Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

WD Updates SanDisk SecureAccess to Prevent Dictionary, Brute Force Attacks

Western Digital has updated its SanDisk SecureAccess product to address vulnerabilities that can be exploited to gain access to user data through brute force and dictionary attacks.

Western Digital has updated its SanDisk SecureAccess product to address vulnerabilities that can be exploited to gain access to user data through brute force and dictionary attacks.

SanDisk SecureAccess, recently rebranded SanDisk PrivateAccess, is a piece of software that allows users to encrypt files and folders stored in a protected vault on SanDisk USB flash drives.

Researcher Sylvain Pelissier has discovered that SanDisk SecureAccess is affected by a couple of key derivation function issues that can allow an attacker to crack user passwords.

“SanDisk SecureAccess 3.02 was using a one-way cryptographic hash with a predictable salt making it vulnerable to dictionary attacks by a malicious user,” WD said in an advisory. “The software also made use of a password hash with insufficient computational effort that would allow an attacker to brute force user passwords leading to unauthorized access to user data.”

The issues, tracked as CVE-2021-36750, have been patched with the release of SanDisk PrivateAccess version 6.3.5, and users have been advised to install the update as soon as possible.

“The key derivation function issues have been addressed by using PBKDF2-SHA256 together with a randomly generated salt,” the company explained.

Pelissier has posted a tweet urging users to update the WD software, but the researcher has yet to share any details about the flaws.

Earlier this year, WD warned customers that attacks targeting some of its older network-attached storage (NAS) devices involved the exploitation of a zero-day vulnerability. Threat actors had targeted My Book Live and My Book Live Duo devices and reset them to factory settings.

Advertisement. Scroll to continue reading.

Related: Old Vulnerability Exploited to Hack, Wipe WD Storage Devices

Related: Researchers Disclose Unpatched WD TV Media Player Flaws

Related: NETGEAR Router, WD NAS Device Hacked on First Day of Pwn2Own Tokyo 2020

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Matthew Cowell has assumed the role of VP of Strategic Alliances at Nozomi Networks. He previously served in the same role at Dragos.

Bret Arsenault is retiring from his full-time role after 35 years at Microsoft.

Social engineering defense platform Doppel has appointed Bobby Ford as Chief Strategy and Experience Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.