McAfee EEFF / FRP Predictable Salt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Advisory ID: SYSS-2014-008  
Product(s): McAfee Endpoint Encryption for Files and Folders (EEFF)  
McAfee File and Removable Media Protection (FRP)  
Vendor: McAfee, Inc.   
Affected Version(s): EEFF 3.2.x, 4.0.x, 4.1.x, 4.2.x; FRP 4.3.0.x  
Tested Version(s): 4.2.0.164  
Vulnerability Type: Insufficient Entropy (CWE-331)  
Use of a One-Way Hash with a Predictable Salt (CWE-760)  
Risk Level: Medium  
Solution Status: Vendor hotfix available  
Vendor Notification: 2014-08-11  
Solution Date: 2014-10-27  
Public Disclosure: 2014-10-31  
CVE Reference: CVE-2014-8565  
Author of Advisory: Matthias Deeg (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
The software encryption tool McAfee Endpoint Encryption for Removable Media  
(EERM) which is part of the data protection software McAfee Endpoint Encryption   
for Files and Folders (EEFF) uses a static and thus predictable salt for  
generating password hashes using the password-based key derivation function 2  
(PBKDF2).  
  
Due to the use of a predictable, hard-coded salt, it is possible for an attacker  
to precompute password candidates and thus to perform more efficient dictionary  
attacks against the password-based authentication with the use of rainbow tables   
(time-memory trade-off).  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
For generating password hashes used by the password-based authentication of the  
software encryption tool McAfee Endpoint Encryption for Removable Media (EERM),  
the password-based key derivation function 2 (PBKDF2) is used with the following  
parameters:  
  
Hash Function : HMAC-SHA1  
Master Password: Password (UTF-16)  
Salt : hard-coded value from the executable file MfeEERM.exe  
711B7D294C7C0FCD3B9B083E13032F91606A4F05D015CCB0BA961C3240B5484A  
Iteration : 8193  
Output Length : 32 Bytes  
  
  
The use of a static, hard-coded salt poses a low security risk, as this allows  
for more efficient password-guessing attacks making use of a time-memory  
trade-off using special precomputed dictionaries with possible password  
candidates, for example so-called rainbow tables.  
  
Thereby, the performance of password guessing attacks can be improved by several  
orders of magnitude.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The SySS GmbH developed a proof-of-concept software tool for performing  
password guessing attacks against removable media protected with McAfee EEFF/RM  
using rainbow tables.  
  
The following output exemplarily shows a successful password recovery:  
  
$ ./mcafee_eeff_crack_rainbow -r rainbow_table.rt usb_test1.bin  
_____________________________________________________________  
/ _____ _____ _____ \  
/ / ___| / ___/ ___| \  
| \ `--. _ _\ `--.\ `--. |  
| `--. \ | | |`--. \`--. \ |  
| /\__/ / |_| /\__/ /\__/ / |  
\ \____/ \__, \____/\____/ ... uses brute force! /  
\ __/ | /  
/ |___/ __________________________________________/  
/ _________________/  
(__) /_/  
(oo)  
/------\/  
/ |____||  
* || ||  
^^ ^^  
McAfee Endproint Encryption for Files and Folders Password Cracker v1.1 (Rainbow Edition)  
by Matthias Deeg <[email protected]> (c) SySS GmbH 2014  
[*] Loaded rainbow table file: 'rainbow_table.rt'  
[*] Starting bruteforce attack ...  
[*] Attack statistics:  
total attack time : 27.152 s  
tested passwords : 50000000  
avg. performance : 1841484 passwords/s  
[+] Password found: passw0rd  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
Apply the vendor supplied a hotfix for Endpoint Encryption for Files and Folders  
(EEFF) or File and Removable Media Protection (FRP) (see [3] and [4]).  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2014-08-11: Vulnerability reported to vendor  
2014-08-11: Vendor acknowledges e-mail with SySS security advisory  
2014-08-13: Vendor reviewed the security advisory and assessed the described  
finding as a product vulnerability.  
As agreed upon with the vendor, the publication date is rescheduled  
to October 31, 2014.  
2014-10-27: Vendor releases hotfix  
2014-10-31: Public release of security advisory  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product Web Site for McAfee Complete Data Protection  
http://www.mcafee.com/us/products/complete-data-protection.aspx  
[2] PKCS #5: Password-Based Cryptography Specification Version 2.0,  
http://tools.ietf.org/html/rfc2898  
[3] McAfee Security Bulletin - File and Removable Media Protection   
(FRP/EEFF/EERM) update addresses a brute-force attack on weak user passwords  
https://kc.mcafee.com/corporate/index?page=content&id=SB10089  
[4] Security Enhancement for Endpoint Encryption for Files and Folders and File   
and Removable Media Protection  
https://kc.mcafee.com/corporate/index?page=content&id=KB83095  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
Security vulnerability found by Matthias Deeg of the SySS GmbH.  
  
E-Mail: matthias.deeg (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc  
Key fingerprint = 5AE3 96EE A014 FB90 9D81 AF90 8C54 7E88 A34C CED8  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is" and   
without warranty of any kind. Details of this security advisory may be updated   
in order to provide as accurate information as possible. The latest version of   
this security advisory is available on the SySS Web site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
  
iEYEAREKAAYFAlRTOxcACgkQjFR+iKNMztgnxQCeKZRuNSJKB51YROWopOsJw/AM  
JgsAnRlNuO8T7sx9uCKV1dixyRKeBnmX  
=D3fz  
-----END PGP SIGNATURE-----  
`