Vulnerabilities

WD Updates SanDisk SecureAccess to Prevent Dictionary, Brute Force Attacks

Western Digital has updated its SanDisk SecureAccess product to address vulnerabilities that can be exploited to gain access to user data through brute force and dictionary attacks.

Eduard Kovacs

December 10, 2021

Western Digital has updated its SanDisk SecureAccess product to address vulnerabilities that can be exploited to gain access to user data through brute force and dictionary attacks.

SanDisk SecureAccess, recently rebranded SanDisk PrivateAccess, is a piece of software that allows users to encrypt files and folders stored in a protected vault on SanDisk USB flash drives.

Researcher Sylvain Pelissier has discovered that SanDisk SecureAccess is affected by a couple of key derivation function issues that can allow an attacker to crack user passwords.

“SanDisk SecureAccess 3.02 was using a one-way cryptographic hash with a predictable salt making it vulnerable to dictionary attacks by a malicious user,” WD said in an advisory. “The software also made use of a password hash with insufficient computational effort that would allow an attacker to brute force user passwords leading to unauthorized access to user data.”

The issues, tracked as CVE-2021-36750, have been patched with the release of SanDisk PrivateAccess version 6.3.5, and users have been advised to install the update as soon as possible.

“The key derivation function issues have been addressed by using PBKDF2-SHA256 together with a randomly generated salt,” the company explained.

Pelissier has posted a tweet urging users to update the WD software, but the researcher has yet to share any details about the flaws.

Earlier this year, WD warned customers that attacks targeting some of its older network-attached storage (NAS) devices involved the exploitation of a zero-day vulnerability. Threat actors had targeted My Book Live and My Book Live Duo devices and reset them to factory settings.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar