Western Digital has patched a security flaw that allowed hackers to brute force SanDisk SecureAccess credentials and get access to customers’ password-protected contents. SanDisk SecureAccess (formerly known as SanDisk PrivateAccess) is a program that allows you to save and safeguard sensitive data on SanDisk USB flash drives.
According to a security alert provided by Western Digital on Wednesday, SanDisk SecureAccess 3.02 used a one-way cryptographic hash with a predictable salt, leaving it open to dictionary attacks by a hostile user. The program also used a password hash that required too little computing work, allowing an attacker to brute force user passwords and gain unauthorized access to user data.
With the release of SanDisk PrivateAccess Version 6.3.5, which now employs PBKDF2-SHA256 with a randomly generated salt, the weakness (CVE-2021-36750) resulting from the key derivation function concerns described above has been fixed.
By visiting this page, you may get more information on updating your installation and moving your SecureAccess Vault to the new PrivateAccess Vault by visiting this page. This necessitates installing the most recent versions of the iXpand Drive mobile software, as well as the Windows and macOS Desktop.
According to Western Digital, “We urge our customers to install this software update immediately to keep their vaults secure. As with any upgrade, it’s best to back up your data before installing the upgrade. Back up your data using the built-in Backup function in the Tools menu.”
While it neglected to notify customers of the change, the business stated that it would offer new model numbers in the future when making hardware modifications that might affect the performance of its goods.
