^{CVE-2021-36750:}ENC DataVault before 7.2 and VaultAPI v67 have improper key derivation implementation, allowing attackers to more easily determine user passwords across multiple branded USB drives.

Overview

The vulnerability in ENC DataVault and VaultAPI affects the password-based key derivation function, which is a critical security component that converts user passwords into encryption keys. Due to improper implementation, the key derivation process is weakened, allowing attackers to perform more efficient brute force attacks against user passwords. This vulnerability impacts USB drives from various manufacturers that license ENC Security's encryption technology. When exploited, an attacker could potentially gain unauthorized access to encrypted data stored on these drives. The issue is particularly concerning because users rely on this encryption to protect sensitive data stored on portable USB drives.

Remediation

Users should immediately update their ENC DataVault software to version 7.2 or later and ensure VaultAPI is updated to v67 or later. Specific steps include:

1. Check the current version of your ENC DataVault or branded equivalent software (such as SanDisk SecureAccess).
2. Download and install the latest version from your device manufacturer's official website.
3. For SanDisk users, visit the Western Digital support site to obtain the updated SecureAccess software.
4. After updating, consider changing your encryption passwords as a precautionary measure.
5. If using affected drives in enterprise environments, ensure all instances of the software are updated across the organization.

Organizations should also consider implementing additional security controls such as multi-factor authentication for accessing sensitive data and monitoring for unusual access patterns to encrypted storage.

References

1. ENC Security Update Advisory: https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software
2. Western Digital Security Advisory: https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update
3. ENC Security Product Information: https://www.encsecurity.com/solutions.php
4. Technical Analysis at RC3 2021: https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/
5. CWE-307: Improper Restriction of Excessive Authentication Attempts: https://cwe.mitre.org/data/definitions/307.html