Utimaco Safeguard Easy vulnerability

Utimaco Safeguard Easy vulnerability
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Utimaco Safeguard Easy vulnerability boomboom999 10-12-2006
Posted by on October 12, 2006, 10:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello guys,

At this moment our company looks for a software to encrypt the whole
disk drives on laptops.


I see that many companies and government institutions use Utimaco
Safeguard Easy.


First, we looked at this software as well.


However, it seems that the tool that is supposed to make laptops more
secure has some serious problems related to password and key
distribution.


For deployement in big companies, Utimaco recommend to implement
centralized management.
The management is done via CFG-files that are pushed via SMS, Active
Directory or otherwise.


These CFG files contain encryption keys for hard disks and floppy, as
well as user passwords and backup passwords for recovery.


The content of the file is supposedly "encrypted" as Utimaco's manual
says. However, it seems that the encryption keys are hardcoded directly

in the EXE file. So, they are easily recoverable and all these CFG
files can be easily compromised.


I am just wondering whether it has been discussed here and someone else

has seen this problem before?


I know that many government and bank institutions use this product, am
I the only person to see this security whole?


Thank you


boom


Posted by Volker Birk on October 13, 2006, 1:29 am
If you were  Registered and logged in, you could reply and use other advanced thread options
boomboom999@yahoo.com wrote:
> At this moment our company looks for a software to encrypt the whole
> disk drives on laptops.

Does truecrypt hold, or (in other words), what do you want to be safe
from what? ;-)

Yours,
VB.
--
Viel schlimmer als die Implementation von PHP ist jedoch das Design.

Rudolf Polzer in de.comp.security.misc

Similar ThreadsPosted
Detecting Intruders on Your System Is Fun and Easy December 11, 2007, 8:36 am
MAC-CBC vulnerability May 14, 2006, 10:07 am
Security Vulnerability in ... May 17, 2004, 2:27 pm
WMF vulnerability specifics January 18, 2006, 5:55 pm
Security Vulnerability in ... August 14, 2006, 5:56 am
Security Vulnerability in ... January 26, 2007, 6:40 am
Security Vulnerability in ... August 31, 2007, 10:45 am
Security Vulnerability in ... September 20, 2007, 9:36 am
Intel DEP vulnerability and windows.......??? July 11, 2005, 3:58 pm
Security Vulnerability Report September 11, 2006, 2:01 pm

The site map in XML format XML site map

Contact Us | Privacy Policy