-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Advisory ID: SYSS-2014-008
Product(s): McAfee Endpoint Encryption for Files and Folders (EEFF)
            McAfee File and Removable Media Protection (FRP)
Vendor: McAfee, Inc. 
Affected Version(s): EEFF 3.2.x, 4.0.x, 4.1.x, 4.2.x; FRP 4.3.0.x
Tested Version(s): 4.2.0.164
Vulnerability Type: Insufficient Entropy (CWE-331)
                    Use of a One-Way Hash with a Predictable Salt (CWE-760)
Risk Level: Medium
Solution Status: Vendor hotfix available
Vendor Notification: 2014-08-11
Solution Date: 2014-10-27
Public Disclosure: 2014-10-31
CVE Reference: CVE-2014-8565
Author of Advisory: Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The software encryption tool McAfee Endpoint Encryption for Removable Media
(EERM) which is part of the data protection software McAfee Endpoint Encryption 
for Files and Folders (EEFF) uses a static and thus predictable salt for
generating password hashes using the password-based key derivation function 2
(PBKDF2).

Due to the use of a predictable, hard-coded salt, it is possible for an attacker
to precompute password candidates and thus to perform more efficient dictionary
attacks against the password-based authentication with the use of rainbow tables 
(time-memory trade-off).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

For generating password hashes used by the password-based authentication of the
software encryption tool McAfee Endpoint Encryption for Removable Media (EERM),
the password-based key derivation function 2 (PBKDF2) is used with the following
parameters:

Hash Function  : HMAC-SHA1
Master Password: Password (UTF-16)
Salt           : hard-coded value from the executable file MfeEERM.exe
                 711B7D294C7C0FCD3B9B083E13032F91606A4F05D015CCB0BA961C3240B5484A
Iteration      : 8193
Output Length  : 32 Bytes


The use of a static, hard-coded salt poses a low security risk, as this allows
for more efficient password-guessing attacks making use of a time-memory
trade-off using special precomputed dictionaries with possible password
candidates, for example so-called rainbow tables.

Thereby, the performance of password guessing attacks can be improved by several
orders of magnitude.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The SySS GmbH developed a proof-of-concept software tool for performing
password guessing attacks against removable media protected with McAfee EEFF/RM
using rainbow tables.

The following output exemplarily shows a successful password recovery:

$ ./mcafee_eeff_crack_rainbow -r rainbow_table.rt usb_test1.bin
                _____________________________________________________________
               /    _____       _____ _____                                  \
              /    /  ___|     /  ___/  ___|                                  \
             |     \ `--. _   _\ `--.\ `--.                                    |
             |      `--. \ | | |`--. \`--. \                                   |
             |     /\__/ / |_| /\__/ /\__/ /                                   |
              \    \____/ \__, \____/\____/   ... uses brute force!           /
               \          __/ |                                              /
               /         |___/    __________________________________________/
              / _________________/
        (__) /_/
        (oo)
  /------\/
 / |____||
*  ||   ||
   ^^   ^^
McAfee Endproint Encryption for Files and Folders Password Cracker v1.1 (Rainbow Edition)
by Matthias Deeg <matthias.deeg@syss.de> (c) SySS GmbH 2014
[*] Loaded rainbow table file: 'rainbow_table.rt'
[*] Starting bruteforce attack ...
[*] Attack statistics:
        total attack time : 27.152 s
        tested passwords  : 50000000
        avg. performance  : 1841484 passwords/s
[+] Password found: passw0rd

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Apply the vendor supplied a hotfix for Endpoint Encryption for Files and Folders
(EEFF) or File and Removable Media Protection (FRP) (see [3] and [4]).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2014-08-11: Vulnerability reported to vendor
2014-08-11: Vendor acknowledges e-mail with SySS security advisory
2014-08-13: Vendor reviewed the security advisory and assessed the described
            finding as a product vulnerability.
            As agreed upon with the vendor, the publication date is rescheduled
            to October 31, 2014.
2014-10-27: Vendor releases hotfix
2014-10-31: Public release of security advisory
            
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product Web Site for McAfee Complete Data Protection
    http://www.mcafee.com/us/products/complete-data-protection.aspx
[2] PKCS #5: Password-Based Cryptography Specification Version 2.0,
    http://tools.ietf.org/html/rfc2898
[3] McAfee Security Bulletin - File and Removable Media Protection 
    (FRP/EEFF/EERM) update addresses a brute-force attack on weak user passwords
    https://kc.mcafee.com/corporate/index?page=content&id=SB10089
[4] Security Enhancement for Endpoint Encryption for Files and Folders and File 
    and Removable Media Protection
    https://kc.mcafee.com/corporate/index?page=content&id=KB83095

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

Security vulnerability found by Matthias Deeg of the SySS GmbH.

E-Mail: matthias.deeg (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc
Key fingerprint = 5AE3 96EE A014 FB90 9D81 AF90 8C54 7E88 A34C CED8

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" and 
without warranty of any kind. Details of this security advisory may be updated 
in order to provide as accurate information as possible. The latest version of 
this security advisory is available on the SySS Web site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iEYEAREKAAYFAlRTOxcACgkQjFR+iKNMztgnxQCeKZRuNSJKB51YROWopOsJw/AM
JgsAnRlNuO8T7sx9uCKV1dixyRKeBnmX
=D3fz
-----END PGP SIGNATURE-----