Western Digital has updated its SanDisk SecureAccess product to address vulnerabilities that can be exploited to gain access to user data through brute force and dictionary attacks.
SanDisk SecureAccess, recently rebranded SanDisk PrivateAccess, is a piece of software that allows users to encrypt files and folders stored in a protected vault on SanDisk USB flash drives.
Researcher Sylvain Pelissier has discovered that SanDisk SecureAccess is affected by a couple of key derivation function issues that can allow an attacker to crack user passwords.
“SanDisk SecureAccess 3.02 was using a one-way cryptographic hash with a predictable salt making it vulnerable to dictionary attacks by a malicious user,” WD said in an advisory. “The software also made use of a password hash with insufficient computational effort that would allow an attacker to brute force user passwords leading to unauthorized access to user data.”
The issues, tracked as CVE-2021-36750, have been patched with the release of SanDisk PrivateAccess version 6.3.5, and users have been advised to install the update as soon as possible.
“The key derivation function issues have been addressed by using PBKDF2-SHA256 together with a randomly generated salt,” the company explained.
Pelissier has posted a tweet urging users to update the WD software, but the researcher has yet to share any details about the flaws.
Earlier this year, WD warned customers that attacks targeting some of its older network-attached storage (NAS) devices involved the exploitation of a zero-day vulnerability. Threat actors had targeted My Book Live and My Book Live Duo devices and reset them to factory settings.
Related: Old Vulnerability Exploited to Hack, Wipe WD Storage Devices
Related: Researchers Disclose Unpatched WD TV Media Player Flaws
Related: NETGEAR Router, WD NAS Device Hacked on First Day of Pwn2Own Tokyo 2020