Home / exploits McAfee EEFF / FRP Predictable Salt
Posted on 01 November 2014
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Advisory ID: SYSS-2014-008 Product(s): McAfee Endpoint Encryption for Files and Folders (EEFF) McAfee File and Removable Media Protection (FRP) Vendor: McAfee, Inc. Affected Version(s): EEFF 3.2.x, 4.0.x, 4.1.x, 4.2.x; FRP 4.3.0.x Tested Version(s): 4.2.0.164 Vulnerability Type: Insufficient Entropy (CWE-331) Use of a One-Way Hash with a Predictable Salt (CWE-760) Risk Level: Medium Solution Status: Vendor hotfix available Vendor Notification: 2014-08-11 Solution Date: 2014-10-27 Public Disclosure: 2014-10-31 CVE Reference: CVE-2014-8565 Author of Advisory: Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: The software encryption tool McAfee Endpoint Encryption for Removable Media (EERM) which is part of the data protection software McAfee Endpoint Encryption for Files and Folders (EEFF) uses a static and thus predictable salt for generating password hashes using the password-based key derivation function 2 (PBKDF2). Due to the use of a predictable, hard-coded salt, it is possible for an attacker to precompute password candidates and thus to perform more efficient dictionary attacks against the password-based authentication with the use of rainbow tables (time-memory trade-off). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: For generating password hashes used by the password-based authentication of the software encryption tool McAfee Endpoint Encryption for Removable Media (EERM), the password-based key derivation function 2 (PBKDF2) is used with the following parameters: Hash Function : HMAC-SHA1 Master Password: Password (UTF-16) Salt : hard-coded value from the executable file MfeEERM.exe 711B7D294C7C0FCD3B9B083E13032F91606A4F05D015CCB0BA961C3240B5484A Iteration : 8193 Output Length : 32 Bytes The use of a static, hard-coded salt poses a low security risk, as this allows for more efficient password-guessing attacks making use of a time-memory trade-off using special precomputed dictionaries with possible password candidates, for example so-called rainbow tables. Thereby, the performance of password guessing attacks can be improved by several orders of magnitude. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The SySS GmbH developed a proof-of-concept software tool for performing password guessing attacks against removable media protected with McAfee EEFF/RM using rainbow tables. The following output exemplarily shows a successful password recovery: $ ./mcafee_eeff_crack_rainbow -r rainbow_table.rt usb_test1.bin _____________________________________________________________ / _____ _____ _____ / / ___| / ___/ ___| | `--. _ _ `--. `--. | | `--. | | |`--. `--. | | /\__/ / |_| /\__/ /\__/ / | \____/ \__, \____/\____/ ... uses brute force! / __/ | / / |___/ __________________________________________/ / _________________/ (__) /_/ (oo) /------/ / |____|| * || || ^^ ^^ McAfee Endproint Encryption for Files and Folders Password Cracker v1.1 (Rainbow Edition) by Matthias Deeg <matthias.deeg@syss.de> (c) SySS GmbH 2014 [*] Loaded rainbow table file: 'rainbow_table.rt' [*] Starting bruteforce attack ... [*] Attack statistics: total attack time : 27.152 s tested passwords : 50000000 avg. performance : 1841484 passwords/s [+] Password found: passw0rd ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Apply the vendor supplied a hotfix for Endpoint Encryption for Files and Folders (EEFF) or File and Removable Media Protection (FRP) (see [3] and [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2014-08-11: Vulnerability reported to vendor 2014-08-11: Vendor acknowledges e-mail with SySS security advisory 2014-08-13: Vendor reviewed the security advisory and assessed the described finding as a product vulnerability. As agreed upon with the vendor, the publication date is rescheduled to October 31, 2014. 2014-10-27: Vendor releases hotfix 2014-10-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product Web Site for McAfee Complete Data Protection http://www.mcafee.com/us/products/complete-data-protection.aspx [2] PKCS #5: Password-Based Cryptography Specification Version 2.0, http://tools.ietf.org/html/rfc2898 [3] McAfee Security Bulletin - File and Removable Media Protection (FRP/EEFF/EERM) update addresses a brute-force attack on weak user passwords https://kc.mcafee.com/corporate/index?page=content&id=SB10089 [4] Security Enhancement for Endpoint Encryption for Files and Folders and File and Removable Media Protection https://kc.mcafee.com/corporate/index?page=content&id=KB83095 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: Security vulnerability found by Matthias Deeg of the SySS GmbH. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc Key fingerprint = 5AE3 96EE A014 FB90 9D81 AF90 8C54 7E88 A34C CED8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iEYEAREKAAYFAlRTOxcACgkQjFR+iKNMztgnxQCeKZRuNSJKB51YROWopOsJw/AM JgsAnRlNuO8T7sx9uCKV1dixyRKeBnmX =D3fz -----END PGP SIGNATURE-----
