlockMaster, a leading provider of managed secure USB flash drive solutions, is unveiling a patented new technology called PIPE that will forever change high-security file-sharing — and will result in a significant savings of time and money. Read more →