Comments on: Breaking the IronKey (literally) http://www.rec-sec.com/2009/05/27/breaking-the-ironkey/ a non-profit information security web site authored by Moshe Ben Abu (Trancer), focusing on vulnerability research, exploit development (mainly for the Metasploit Framework), web application security, information security and hacking news from around the world. Wed, 21 Jul 2010 17:11:36 +0000 http://www.rec-sec.com hourly 1 By: Anhldbk http://www.rec-sec.com/2009/05/27/breaking-the-ironkey/comment-page-1/#comment-1044 Anhldbk Wed, 01 Jul 2009 06:40:29 +0000 http://www.rec-sec.com/?p=575#comment-1044 You've got a good sense of humor! :D You’ve got a good sense of humor! :D

]]> By: Justin Trent http://www.rec-sec.com/2009/05/27/breaking-the-ironkey/comment-page-1/#comment-981 Justin Trent Thu, 28 May 2009 14:31:57 +0000 http://www.rec-sec.com/?p=575#comment-981 Dave, Glad to see a modified form of the case is coming. Currently, at least according to the device's official FIPS security policy registered at NIST, my users are supposed to use a hair dryer to open it up and check the epoxy themselves on a periodic basis. I've been very worried that someone would yank the devices off desks when they found out users weren't doing this (for obvious reasons). Hopefully this new design will improve things. Dave,

Glad to see a modified form of the case is coming. Currently, at least according to the device’s official FIPS security policy registered at NIST, my users are supposed to use a hair dryer to open it up and check the epoxy themselves on a periodic basis.

I’ve been very worried that someone would yank the devices off desks when they found out users weren’t doing this (for obvious reasons). Hopefully this new design will improve things.

]]> By: Trancer http://www.rec-sec.com/2009/05/27/breaking-the-ironkey/comment-page-1/#comment-979 Trancer Thu, 28 May 2009 07:26:20 +0000 http://www.rec-sec.com/?p=575#comment-979 Dave, I personally think the IronKey is a great product and I'm glad to hear you've got a newer design. This post is a joke (Categories: LOLz) don't take it too seriously :) Dave, I personally think the IronKey is a great product and I’m glad to hear you’ve got a newer design. This post is a joke (Categories: LOLz) don’t take it too seriously :)

]]> By: Dave_IronKey http://www.rec-sec.com/2009/05/27/breaking-the-ironkey/comment-page-1/#comment-978 Dave_IronKey Thu, 28 May 2009 00:14:21 +0000 http://www.rec-sec.com/?p=575#comment-978 Trancer, You've still got to get through the epoxy without damaging the chips, but even then, you've got the crypto and key protection to deal with. The case you show is an older IronKey design. The current cases are a single extruded assembly and there is no label plate to get off. There is a top plate on the current design, which goes around the USB connector, and it has teeth which engage into the case. This whole thing is epoxied. It's a highly robust design that has been submitted for FIPS 140-2 Level 3 validation, which tests the tamper resistance to a high level. Dave @ IronKey Trancer,
You’ve still got to get through the epoxy without damaging the chips, but even then, you’ve got the crypto and key protection to deal with.

The case you show is an older IronKey design. The current cases are a single extruded assembly and there is no label plate to get off. There is a top plate on the current design, which goes around the USB connector, and it has teeth which engage into the case. This whole thing is epoxied. It’s a highly robust design that has been submitted for FIPS 140-2 Level 3 validation, which tests the tamper resistance to a high level.

Dave @ IronKey

]]>