Message-ID: <c40796cd-2954-4f4a-a4a9-7500a136bd31@syss.de>
Date: Mon, 20 Oct 2025 12:06:07 +0200
From: Matthias Deeg via Fulldisclosure <fulldisclosure@...lists.org>
To: <fulldisclosure@...lists.org>
Subject: [FD] [SYSS-2025-015]: Verbatim Keypad Secure (security update
 v1.0.0.6) - Offline brute-force attack

Advisory ID:               SYSS-2025-015
Product:                   Keypad Secure USB 3.2 Gen 1 Drive
Manufacturer:              Verbatim
Affected Version(s):       Part Number #49427 (GDMSLK03A-IN3637 VER1.0)
                            Part Number #49428 (GDMSLK03A-IN3637 VER1.0)
Tested Version(s):         Part Number #49427 (GDMSLK03A-IN3637 VER1.0)
                            Part Number #49428 (GDMSLK03A-IN3637 VER1.0)
Vulnerability Type:        Use of a Cryptographic Primitive with a Risky
                            Implementation (CWE-1240)
Risk Level:                High
Solution Status:           Open
Manufacturer Notification: 2025-02-21
Solution Date:             -
Public Disclosure:         2025-10-20
CVE Reference:             Not assigned yet
Author of Advisory:        Matthias Deeg, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The Verbatim Keypad Secure is a USB drive with AES 256-bit hardware
encryption and a built-in keypad for passcode entry.

The manufacturer describes the product as follows:

"The AES 256-bit Hardware Encryption seamlessly encrypts all data on the
drive in real-time with a built-in keypad for passcode input. The USB
Drive does not store passwords in the computer or system's volatile
memory making it far more secure than software encryption. Also, if it
falls into the wrong hands, the device will lock and require
re-formatting after 20 failed passcode attempts."[1]

Due to an insecure design, the Verbatim Keypad Secure USB drive with
the latest security update[2] is vulnerable to an offline brute-force
attack for finding out the correct passcode and the corresponding data
encryption key, thus gaining unauthorized access to the stored encrypted
data.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

When analyzing the USB drive Verbatim Keypad Secure with the latest
security update[2], Matthias Deeg found out that it is still possible
to perform offline brute-force attacks against this device because of
an insecure design.

Compared to the brute-force attack published in 2022 regarding an older
firmware version (see SySS Security Advisory SYSS-2022-001[3], SySS
Tech Blog article[4]), the Verbatim Keypad Secure with the latest
firmware version uses a different AES encryption mode, AES-XTS instead
of AES-ECB, and the logic for verifying the entered passcode was
changed.

Nevertheless, an attacker can still gain access to all required data
for performing an offline brute-force attack.

The Verbatim Keypad Secure consists of the following four main parts:

1. An SSD in M.2 form factor (SSD controller MARVELL-88NV1120)
2. A USB-to-SATA bridge controller (INIC-3637EN)
3. An SPI flash memory chip (XT25F01D) containing the firmware of the
    INIC-3637EN
4. A keypad controller (unknown chip, marked "SW611 2121")

For encrypting the data stored on the SSD, the hardware AES engine of
the INIC-3637EN is used. The firmware version of the latest security
update uses AES-XTS-256 (XEX-based tweaked-codebook mode with ciphertext
stealing[5]). This mode of operation requires a 512-bit XTS key and
so-called 128-bit tweaks for decrypting different disk sectors.

The cryptographic key for the actual data encryption, the so-called data
encryption key (DEK), is stored in a special sector of the SSD which in
turn is encrypted using a so-called key encryption key (KEK).

This KEK is derived from the entered passcode which can be between five
and twelve digits long, and can be generated by the keypad controller.

When the unlock button is pressed on the Verbatim Keypad Secure, the
first half of the generated AES-XTS key (32 bytes) is transmitted via
SPI communication from the keypad controller to the USB-to-SATA bridge
controller INIC-3637EN for configuring the corresponding hardware AES
engine together with a static second half of the AES-XTS key (32 bytes).

For verifying the entered passcode, the firmware of the INIC-3637EN
reads and decrypts the special sector on the SSD with the provided KEK,
and it checks specific data offsets for known byte patterns.

If this check is successful, the entered passcode and its derived
AES-XTS key are considered correct, enabling the firmware access to
the decrypted DEK, which can then be used to decrypt the actual SSD
user data.

This described design of the Verbatim Keypad Secure allows for offline
brute-force attacks for finding the correct passcode and the
corresponding DEK. An attacker can generate the derived AES-XTS
keys (KEK) for all possible passcodes and then try to correctly decrypt
the data of the specific SSD sector. If the resulting plaintext meets
certain criteria, the correct passcode and data encryption key was
found, which then allows for gaining unauthorized access to the
encrypted user data.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

For demonstrating the offline brute-force attack, Matthias Deeg
developed a brute-forcing software tool which checks the complete
search space of all possible passcodes between five and twelve digits.

The following output exemplarily shows a successful attack:

# ./vks-cracker 2 /dev/sda
  █████   █████ █████   ████  █████████       █████████ 
              █████
░░███   ░░███ ░░███   ███░  ███░░░░░███     ███░░░░░███ 
            ░░███
  ░███    ░███  ░███  ███   ░███    ░░░     ███     ░░░  ████████ 
██████    ██████  ░███ █████  ██████  ████████
  ░███    ░███  ░███████    ░░█████████    ░███         ░░███░░███ 
░░░░░███  ███░░███ ░███░░███  ███░░███░░███░░███
  ░░███   ███   ░███░░███    ░░░░░░░░███   ░███          ░███ ░░░ 
███████ ░███ ░░░  ░██████░  ░███████  ░███ ░░░
   ░░░█████░    ░███ ░░███   ███    ░███   ░░███     ███ ░███ 
███░░███ ░███  ███ ░███░░███ ░███░░░   ░███
     ░░███      █████ ░░████░░█████████     ░░█████████  █████ 
░░████████░░██████  ████ █████░░██████  █████
      ░░░      ░░░░░   ░░░░  ░░░░░░░░░       ░░░░░░░░░  ░░░░░ 
░░░░░░░░  ░░░░░░  ░░░░ ░░░░░  ░░░░░░  ░░░░░
  ... finds out your passcode.

Verbatim Keypad Secure Cracker v0.8 by Matthias Deeg 
<matthias.deeg@...s.de> (c) 2022,2025
- ---
[*] Initialize passcode hash table
[*] Found 16 CPU cores
[*] Reading magic sector from device /dev/sda
[*] Initialize passcode hash table
[*] Start cracking ...
[+] Success!
     The passcode is: 13372025
     The DEK is: 
8da22dcc4e6f42cef367d5d0d7bac017b55be4c84dd055d6f668f68d945788cdb86f54884d186dc7b1f9e9da8c748883aebb3fc2af6afc89bd5306cccdac890c
[*] Have a nice day.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS GmbH is not aware of a solution for the described security issue.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2025-02-21: Vulnerability reported to manufacturer
2025-03-10: Vulnerability reported to manufacturer again
2025-10-20: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Verbatim Keypad Secure
  
https://www.verbatim-europe.co.uk/en/prod/verbatim-keypad-secure-usb-32-gen-1-drive-64gb-49428
[2] Verbatim Keypad Security Update 1.0.0.6
  
https://www.verbatim-europe.com/files/products/keypad-secure-usb-32-gen-1-drive/keypad-products-update-1006-manual.zip
[3] SySS Security Advisory SYSS-2022-001
  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-001.txt
[4] SySS Tech Blog: Hacking Some More Secure USB Flash Drives (Part I)
     https://blog.syss.com/posts/hacking-usb-flash-drives-part-1/
[5] Wikipedia: Disk encryption theory - XTS
     https://en.wikipedia.org/wiki/Disk_encryption_theory#XTS
[6] SySS Security Advisory SYSS-2025-015
  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-015.txt
[7] SySS GmbH, SySS Responsible Disclosure Policy
     https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg of SySS GmbH.

E-Mail: matthias.deeg (at) syss.de
Public Key: 
https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en



Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists